docker-nginx-brotli

Alpine Linux image with nginx latest with, TLSv1.3, 0-RTT, brotli, NJS, Cookie-Flag support. All built on the bleeding edge. Built on the edge, for the edge.

Images for this are available on Docker Hub.

Usage

Docker Hub: docker pull woosungchoi/docker-nginx-brotli

This is a base image like the default nginx image. It is meant to be used as a drop-in replacement for the nginx base image.

Best practice example Nginx configs are available in this repo. See nginx.conf and h3.nginx.conf.

Example:

# Base Nginx HTTP/2 Image
FROM woosungchoi/docker-nginx-brotli:latest

# Copy your certs.
COPY localhost.key /etc/ssl/private/
COPY localhost.pem /etc/ssl/

# Copy your configs.
COPY nginx.conf /etc/nginx/
COPY h3.nginx.conf /etc/nginx/conf.d/

NOTE: Please note that you need a valid CA signed certificate for the client to upgrade you to HTTP/2. Let's Encrypt is a option for getting a free valid CA signed certificate.

Features

• HTTP/2 (with Server Push)
• BoringSSL (Google's flavor of OpenSSL)
• TLS 1.3 with 0-RTT support
• Brotli compression
• headers-more-nginx-module
• NJS
• nginx_cookie_flag_module
• PCRE latest with JIT compilation enabled
• zlib latest
• Alpine Linux (total size of 10 MB compressed)

HTTP/2 with Server Push

TLS v1.3

0-RTT Proof

Testing 0-RTT

host=domain.example.com # Replace your domain.
echo -e "GET / HTTP/1.1\r\nHost: $host\r\nConnection: close\r\n\r\n" > request.txt
openssl s_client -connect $host:443 -tls1_3 -sess_out session.pem -ign_eof < request.txt
openssl s_client -connect $host:443 -tls1_3 -sess_in session.pem -early_data request.txt