Why we actually build these packages
A quick story, because nobody maintains a 50-package APT repository for fun. (Okay — maybe a little bit for fun.)
Here’s the honest truth: this whole thing started because the packages we needed simply didn’t exist. We run real production servers — mail servers, web servers, WordPress sites, the works — and we kept hitting the same wall. We wanted NGINX with HTTP/3, but Debian shipped it without QUIC. We wanted Angie with native ACME, but it wasn’t in any official repository at all. We wanted ModSecurity with the OWASP Core Rule Set wired up properly, Postfix with modern TLS, Dovecot with the latest Sieve plugin, php-snuffleupagus hardening PHP-FPM, and a dozen other things. Every single one needed a custom build.
So we built them. And then we figured: if we’re already compiling all of this for our own infrastructure, why not share? That’s how deb.myguard.nl was born — a free, public, GPG-signed APT repository for Debian and Ubuntu that ships the packages we actually run in production. No telemetry, no registration, no “enterprise tier.” You just add the repository and apt-get install the things you need.
The four pillars we build for
1. Performance. Every package is compiled with sensible flags — LTO where it helps, hardened defaults that don’t cripple throughput, and modern allocators (jemalloc, mimalloc) linked in where they make a measurable difference. NGINX and Angie are built against a dedicated OpenSSL with QUIC patches, so HTTP/3 actually works instead of being a checkbox.
2. Security. The defaults matter. ModSecurity ships with the OWASP CRS pre-wired. PHP gets snuffleupagus for runtime hardening. TLS configs default to modern cipher suites. Packages are GPG-signed and delivered via the modern signed-by APT mechanism, so a compromised mirror can’t feed you a tampered binary. We sleep better, and so do the people running these on their own boxes.
3. Freshness. Debian stable is wonderful for stability and terrible for anyone who needs the latest Dovecot fix, a new Rspamd module, or NGINX mainline. We track upstream releases and rebuild quickly — usually within days, often within hours. Docker images for NGINX and Angie are rebuilt every single night, so containerised deployments stay current without anyone babysitting them.
4. The features the official repos won’t ship. HTTP/3, QUIC, Brotli, ModSecurity, OpenResty Lua modules, the full NGINX module zoo — everything that requires a custom compile lives here. You shouldn’t have to maintain your own build pipeline just to enable HTTP/3 in 2026.
Who actually uses this?
Honestly, all sorts. Sysadmins running production web stacks who don’t want to babysit a build server. Homelab folks who just want HTTP/3 on their Pi without compiling for three hours. Docker and Kubernetes users pulling the daily-rebuilt images. Mail server operators who finally want Postfix, Dovecot, and Rspamd to work together out of the box. The packages are the same whether you’re on Debian 12, Debian 13, Ubuntu 22.04, 24.04, or the new 26.04 — one repository, every current distro.
If any of that resonates, jump to the quick start below. If you’d rather poke around first, the blog has deep-dives on most of these packages — how HTTP/3 actually works, why Angie matters, the dedicated OpenSSL build, and a lot more.