Add basic configuration extracted from our running config

Cleaned of most stuff *from* our config, but a template is provided to help you get started.

.gitmodules

@@ -13,3 +13,15 @@
 [submodule "sources/modules/ngx-fancyindex"]
 	path = sources/modules/ngx-fancyindex
 	url = https://github.com/aperezdc/ngx-fancyindex
+[submodule "sources/modules/lua-nginx-module"]
+	path = sources/modules/lua-nginx-module
+	url = https://github.com/openresty/lua-nginx-module
+[submodule "sources/lua-resty-core"]
+	path = sources/lua-resty-core
+	url = https://github.com/openresty/lua-resty-core
+[submodule "sources/lua-resty-lrucache"]
+	path = sources/lua-resty-lrucache
+	url = https://github.com/openresty/lua-resty-lrucache
+[submodule "sources/luajit2"]
+	path = sources/luajit2
+	url = https://github.com/openresty/luajit2

README.md

@@ -1,3 +1,14 @@
 # `nginx-cn`
 
-Our build of NGINX we use.
+Our build of NGINX we use. Precompiled with OpenResty core and several other useful modules.
+
+# Build/installaction instructions
+
+```bash
+$ git clone --recursive https://git.computernewb.com/nginx-cn
+$ cd nginx-cn
+$ ./build
+# ./install
+# ... (copy the base config from conf/ into /opt/nginx/etc/nginx and adjust/add to suit your configuration)
+# profit?
+```

build

@@ -1,9 +1,13 @@
 #!/bin/bash
 
+# installation prefix. unfortunately we have to vendor
+# certains dependencies (luajit) so this /opt path is 
+# (probably) going to unfortunately stick.
 PREFIX="/opt/nginx"
 
 TOP="$(pwd)"
 
+# clean Nginx sources
 pushd sources/nginx/
 echo "cleaning nginx sources"
 git clean -dxf
@@ -56,6 +60,7 @@ BASE_CONFIGURE_FLAGS=(
   # Add modules into the build we use
   --add-module=$TOP/sources/modules/nginx-module-vts
   --add-module=$TOP/sources/modules/ngx-fancyindex
+  --add-module=$TOP/sources/modules/lua-nginx-module
 #  --add-module=$TOP/sources/modules/nginx-rtmp-module
 #  --add-module=$TOP/modules/nginx-dav-ext-module
 )
@@ -66,8 +71,28 @@ CFLAGS="-O3 -march=native -mtune=native -pipe -flto=thin -pipe" CC="clang" \
         ./configure 
 popd
 
+# build and install luajit and the resty lua libraries into prefix
+pushd $TOP/sources/luajit2
+	git clean -dxf
+	make PREFIX=$PREFIX -j49
+	sudo make PREFIX=$PREFIX install
+popd
+
+pushd $TOP/sources/lua-resty-core
+	sudo make install PREFIX=$PREFIX
+popd
+
+pushd $TOP/sources/lua-resty-lrucache
+	sudo make install PREFIX=$PREFIX
+popd
+
 pushd $TOP/sources/nginx
 
+# needed for lua-nginx-module
+export LUAJIT_INC="$PREFIX/include/luajit-2.1"
+export LUAJIT_LIB="$PREFIX/nginx/lib"
+
+# TODO: see ./install for --sbin-path
 ./auto/configure \
     --prefix=$PREFIX/etc/nginx \
     --conf-path=$PREFIX/etc/nginx/nginx.conf \

conf/bits/no-ranges.conf

@@ -0,0 +1,30 @@
+# no-ranges.conf
+
+# Disables ranges and adds a simple lua block
+# that will immediately fail requests.
+
+# "max_ranges 0" doesn't seem to really work the way you'd expect
+# which is kind of why I'm making this include..
+# This will actually properly not allow ranged connections.
+
+# Do the obligatory first
+max_ranges 0;
+
+# Add a Lua header filter that will explicitly 400
+# any HTTP requests with the "Range" header; regardless of
+# if they contain a valid range, set of ranges, or an invalid
+# range.
+#
+# We also add the "Accept-Ranges" header here, because unlike
+# nginx's native "add_header", it's not terminally broken and won't append
+# a duplicate header in certain contexts... Don't ask how I had to find that out.
+
+header_filter_by_lua_block {
+	local req_headers = ngx.req.get_headers();
+	ngx.header["Accept-Ranges"] = "none"
+
+	if req_headers["Range"] ~= nil then
+		ngx.log(ngx.ERR, "Request with ranges! Blocking")
+		return ngx.exit(400)
+	end
+}

conf/bits/wsproxy_params

@@ -0,0 +1,53 @@
+# wsproxy_params: Include file for configuring a location
+# to proxy a upstream with WebSocket support.
+# This file effectively makes WebSocket proxying 2 lines long.
+
+proxy_http_version 1.1;
+
+# ignore headers that could be used to alter how we handle
+# none of our proxied servers do this, but
+proxy_ignore_headers X-Accel-Redirect X-Accel-Buffering;
+
+# No buffering or redirect
+#proxy_buffering off;
+proxy_redirect off;
+
+# experiemnt: do use buffering and
+# use smaller buffer sizes
+proxy_buffering off;
+#proxy_buffer_size 4k;
+#proxy_buffers 8 4k;
+
+#proxy_buffer_size  128k;
+#proxy_buffers 100  128k;
+
+#proxy_set_header Host $host:$server_port;
+
+proxy_set_header Upgrade $http_upgrade;
+
+# TODO: this might be problemeatic, change this to $http_connection, or
+# the map in documentation.
+proxy_set_header Connection $connection_upgrade;
+
+# pass standard Websocket handshake headers
+proxy_set_header Sec-WebSocket-Extensions  $http_sec_websocket_extensions;
+proxy_set_header Sec-WebSocket-Protocol  $http_sec_websocket_protocol;
+proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
+
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # CHANGE use second if your server will be under cloudflare
+#proxy_set_header X-Forwarded-For $http_cf_connecting_ip;
+
+# I'd readd this, but to be kinda brutally honest,
+# this causes more issues than it really solves.
+#proxy_read_timeout      36000s;
+
+# hopefully this works?
+
+proxy_connect_timeout 10s;
+
+# Most of our stuff will disconnect you if you don't send anything in a reasonable
+# time frame, so this should be okay.
+
+#proxy_read_timeout 36000s;
+#proxy_read_timeout 960s;
+proxy_send_timeout 480s;

conf/fastcgi.conf

@@ -0,0 +1,26 @@
+
+fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;

conf/fastcgi_params

@@ -0,0 +1,25 @@
+
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;

conf/koi-utf

@@ -0,0 +1,109 @@
+
+# This map is not a full koi8-r <> utf8 map: it does not contain
+# box-drawing and some other characters.  Besides this map contains
+# several koi8-u and Byelorussian letters which are not in koi8-r.
+# If you need a full and standard map, use contrib/unicode2nginx/koi-utf
+# map instead.
+
+charset_map  koi8-r  utf-8 {
+
+    80  E282AC ; # euro
+
+    95  E280A2 ; # bullet
+
+    9A  C2A0 ;   # &nbsp;
+
+    9E  C2B7 ;   # &middot;
+
+    A3  D191 ;   # small yo
+    A4  D194 ;   # small Ukrainian ye
+
+    A6  D196 ;   # small Ukrainian i
+    A7  D197 ;   # small Ukrainian yi
+
+    AD  D291 ;   # small Ukrainian soft g
+    AE  D19E ;   # small Byelorussian short u
+
+    B0  C2B0 ;   # &deg;
+
+    B3  D081 ;   # capital YO
+    B4  D084 ;   # capital Ukrainian YE
+
+    B6  D086 ;   # capital Ukrainian I
+    B7  D087 ;   # capital Ukrainian YI
+
+    B9  E28496 ; # numero sign
+
+    BD  D290 ;   # capital Ukrainian soft G
+    BE  D18E ;   # capital Byelorussian short U
+
+    BF  C2A9 ;   # (C)
+
+    C0  D18E ;   # small yu
+    C1  D0B0 ;   # small a
+    C2  D0B1 ;   # small b
+    C3  D186 ;   # small ts
+    C4  D0B4 ;   # small d
+    C5  D0B5 ;   # small ye
+    C6  D184 ;   # small f
+    C7  D0B3 ;   # small g
+    C8  D185 ;   # small kh
+    C9  D0B8 ;   # small i
+    CA  D0B9 ;   # small j
+    CB  D0BA ;   # small k
+    CC  D0BB ;   # small l
+    CD  D0BC ;   # small m
+    CE  D0BD ;   # small n
+    CF  D0BE ;   # small o
+
+    D0  D0BF ;   # small p
+    D1  D18F ;   # small ya
+    D2  D180 ;   # small r
+    D3  D181 ;   # small s
+    D4  D182 ;   # small t
+    D5  D183 ;   # small u
+    D6  D0B6 ;   # small zh
+    D7  D0B2 ;   # small v
+    D8  D18C ;   # small soft sign
+    D9  D18B ;   # small y
+    DA  D0B7 ;   # small z
+    DB  D188 ;   # small sh
+    DC  D18D ;   # small e
+    DD  D189 ;   # small shch
+    DE  D187 ;   # small ch
+    DF  D18A ;   # small hard sign
+
+    E0  D0AE ;   # capital YU
+    E1  D090 ;   # capital A
+    E2  D091 ;   # capital B
+    E3  D0A6 ;   # capital TS
+    E4  D094 ;   # capital D
+    E5  D095 ;   # capital YE
+    E6  D0A4 ;   # capital F
+    E7  D093 ;   # capital G
+    E8  D0A5 ;   # capital KH
+    E9  D098 ;   # capital I
+    EA  D099 ;   # capital J
+    EB  D09A ;   # capital K
+    EC  D09B ;   # capital L
+    ED  D09C ;   # capital M
+    EE  D09D ;   # capital N
+    EF  D09E ;   # capital O
+
+    F0  D09F ;   # capital P
+    F1  D0AF ;   # capital YA
+    F2  D0A0 ;   # capital R
+    F3  D0A1 ;   # capital S
+    F4  D0A2 ;   # capital T
+    F5  D0A3 ;   # capital U
+    F6  D096 ;   # capital ZH
+    F7  D092 ;   # capital V
+    F8  D0AC ;   # capital soft sign
+    F9  D0AB ;   # capital Y
+    FA  D097 ;   # capital Z
+    FB  D0A8 ;   # capital SH
+    FC  D0AD ;   # capital E
+    FD  D0A9 ;   # capital SHCH
+    FE  D0A7 ;   # capital CH
+    FF  D0AA ;   # capital hard sign
+}

conf/koi-win

@@ -0,0 +1,103 @@
+
+charset_map  koi8-r  windows-1251 {
+
+    80  88 ; # euro
+
+    95  95 ; # bullet
+
+    9A  A0 ; #  
+
+    9E  B7 ; # ·
+
+    A3  B8 ; # small yo
+    A4  BA ; # small Ukrainian ye
+
+    A6  B3 ; # small Ukrainian i
+    A7  BF ; # small Ukrainian yi
+
+    AD  B4 ; # small Ukrainian soft g
+    AE  A2 ; # small Byelorussian short u
+
+    B0  B0 ; # °
+
+    B3  A8 ; # capital YO
+    B4  AA ; # capital Ukrainian YE
+
+    B6  B2 ; # capital Ukrainian I
+    B7  AF ; # capital Ukrainian YI
+
+    B9  B9 ; # numero sign
+
+    BD  A5 ; # capital Ukrainian soft G
+    BE  A1 ; # capital Byelorussian short U
+
+    BF  A9 ; # (C)
+
+    C0  FE ; # small yu
+    C1  E0 ; # small a
+    C2  E1 ; # small b
+    C3  F6 ; # small ts
+    C4  E4 ; # small d
+    C5  E5 ; # small ye
+    C6  F4 ; # small f
+    C7  E3 ; # small g
+    C8  F5 ; # small kh
+    C9  E8 ; # small i
+    CA  E9 ; # small j
+    CB  EA ; # small k
+    CC  EB ; # small l
+    CD  EC ; # small m
+    CE  ED ; # small n
+    CF  EE ; # small o
+
+    D0  EF ; # small p
+    D1  FF ; # small ya
+    D2  F0 ; # small r
+    D3  F1 ; # small s
+    D4  F2 ; # small t
+    D5  F3 ; # small u
+    D6  E6 ; # small zh
+    D7  E2 ; # small v
+    D8  FC ; # small soft sign
+    D9  FB ; # small y
+    DA  E7 ; # small z
+    DB  F8 ; # small sh
+    DC  FD ; # small e
+    DD  F9 ; # small shch
+    DE  F7 ; # small ch
+    DF  FA ; # small hard sign
+
+    E0  DE ; # capital YU
+    E1  C0 ; # capital A
+    E2  C1 ; # capital B
+    E3  D6 ; # capital TS
+    E4  C4 ; # capital D
+    E5  C5 ; # capital YE
+    E6  D4 ; # capital F
+    E7  C3 ; # capital G
+    E8  D5 ; # capital KH
+    E9  C8 ; # capital I
+    EA  C9 ; # capital J
+    EB  CA ; # capital K
+    EC  CB ; # capital L
+    ED  CC ; # capital M
+    EE  CD ; # capital N
+    EF  CE ; # capital O
+
+    F0  CF ; # capital P
+    F1  DF ; # capital YA
+    F2  D0 ; # capital R
+    F3  D1 ; # capital S
+    F4  D2 ; # capital T
+    F5  D3 ; # capital U
+    F6  C6 ; # capital ZH
+    F7  C2 ; # capital V
+    F8  DC ; # capital soft sign
+    F9  DB ; # capital Y
+    FA  C7 ; # capital Z
+    FB  D8 ; # capital SH
+    FC  DD ; # capital E
+    FD  D9 ; # capital SHCH
+    FE  D7 ; # capital CH
+    FF  DA ; # capital hard sign
+}

conf/nginx.conf

@@ -0,0 +1,123 @@
+# nginx.conf
+
+user http;
+
+worker_processes 24; # CHANGE to fit your system
+
+error_log  /var/log/nginx/error.log;
+
+pcre_jit on;
+
+events {
+	worker_connections 4096;
+	use epoll;
+
+	multi_accept off;
+	accept_mutex off;
+}
+
+http {
+	# Lua path
+	lua_package_path "/opt/nginx/lib/lua/?.lua;;";
+
+	vhost_traffic_status_zone;
+
+	include mime.types;
+	default_type  application/octet-stream;
+
+	# this is defined as a nicity here, and used by other files
+	map $http_upgrade $connection_upgrade {
+		default	upgrade;
+		''	keep-alive;
+	}
+
+	log_format main '$remote_addr - $remote_user [$time_local] '
+					'"$server_name" "$request" $status $body_bytes_sent "$http_referer" '
+					'"$http_user_agent' ;
+
+# CHANGE if you want to use systemd for journaling (probably not a bad idea), or some other syslogd (again, probably
+# not the worst idea), uncomment out this
+#	access_log syslog:server=unix:/dev/log,facility=local7,tag=nginx,severity=info main;
+
+	access_log  /var/log/nginx/access.log  main;
+
+	server_tokens off;
+
+	#map_hash_bucket_size 128;
+	#map_hash_max_size 8192;
+
+	sendfile        on;
+	tcp_nopush      on;
+	tcp_nodelay     on;
+
+	# :(
+	keepalive_timeout  3605;
+	#keepalive_timeout  65;
+	#send_timeout 60;
+	send_timeout 3600;
+
+	reset_timedout_connection on;
+
+	types_hash_max_size 4096;
+
+	gzip  on;
+	#gzip_disable "msie6";
+
+	gzip_vary on;
+	gzip_proxied any;
+	gzip_comp_level 3;
+	gzip_buffers 16 8k;
+	gzip_http_version 1.1;
+
+	gzip_min_length 10240;
+	gzip_types
+		application/atom+xml
+		application/geo+json
+		application/javascript
+		application/x-javascript
+		application/json
+		application/ld+json
+		application/manifest+json
+		application/rdf+xml
+		application/rss+xml
+		application/xhtml+xml
+		application/xml
+		font/eot
+		font/otf
+		font/ttf
+		image/svg+xml
+		text/css
+		text/javascript
+		text/plain
+		text/xml;
+
+	server {
+		access_log /dev/null; # avoid spamming our access logs with accesses to this
+				      # (do log errors though!)
+
+		listen 127.0.0.1:3950 bind reuseport;
+		location /status {
+			vhost_traffic_status_display;
+			vhost_traffic_status_display_format html;
+		}
+	}
+
+	# A dummy default server just to avoid any configuration mishaps.
+	# Also sets our bind and reuseport options for us :)
+	server {
+		server_name _;
+		listen (ipv4):80 bind reuseport default_server; # CHANGE like template.conf tells you to
+		listen [(ipv6)]:80 bind reuseport default_server;
+
+		# a nice message if anyone else see this
+		default_type 'text/plain';
+		location ^~ / {
+			content_by_lua_block {
+				ngx.say('You should not see this message (unless some infrastructure is screwing up and not passing a Host header). If you do yell loudly.')
+			}
+		}
+	}
+
+	# include all enabled sites
+	include sites/*;
+}

conf/scgi_params

@@ -0,0 +1,17 @@
+
+scgi_param  REQUEST_METHOD     $request_method;
+scgi_param  REQUEST_URI        $request_uri;
+scgi_param  QUERY_STRING       $query_string;
+scgi_param  CONTENT_TYPE       $content_type;
+
+scgi_param  DOCUMENT_URI       $document_uri;
+scgi_param  DOCUMENT_ROOT      $document_root;
+scgi_param  SCGI               1;
+scgi_param  SERVER_PROTOCOL    $server_protocol;
+scgi_param  REQUEST_SCHEME     $scheme;
+scgi_param  HTTPS              $https if_not_empty;
+
+scgi_param  REMOTE_ADDR        $remote_addr;
+scgi_param  REMOTE_PORT        $remote_port;
+scgi_param  SERVER_PORT        $server_port;
+scgi_param  SERVER_NAME        $server_name;

conf/template.conf

@@ -0,0 +1,45 @@
+# template for your own domain
+
+# this defines ratelimit parameters.
+# You can remove this if you don't want ratelimiting but it's a very good idea
+# and will heavily limit the effectiveness of attacks so it's probably best to leave it in place.
+limit_req_zone $binary_remote_addr zone=reqlimit_yourdomain:10m rate=20r/s; # CHANGE
+
+# an example upstream for reverse proxying
+#upstream myservice { 
+#	server 127.0.0.1:3002;
+#}
+
+server {
+	server_name yourdomain.net; # CHANGE
+	root /srv/http/yourdomain.net; # CHANGE
+
+	# TODO SSL
+
+	listen (ipv4):80; # CHANGE to your ipv4 address if using ipv4
+
+	listen [(ipv6)]:80; # CHANGE to your ipv6 address if you want ipv6,
+					   # or comment/remove if you don't have ipv6
+					   # (likewise, for ipv4 if you don't want ipv4)
+
+	index index.php index.html; # CHANGE if not using php
+
+	#autoindex on; # CHANGE if you want to use fancyindex, comment out the next line,
+	#fancyindex on; # CHANGE or just comment out the line above if you only want
+
+	limit_req zone=reqlimit_yourdomain burst=20 delay=8; # CHANGE zone=
+	limit_req_status 429;
+
+	# Example of doing reverse proxying
+	#location ^~ /myapi {
+	#	include bits/wsproxy_params;
+	#	proxy_pass http://myservice/;
+	#}
+
+
+	# CHANGE comment or remove this if your domain doesn't use php
+	location ~ \.php$ {
+		include fastcgi.conf;
+		fastcgi_pass unix:/run/php-fpm/php-fpm.sock;		
+	}
+}

conf/uwsgi_params

@@ -0,0 +1,17 @@
+
+uwsgi_param  QUERY_STRING       $query_string;
+uwsgi_param  REQUEST_METHOD     $request_method;
+uwsgi_param  CONTENT_TYPE       $content_type;
+uwsgi_param  CONTENT_LENGTH     $content_length;
+
+uwsgi_param  REQUEST_URI        $request_uri;
+uwsgi_param  PATH_INFO          $document_uri;
+uwsgi_param  DOCUMENT_ROOT      $document_root;
+uwsgi_param  SERVER_PROTOCOL    $server_protocol;
+uwsgi_param  REQUEST_SCHEME     $scheme;
+uwsgi_param  HTTPS              $https if_not_empty;
+
+uwsgi_param  REMOTE_ADDR        $remote_addr;
+uwsgi_param  REMOTE_PORT        $remote_port;
+uwsgi_param  SERVER_PORT        $server_port;
+uwsgi_param  SERVER_NAME        $server_name;

conf/win-utf

@@ -0,0 +1,126 @@
+
+# This map is not a full windows-1251 <> utf8 map: it does not
+# contain Serbian and Macedonian letters.  If you need a full map,
+# use contrib/unicode2nginx/win-utf map instead.
+
+charset_map  windows-1251  utf-8 {
+
+    82  E2809A ; # single low-9 quotation mark
+
+    84  E2809E ; # double low-9 quotation mark
+    85  E280A6 ; # ellipsis
+    86  E280A0 ; # dagger
+    87  E280A1 ; # double dagger
+    88  E282AC ; # euro
+    89  E280B0 ; # per mille
+
+    91  E28098 ; # left single quotation mark
+    92  E28099 ; # right single quotation mark
+    93  E2809C ; # left double quotation mark
+    94  E2809D ; # right double quotation mark
+    95  E280A2 ; # bullet
+    96  E28093 ; # en dash
+    97  E28094 ; # em dash
+
+    99  E284A2 ; # trade mark sign
+
+    A0  C2A0 ;   # &nbsp;
+    A1  D18E ;   # capital Byelorussian short U
+    A2  D19E ;   # small Byelorussian short u
+
+    A4  C2A4 ;   # currency sign
+    A5  D290 ;   # capital Ukrainian soft G
+    A6  C2A6 ;   # borken bar
+    A7  C2A7 ;   # section sign
+    A8  D081 ;   # capital YO
+    A9  C2A9 ;   # (C)
+    AA  D084 ;   # capital Ukrainian YE
+    AB  C2AB ;   # left-pointing double angle quotation mark
+    AC  C2AC ;   # not sign
+    AD  C2AD ;   # soft hypen
+    AE  C2AE ;   # (R)
+    AF  D087 ;   # capital Ukrainian YI
+
+    B0  C2B0 ;   # &deg;
+    B1  C2B1 ;   # plus-minus sign
+    B2  D086 ;   # capital Ukrainian I
+    B3  D196 ;   # small Ukrainian i
+    B4  D291 ;   # small Ukrainian soft g
+    B5  C2B5 ;   # micro sign
+    B6  C2B6 ;   # pilcrow sign
+    B7  C2B7 ;   # &middot;
+    B8  D191 ;   # small yo
+    B9  E28496 ; # numero sign
+    BA  D194 ;   # small Ukrainian ye
+    BB  C2BB ;   # right-pointing double angle quotation mark
+
+    BF  D197 ;   # small Ukrainian yi
+
+    C0  D090 ;   # capital A
+    C1  D091 ;   # capital B
+    C2  D092 ;   # capital V
+    C3  D093 ;   # capital G
+    C4  D094 ;   # capital D
+    C5  D095 ;   # capital YE
+    C6  D096 ;   # capital ZH
+    C7  D097 ;   # capital Z
+    C8  D098 ;   # capital I
+    C9  D099 ;   # capital J
+    CA  D09A ;   # capital K
+    CB  D09B ;   # capital L
+    CC  D09C ;   # capital M
+    CD  D09D ;   # capital N
+    CE  D09E ;   # capital O
+    CF  D09F ;   # capital P
+
+    D0  D0A0 ;   # capital R
+    D1  D0A1 ;   # capital S
+    D2  D0A2 ;   # capital T
+    D3  D0A3 ;   # capital U
+    D4  D0A4 ;   # capital F
+    D5  D0A5 ;   # capital KH
+    D6  D0A6 ;   # capital TS
+    D7  D0A7 ;   # capital CH
+    D8  D0A8 ;   # capital SH
+    D9  D0A9 ;   # capital SHCH
+    DA  D0AA ;   # capital hard sign
+    DB  D0AB ;   # capital Y
+    DC  D0AC ;   # capital soft sign
+    DD  D0AD ;   # capital E
+    DE  D0AE ;   # capital YU
+    DF  D0AF ;   # capital YA
+
+    E0  D0B0 ;   # small a
+    E1  D0B1 ;   # small b
+    E2  D0B2 ;   # small v
+    E3  D0B3 ;   # small g
+    E4  D0B4 ;   # small d
+    E5  D0B5 ;   # small ye
+    E6  D0B6 ;   # small zh
+    E7  D0B7 ;   # small z
+    E8  D0B8 ;   # small i
+    E9  D0B9 ;   # small j
+    EA  D0BA ;   # small k
+    EB  D0BB ;   # small l
+    EC  D0BC ;   # small m
+    ED  D0BD ;   # small n
+    EE  D0BE ;   # small o
+    EF  D0BF ;   # small p
+
+    F0  D180 ;   # small r
+    F1  D181 ;   # small s
+    F2  D182 ;   # small t
+    F3  D183 ;   # small u
+    F4  D184 ;   # small f
+    F5  D185 ;   # small kh
+    F6  D186 ;   # small ts
+    F7  D187 ;   # small ch
+    F8  D188 ;   # small sh
+    F9  D189 ;   # small shch
+    FA  D18A ;   # small hard sign
+    FB  D18B ;   # small y
+    FC  D18C ;   # small soft sign
+    FD  D18D ;   # small e
+    FE  D18E ;   # small yu
+    FF  D18F ;   # small ya
+}

install

@@ -8,11 +8,14 @@ TOP="$(pwd)"
 	exit 1
 }
 
+# N.B: We do not use nginx's `make install` because it's very very bad
+# and it overwrites $PREFIX/etc unconditionally. It's bad. I don't like it.
 pushd $TOP/sources
 sudo systemctl stop nginx-cn
 	# strip binary of unneeded fluff (saving the original)
 	cp nginx/objs/nginx nginx/objs/nginx.unstripped
 	strip nginx/objs/nginx
+	# FIXME: /opt/nginx/bin would probably be less annoying tbh..
 	sudo cp nginx/objs/nginx /opt/nginx/usr/bin
 sudo systemctl start nginx-cn
 #sudo make install

sources/lua-resty-core

@@ -0,0 +1 @@
+Subproject commit fc9e2ba34498fabc607754afa49b7721b47e7b70

sources/lua-resty-lrucache

@@ -0,0 +1 @@
+Subproject commit 82b5ab467aa46495db09499725eb87d4a7c1bc1c

sources/luajit2

@@ -0,0 +1 @@
+Subproject commit 15f58c9648ee40a3fb6617e22e2f3fdff80d66b8

sources/modules/lua-nginx-module

@@ -0,0 +1 @@
+Subproject commit 45db94a3440a12165b8d64495a4b5dd78678214f