Free APT repository  ·  Open-source project  ·  No registration

Debian & Ubuntu APT repository for NGINX, Angie and HTTP/3

This is a free APT repository for Debian and Ubuntu with current builds of NGINX, Angie, OpenSSL, Postfix, Dovecot, ModSecurity and 50-odd other packages. They’re the packages we run on our own servers, compiled with the modules the official archives leave out: HTTP/3 in NGINX, Angie with ACME built in, a WAF that’s already wired up. Around the repository you’ll find NGINX and Angie modules we write ourselves, the Mailstrix mail malware scanner, ModSecurity CRS plugins and a growing pile of guides on running all of it.

# Installs GPG key, APT source and pinning in one step
$ wget https://raw.githubusercontent.com/eilandert/deb.myguard.nl/main/myguard.deb
$ dpkg -i myguard.deb
$ apt-get update && apt-get install nginx
Works on Debian 12/13 and Ubuntu 22.04/24.04/26.04  ·  amd64 + arm64  ·  Manual setup →  ·  How the repository is laid out
Browse packages Full setup guide Read the articles
100+
NGINX & Angie modules
50+
Packages, amd64 + arm64
60+
Deep-dive articles
2019
Active since

Why use this APT repository?

Debian and Ubuntu freeze package versions for the life of a release, and they don’t ship anything that needs a custom compile. For a distribution that’s the right call. For a server that needs HTTP/3 this year, it’s a problem.

// performance

Compiled, not just packaged

LTO where it helps, and jemalloc or mimalloc linked in where the allocator actually shows up in a profile. NGINX and Angie link against openssl-nginx, a dedicated OpenSSL build with QUIC support, so HTTP/3 works instead of sitting in the feature list.

// features

Modules the official repos skip

HTTP/3 and QUIC, Brotli compression, ModSecurity, the OpenResty Lua modules and njs with QuickJS. Anything that needs a custom compile lives here, and the NGINX module list has the rest.

// freshness

Days, not release cycles

We follow upstream releases rather than Debian’s freeze, so you get NGINX mainline, the current Dovecot and the latest Rspamd without waiting for a backport. Rebuilds usually land within days of a release. The changelog shows what moved recently.

// security

Hardened by default

php-snuffleupagus for PHP-FPM, ModSecurity with the OWASP Core Rule Set, a hardened OpenSSH with post-quantum key exchange, and modern TLS settings out of the box. The SSL Labs A+ guide covers the rest.

// containers

Docker & Kubernetes ready

NGINX and Angie images are rebuilt every night with all modules compiled in. If you run them as ingress, the Kubernetes guide covers Helm, the WAF and HTTP/3.

// trust

GPG-signed packages

Every package is signed, and the repository uses the modern signed-by APT setup, so a compromised mirror can’t hand you a tampered binary. The setup guide shows the key and the pinning.

More than a package repository

deb.myguard.nl started as an APT repository. These days it’s also where we publish web server modules, mail security tooling, WAF rule sets, Docker images and the guides that go with them. The code lives in the myguard-labs organisation on GitHub.

// mail security

Mailstrix

The owl that finds malware hiding in your mail. Mailstrix unpacks attachments (Office macros, RTF objects, PDFs, archives inside archives) and runs about 10,000 curated YARA rules over them, behind Rspamd, SpamAssassin, Dovecot Sieve or ICAP. How Mailstrix works · Office macro scanning with Olefy · GitHub

// web servers

Our own NGINX & Angie modules

Dynamic modules we write and maintain: zstd compression, fail2ban-style banning, a page cache, automatic certificates, exploit blocking. They ship as ordinary .deb packages. See all 100+ modules

// waf

ModSecurity CRS plugins

OWASP Core Rule Set plugins for apps we self-host: WordPress, Vaultwarden and ViMbAdmin. They exist because running a WAF in front of those apps without tuning means a lot of false positives. All CRS plugins

// knowledge

Articles & deep dives

60+ long-form guides on NGINX, Angie, TLS, mail servers, spam filtering and Docker, written from running the same packages in production. Start with the NGINX and Angie expert guide or browse everything.

// containers

Docker images

Nightly NGINX and Angie images with every module compiled in, plus a hardened Roundcube image, mail backends and docker-cms for PHP and WordPress. Image overview

// source

github.com/myguard-labs

Every module, plugin and tool is open source. Issues and pull requests are welcome, and the overview of all our repositories and images is the quickest way to find a specific project.

Why we build all this

Nobody maintains a 50-package APT repository for fun. Well, mostly not for fun.

It started because the packages we needed didn’t exist. We run mail servers, web servers and a handful of WordPress sites, and we kept hitting the same wall. Debian’s NGINX had no QUIC, so no HTTP/3. Angie wasn’t in any official repository. We wanted ModSecurity in front of NGINX with the OWASP Core Rule Set properly wired in, Postfix and Dovecot at their current releases, and php-snuffleupagus guarding PHP-FPM. Each of those meant a custom build.

So we built them. Once the pipeline existed and we were compiling everything for ourselves anyway, publishing the results was the obvious move. That’s deb.myguard.nl: a free, GPG-signed APT repository for Debian and Ubuntu with the packages we run in production. There’s no telemetry, no sign-up and no enterprise tier. You add the repository and apt-get install what you need. (If you’d rather run your own, we wrote up self-hosting an APT repository with aptly and how we keep Debian package builds fast.)

Repackaging only gets you so far. When an upstream module had bugs nobody was fixing, we forked it; the zstd module is the clearest example. When nothing existed, we wrote our own. Spam filters kept letting malware-laden attachments through, so we built Mailstrix. Putting a WAF in front of our own apps meant tuning out false positives, and those exclusions became CRS plugins. Most of what we learned along the way ended up in the articles section. The rule hasn’t changed: it runs on our servers first, then it gets published.

Want to try it? The quick start is further down. If you’d rather read first, good places to start are enabling HTTP/3 on NGINX, the Angie guide (including migrating from NGINX) and post-quantum TLS on NGINX and Angie.

Who uses this?

All sorts, but most people land here for one of four reasons.

// sysadmins

Production web stacks

You run NGINX or Angie in front of real traffic and don’t want to babysit a build server to get HTTP/3, Brotli and ModSecurity. Install, pin, done. Then tune it with the guides on reverse proxying, load balancing and rate limiting.

// homelab

Homelab & self-hosters

You want HTTP/3 on a Raspberry Pi or a closet server without three hours of ./configure. Same packages, arm64 included. Popular next steps: self-hosting Vaultwarden and hardening your Docker containers.

// containers

Docker & Kubernetes

You pull the nightly NGINX and Angie images with every module already compiled in, for ingress, edge proxies or short-lived pods. A slimmer option for PHP sites is nginx-minimal.

// mail ops

Mail server operators

Postfix with modern TLS, Dovecot with current Sieve, Rspamd and Mailstrix scanning attachments. The Postfix and Dovecot setup guide builds the whole stack, and ViMbAdmin manages the mailboxes.

One repository, every current distro: Debian 12 Debian 13 Ubuntu 22.04 Ubuntu 24.04 Ubuntu 26.04

Featured packages

The packages people install most. The full package list has 50+ across web, mail, security and system tools.

nginx
Mainline release with HTTP/3, QUIC, Brotli, ModSecurity and the standard modules
HTTP/3
angie
Drop-in NGINX replacement with native ACME (no Certbot) and extended metrics
HTTP/3 ACME
apache2
Current Apache HTTP Server built against OpenSSL 3
openssl
OpenSSL with QUIC support for HTTP/3 in NGINX and other tools
QUIC
postfix
Current Postfix with modern TLS and SRS support
Mail
dovecot
Current Dovecot IMAP/POP3 server with the Sieve plugin
Mail
rspamd
Fast spam filtering for Postfix and Dovecot
Mail
libmodsecurity3
ModSecurity WAF library with the OWASP Core Rule Set for NGINX and Apache
WAF
libbrotli
Google’s Brotli library, needed by the NGINX Brotli module
Compression
valkey
BSD-licensed Redis fork with a tight systemd sandbox and an AppArmor profile
Cache
openssh
Hardened OpenSSH with post-quantum key exchange and AppArmor
Security
php-snuffleupagus
Runtime hardening for PHP-FPM: blocks dangerous functions and common exploit paths
Security
libfido2
FIDO2 library for hardware keys (YubiKey) in OpenSSH and other tools
Security
ccache
Compiler cache for faster repeated builds
Dev

→ NGINX modules overview  ·  Angie modules overview  ·  Lua modules  ·  Full packages page  ·  Source on GitHub

NGINX & Angie modules we wrote ourselves

These aren’t repackaged upstream code. We develop and maintain them, and they ship as .deb packages for both NGINX and Angie.

// compression

zstd-nginx-module

Our fork of the Zstandard compression module, with several upstream bugs fixed and clean builds against current NGINX and Angie. What we fixed · What zstd is · GitHub

// abuse

error-abuse

Bans clients that flood you with 403, 404 or 5xx responses, fail2ban-style but inside NGINX. Sliding-window counters in shared memory, with optional cluster-wide bans through Redis or Valkey. Guide · GitHub

// cache

cache-turbo

A page cache inside NGINX itself, so you don’t need Varnish or a second daemon. Stale-while-revalidate, L1/L2 tiers and single-flight refresh. Guide · GitHub

// tls

autocert

Gets and renews TLS certificates over ACME from inside NGINX, so Certbot and its cron job can go. Guide · GitHub

// shield

http-shield

Blocks probes for ancient exploits cheaply, without running a full WAF. Guide · GitHub

// minify

strip-filter

Minifies CSS and JavaScript as NGINX serves it, for apps that ship unminified assets. Guide · GitHub

Writing a module of your own? Start from nginx-skeleton-module, a template with working CI, and catch leaks with nginx-test-harness. → All NGINX modules  ·  All Angie modules  ·  Every repo on GitHub

ModSecurity & the OWASP Core Rule Set

A complete WAF stack for NGINX, Angie and Apache: the ModSecurity v3 engine, the OWASP CRS, and our own CRS plugins for apps we self-host. If you’d rather not use ModSecurity, Coraza runs the same CRS rules.

// wordpress

WordPress hardening CRS plugin

40+ rules tuned for WordPress: typed-parameter SQLi blocking, rate limiting, GeoIP and an XML-RPC lockdown, all enforced before PHP starts. Guide · GitHub

// vaultwarden

vaultwarden-crs-plugin

Rules and exclusions that let the WAF sit in front of self-hosted Vaultwarden without blocking normal client traffic. GitHub

// vimbadmin

vimbadmin-crs-plugin

Rules and exclusions for the ViMbAdmin mail admin panel, so the WAF protects it without breaking its JSON-RPC API. GitHub

→ All our CRS plugins  ·  ModSecurity setup on Debian and Ubuntu  ·  Defending against AI exploit scanners  ·  JA3/JA4 TLS fingerprinting  ·  The BREACH attack

Guides & deep dives

Every package and module here came out of running real infrastructure, and most of the lessons became long-form guides. These are good places to start; the articles section has 60+ in total.

// nginx & web

NGINX, Angie & TLS

// mail & antispam

Mail servers & spam filtering

→ All articles  ·  Docker hardening for self-hosters  ·  Self-hosting your own APT repository  ·  Valkey vs Redis  ·  NGINX vs Apache benchmark

Supported distributions

Packages are built for all current Debian and Ubuntu releases, on amd64 and arm64.

Debian
Bookworm (12) Trixie (13)
Ubuntu
Jammy (22.04 LTS) Noble (24.04 LTS) Resolute (26.04)

Green = current/recommended. Every package is built for both amd64 (x86-64) and arm64 (aarch64). Curious about the next Debian release? Here’s what to expect from Debian 14 (Forky).

Quick start

Add the myguard APT repository and install your first package. It takes about a minute.

$ wget https://raw.githubusercontent.com/eilandert/deb.myguard.nl/main/myguard.deb
$ dpkg -i myguard.deb
$ apt-get update
# Web server with HTTP/3
$ apt-get install nginx
 
# NGINX alternative with built-in ACME/Let’s Encrypt
$ apt-get install angie
 
# Mail stack
$ apt-get install postfix dovecot-core rspamd
 
# WAF for NGINX
$ apt-get install libnginx-mod-http-modsecurity libmodsecurity3 modsecurity-crs

Need manual setup or APT pinning? → Full setup guide. Coming from nginx-full or nginx-light? Those packages are gone; here’s what replaced them.