Brotli for NGINX

Brotli is defined in RFC 7932 and reading the RFC is fun, it is most simply described by brotli.pro:
Brotli is an open-source algorithm from Google used for compression  It is an alternative to the famous GZIP compression. Several case studies have shown that Brotli excels in compression speed and file size in comparison to GZIP when using the default. Also, all modern browsers support Brotli by now, though only over HTTPS.
An implementation of Brotli is available for NGINX by Google. As it needs to be compiled from source I have attached my code below to build it for Debian/Ubuntu. 
Warning: Before any implementing HTTP compression, be aware that you may be exposing yourself to BREACH-attacks!
1
WORKDIR="~/ng_workdir"
2
mkdir $WORKDIR
3
​
4
# Get google/ngx_brotli source code + google/ngx_brotli submodules
5
cd $WORKDIR
6
git clone git://github.com/google/ngx_brotli.git
7
cd ngx_brotli
8
git submodule update --init
9
​
10
# Get the currently installed Nginx source code (Debian package)
11
cd $WORKDIR
12
apt source nginx
13
NGINX_SOURCE=$(ls -td -- */ | head -n 1 | cut -d'/' -f1)
14
cd $NGINX_SOURCE
15
​
16
# Find the ./configure line Nginx was compiled with
17
nginx -V
18
​
19
# *** REQUIRES HUMAN INTERACTION ***
20
# Call `./configure` with ALL arguments from "configure arguments:" output above, **except** for the `--add-dynamic-module` ones, and append `--add-dynamic-module=../ngx_brotli` to the end
21
./configure --with-cc-opt='-g -O2 ....................... --add-dynamic-module=../ngx_brotli
22
​
23
# Build and copy build modules to the right place
24
make modules
25
mkdir -p /usr/local/lib/nginx/modules/
26
sudo cp objs/ngx_http_brotli_filter_module.so /usr/local/lib/nginx/modules/
27
sudo cp objs/ngx_http_brotli_static_module.so /usr/local/lib/nginx/modules/
28
​
29
# cleanup
30
rm -rf $WORKDIR
Copied!
Enable by adding following to enforce Brotli compression in NGINX :
Enable brotli module
Configure Directives
/etc/nginx/modules-enabled/brotli-static.conf
1
load_module /usr/local/lib/nginx/modules/ngx_http_brotli_filter_module.so;
2
load_module /usr/local/lib/nginx/modules/ngx_http_brotli_static_module.so;
Copied!
nginx.conf
1
http {
2
    ...
3
    server {
4
        brotli on;
5
        brotli_min_length    1100;
6
        brotli_buffers       4 32k;
7
        brotli_types         text/css text/javascript text/xml text/plain text/x-component application/javascript application/x-javascript application/json application/xml  application/rss+xml font/truetype application/x-font-ttf font/opentype application/vnd.ms-fontobject image/svg+xml;
8
        brotli_comp_level    6;
9
    }
10
}
Copied!
​

DONE - Previous

HTTP Security Checklist

Next - In progress ...

TLS and Ciphers Suites

Last modified 1yr ago

Copy link