Brotli for NGINX

Brotli is defined in RFC 7932 and reading the RFC is fun, it is most simply described by brotli.pro:
Brotli is an open-source algorithm from Google used for compression  It is an alternative to the famous GZIP compression. Several case studies have shown that Brotli excels in compression speed and file size in comparison to GZIP when using the default. Also, all modern browsers support Brotli by now, though only over HTTPS.
An implementation of Brotli is available for NGINX by Google. As it needs to be compiled from source I have attached my code below to build it for Debian/Ubuntu. 
Warning: Before any implementing HTTP compression, be aware that you may be exposing yourself to BREACH-attacks!
WORKDIR="~/ng_workdir"
mkdir $WORKDIR
​
# Get google/ngx_brotli source code + google/ngx_brotli submodules
cd $WORKDIR
git clone git://github.com/google/ngx_brotli.git
cd ngx_brotli
git submodule update --init
​
# Get the currently installed Nginx source code (Debian package)
cd $WORKDIR
apt source nginx
NGINX_SOURCE=$(ls -td -- */ | head -n 1 | cut -d'/' -f1)
cd $NGINX_SOURCE
​
# Find the ./configure line Nginx was compiled with
nginx -V
​
# *** REQUIRES HUMAN INTERACTION ***
# Call `./configure` with ALL arguments from "configure arguments:" output above, **except** for the `--add-dynamic-module` ones, and append `--add-dynamic-module=../ngx_brotli` to the end
./configure --with-cc-opt='-g -O2 ....................... --add-dynamic-module=../ngx_brotli
​
# Build and copy build modules to the right place
make modules
mkdir -p /usr/local/lib/nginx/modules/
sudo cp objs/ngx_http_brotli_filter_module.so /usr/local/lib/nginx/modules/
sudo cp objs/ngx_http_brotli_static_module.so /usr/local/lib/nginx/modules/
​
# cleanup
rm -rf $WORKDIR
Enable by adding following to enforce Brotli compression in NGINX :
Enable brotli module
Configure Directives
/etc/nginx/modules-enabled/brotli-static.conf
load_module /usr/local/lib/nginx/modules/ngx_http_brotli_filter_module.so;
load_module /usr/local/lib/nginx/modules/ngx_http_brotli_static_module.so;
nginx.conf
http {
    ...
    server {
        brotli on;
        brotli_min_length    1100;
        brotli_buffers       4 32k;
        brotli_types         text/css text/javascript text/xml text/plain text/x-component application/javascript application/x-javascript application/json application/xml  application/rss+xml font/truetype application/x-font-ttf font/opentype application/vnd.ms-fontobject image/svg+xml;
        brotli_comp_level    6;
    }
}
​

DONE - Previous

HTTP Security Checklist

Next - In progress ...

TLS and Ciphers Suites

Last modified 1yr ago

Copy link