From 482788e3bfdf2f75db63dd6473e518d7f19b76e4 Mon Sep 17 00:00:00 2001 From: Snrat Date: Wed, 26 Aug 2026 04:12:27 +0800 Subject: [PATCH 1/2] feat(openresty): add http.d include for panel-managed http directives Introduce `conf/http.d/`, a directory reserved for http-context directives that 1Panel generates and owns, mounted read-only into the container. `conf/modules-enabled/` cannot serve this purpose: it is included at the top level of nginx.conf because `load_module` is a main-context directive, so http-context directives such as `brotli on` cannot be placed there. The include is emitted before `conf.d/*.conf` so that per-site configuration continues to take precedence over panel-managed global defaults. `upgrade.sh` injects the include into existing installations, mirroring the handling already in place for the modules-enabled include. It is idempotent and degrades to a warning when the conf.d include is absent, which happens when a user has heavily customised nginx.conf. --- .../1.31.1.1-2-4-noble/conf/http.d/.gitkeep | 0 .../1.31.1.1-2-4-noble/conf/nginx.conf | 1 + .../1.31.1.1-2-4-noble/docker-compose.yml | 1 + .../1.31.1.1-2-4-noble/scripts/init.sh | 2 +- .../1.31.1.1-2-4-noble/scripts/upgrade.sh | 22 ++++++++++++++++++- 5 files changed, 24 insertions(+), 2 deletions(-) create mode 100644 apps/openresty/1.31.1.1-2-4-noble/conf/http.d/.gitkeep diff --git a/apps/openresty/1.31.1.1-2-4-noble/conf/http.d/.gitkeep b/apps/openresty/1.31.1.1-2-4-noble/conf/http.d/.gitkeep new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf b/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf index d1aa15366fbe..f60197a53225 100644 --- a/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf +++ b/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf @@ -46,6 +46,7 @@ http { limit_conn_zone $binary_remote_addr zone=perip:10m; limit_conn_zone $server_name zone=perserver:10m; + include /usr/local/openresty/nginx/conf/http.d/*.conf; include /usr/local/openresty/nginx/conf/conf.d/*.conf; include /usr/local/openresty/nginx/conf/default/*.conf; include /usr/local/openresty/1pwaf/data/conf/waf.conf; diff --git a/apps/openresty/1.31.1.1-2-4-noble/docker-compose.yml b/apps/openresty/1.31.1.1-2-4-noble/docker-compose.yml index bf1df68b34dc..99559e479cb1 100644 --- a/apps/openresty/1.31.1.1-2-4-noble/docker-compose.yml +++ b/apps/openresty/1.31.1.1-2-4-noble/docker-compose.yml @@ -19,6 +19,7 @@ services: - ./conf/default:/usr/local/openresty/nginx/conf/default/ - ./conf/ssl:/usr/local/openresty/nginx/conf/ssl/ - ./conf/modules-enabled:/usr/local/openresty/nginx/conf/modules-enabled/:ro + - ./conf/http.d:/usr/local/openresty/nginx/conf/http.d/:ro - ./modules:/usr/local/openresty/nginx/modules/1panel/:ro - ./log:/var/log/nginx - ./root:/usr/share/nginx/html diff --git a/apps/openresty/1.31.1.1-2-4-noble/scripts/init.sh b/apps/openresty/1.31.1.1-2-4-noble/scripts/init.sh index 494e80d096ca..c4584742c4a3 100755 --- a/apps/openresty/1.31.1.1-2-4-noble/scripts/init.sh +++ b/apps/openresty/1.31.1.1-2-4-noble/scripts/init.sh @@ -2,7 +2,7 @@ source ./.env -mkdir -p modules conf/modules-enabled +mkdir -p modules conf/modules-enabled conf/http.d sed -i -E "s/(listen[[:space:]]+)80([[:space:]]*default_server;)/\1${PANEL_APP_PORT_HTTP}\2/" conf/default/00.default.conf sed -i -E "s/(listen[[:space:]]+)\[::]:80([[:space:]]*default_server;)/\1\[::]:${PANEL_APP_PORT_HTTP}\2/" conf/default/00.default.conf diff --git a/apps/openresty/1.31.1.1-2-4-noble/scripts/upgrade.sh b/apps/openresty/1.31.1.1-2-4-noble/scripts/upgrade.sh index f921a27ac035..6573d8c24985 100644 --- a/apps/openresty/1.31.1.1-2-4-noble/scripts/upgrade.sh +++ b/apps/openresty/1.31.1.1-2-4-noble/scripts/upgrade.sh @@ -1,8 +1,10 @@ #!/bin/bash NGINX_CONF="conf/nginx.conf" MODULE_INCLUDE="include /usr/local/openresty/nginx/conf/modules-enabled/*.conf;" +HTTP_INCLUDE="include /usr/local/openresty/nginx/conf/http.d/*.conf;" +SITE_INCLUDE="include /usr/local/openresty/nginx/conf/conf.d/*.conf;" -mkdir -p modules conf/modules-enabled +mkdir -p modules conf/modules-enabled conf/http.d if [ ! -f "$NGINX_CONF" ]; then echo "✗ failed: $NGINX_CONF not found" @@ -13,6 +15,24 @@ if ! grep -Fq "$MODULE_INCLUDE" "$NGINX_CONF"; then sed -i "1i$MODULE_INCLUDE" "$NGINX_CONF" fi +# http.d holds panel-managed http-context directives (compression, module +# runtime settings). It must be included before conf.d so that per-site +# configuration keeps overriding the global defaults. +if ! grep -Fq "$HTTP_INCLUDE" "$NGINX_CONF"; then + if grep -Fq "$SITE_INCLUDE" "$NGINX_CONF"; then + awk -v site="$SITE_INCLUDE" -v http="$HTTP_INCLUDE" ' + !done && index($0, site) { + match($0, /^[ \t]*/) + printf "%s%s\n", substr($0, 1, RLENGTH), http + done = 1 + } + { print } + ' "$NGINX_CONF" > "$NGINX_CONF.tmp" && mv "$NGINX_CONF.tmp" "$NGINX_CONF" + else + echo "! skipped: conf.d include not found, add '$HTTP_INCLUDE' to the http block manually" + fi +fi + STREAM_BLOCK='stream { log_format streamlog '\''$remote_addr[$time_local] '\'' '\''$protocol $status $bytes_sent $bytes_received '\'' From 8cd3841b970b73282f82211768df21d37382812d Mon Sep 17 00:00:00 2001 From: Snrat Date: Wed, 26 Aug 2026 04:12:51 +0800 Subject: [PATCH 2/2] fix(openresty): correct gzip defaults and add missing compressible types MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These defaults have been unchanged since 1.21.4.3 and no longer match how sites are actually served. gzip_types was missing application/json, so JSON API responses were served uncompressed. For an API-backed site this is the single largest loss in the whole configuration. Also add ld+json, text/xml, xhtml+xml, rss+xml, atom+xml, wasm, svg+xml and ttf/otf, all of which compress well. Already compressed formats (images, woff2, archives) are deliberately excluded. gzip_comp_level 2 -> 5. Level 2 gives up roughly 8-15% ratio on text compared to level 5, which sits at the cost/ratio knee for gzip. gzip_proxied expired|no-cache|no-store|private|auth -> any. The previous value only compressed proxied responses carrying those specific Cache-Control semantics, so a common upstream response such as `Cache-Control: public, max-age=3600` matched no condition and was never compressed. This affected reverse-proxy sites, one of the main use cases. Drop gzip_disable "MSIE [1-6]\." — a per-request User-Agent regex for browsers with no measurable traffic share. gzip_static is intentionally not enabled: nginx does not verify that a `.gz` file is newer than its source, so a stale precompressed file would be served indefinitely with no error. The module stays compiled in and can be enabled per site by users who generate `.gz` artifacts at build time. --- apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf b/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf index f60197a53225..e5b060c8c45a 100644 --- a/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf +++ b/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf @@ -37,11 +37,10 @@ http { gzip_min_length 1k; gzip_buffers 4 16k; gzip_http_version 1.1; - gzip_comp_level 2; - gzip_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml; + gzip_comp_level 5; + gzip_types text/plain text/css text/xml text/javascript application/json application/ld+json application/javascript application/x-javascript application/xml application/xhtml+xml application/rss+xml application/atom+xml application/wasm image/svg+xml font/ttf font/otf; gzip_vary on; - gzip_proxied expired no-cache no-store private auth; - gzip_disable "MSIE [1-6]\."; + gzip_proxied any; limit_conn_zone $binary_remote_addr zone=perip:10m; limit_conn_zone $server_name zone=perserver:10m;