Generated by Rank Math SEO, this is an llms.txt file designed to help LLMs better understand and index this website.

# deb.myguard.nl: Building packages, building the web

## Sitemaps
[XML Sitemap](https://deb.myguard.nl/sitemap_index.xml): Includes all crawlable and indexable pages.

## Posts
- [AI coding without amnesia: inside the MyGuard workflow](https://deb.myguard.nl/articles/ai-coding-workflow-memory-skills-review/): How our AI coding workflow connects shared memory, SQLite, Claude and Codex skills, grind, CodeRabbit, PR-agent, and tested ast-grep rules.
- [nginx-skeleton-module: An nginx Module Template With Working CI](https://deb.myguard.nl/articles/nginx-skeleton-module/): Cache one build tree across debug and ASan and your sanitizer job goes green testing nothing. nginx-skeleton-module is the nginx module template with those traps already closed.
- [nginx-test-harness: Leak Testing for nginx and Angie Modules](https://deb.myguard.nl/articles/nginx-test-harness/): A leaked fd is not a memory error, so ASan never sees it. nginx-test-harness catches fd and cycle-pool leaks in nginx and Angie modules, in plain C, no Perl.
- [nginx-http-shield-module: Block Ancient Exploits Without a WAF](https://deb.myguard.nl/articles/nginx-http-shield-module/): nginx-http-shield-module blocks Log4Shell, Shellshock, SQL injection and ~400 other long-patched exploits in about a microsecond. No WAF, no rules files, near-zero false positives.
- [Debian Forky (Debian 14): What It Is and What to Expect](https://deb.myguard.nl/articles/debian-forky-debian-14-what-to-expect/): Debian Forky is the codename for Debian 14, the next stable release after Trixie. Here is what testing looks like now, what is being deprecated, and how to try it without setting prod on fire.
- [nginx-strip-filter-module: CSS and JavaScript Minification](https://deb.myguard.nl/articles/nginx-strip-filter-module/): A safe NGINX response filter for minifying HTML, CSS, JavaScript, JSON, SVG and XML, plus the cache-turbo setup that keeps generated assets quick without turning workers into a Node build farm.
- [nginx-autocert-module: Automatic TLS Certs, No Certbot](https://deb.myguard.nl/articles/nginx-autocert-module/): An open-source NGINX module that bakes a full ACME client into the server itself. Write autocert on; and NGINX gets, serves and renews its own Let's Encrypt certificates — no certbot, no cron, no reload.
- [Olefy and rspamd: scan Office macro malware in your mail](https://deb.myguard.nl/articles/olefy-rspamd-office-macro-scanning/): Olefy lets rspamd run oletools against Office attachments to catch VBA-macro malware. Here is how it works, where stock olefy falls over under load, and how olefied makes it survive a real mail stream.
- [YARA malware scanning in Rspamd: unwrap malicious mail](https://deb.myguard.nl/articles/yara-malware-scanning-mailstrix/): YARA malware scanning in Rspamd unpacks OLE, VBA, PDFs and nested attachments before detection rules inspect the dangerous bits.
- [DCC, Razor and Pyzor for Rspamd: One Docker Backend](https://deb.myguard.nl/articles/rspamd-dcc-razor-pyzor/): Run DCC, Razor and Pyzor for rspamd from one token-authed Docker backend that never blocks the scanner and never writes your mail to disk. Here is how the shim works and why it looks the way it does.
- [Coraza WAF on NGINX: The Go-Powered ModSecurity Replacement](https://deb.myguard.nl/articles/coraza-waf-nginx-modsecurity-replacement/): Coraza is the memory-safe, Go-written WAF that speaks ModSecurity's language and runs the OWASP CRS unchanged. Here is what libcoraza and the nginx-coraza module are, why we package them, and the fork-deadlock gotcha nobody warns you about.
- [JA3/JA4 TLS Fingerprinting: How It Works and Is It Safe to Block?](https://deb.myguard.nl/articles/ja3-ja4-tls-fingerprinting-nginx/): JA3 and JA4 TLS fingerprinting read the bytes of the ClientHello to spot the software behind a connection, even when it lies about its User-Agent. Here is how it works on nginx with ngx_ssl_fingerprint_module, and why blocking on a fingerprint is riskier than it looks.
- [How to cache pages in nginx with cache-turbo (no Varnish)](https://deb.myguard.nl/articles/nginx-cache-turbo/): A page cache that lives inside nginx: no Varnish, no Lua, no second daemon. How cache-turbo uses stale-while-revalidate, L1/L2 tiers and single-flight refresh to keep your backend asleep under load.
- [Auto-Ban Abusive Clients in NGINX with the error-abuse module](https://deb.myguard.nl/articles/nginx-error-abuse/): That gap is exactly what the nginx-error-abuse-module closes. It's a dynamic NGINX module, written in C, that watches the status codes your server hands back and temporarily blocks any client generating too many errors. A hundred errors in five minutes? Gone for an hour. Think fail2ban, except it lives inside the worker process instead of tailing a log file from the outside, and it makes its decision before the next request ever reaches your application.
- [KAM.cf in Rspamd: 3,668 SpamAssassin Rules, Native Lua, No Perl](https://deb.myguard.nl/articles/kam-cf-rspamd-lua-converter/): KAM.cf is 3,668 SpamAssassin rules after conversion. Loading it through Rspamd compat mode drags dead rules and unmapped symbols along. Here is the converter that transpiles it to native Rspamd Lua instead.
- [How to defend your webserver against vibe-coded AI exploit scanners and bots](https://deb.myguard.nl/articles/block-ai-scanner-bots-nginx/): Half of all web traffic is bots, and a growing slice are vibe-coded AI scanners written by a chatbot prompt. Here is the five-layer defense in depth that stops them: rate limiting, WAF, TLS hardening, request validation, access control, PHP and Docker hardening, plus the patching that does the most work.
- [WordPress Hardening Plugin for ModSecurity CRS: Block Attacks Without Touching Your PHP](https://deb.myguard.nl/articles/wordpress-hardening-modsecurity-plugin/): WordPress XSS and SQL injection CVEs are exploding because AI now finds them faster than you can patch. This ModSecurity CRS plugin is the last wall: 40+ rules, typed-parameter SQLi blocking, rate limiting and GeoIP — before PHP ever boots.
- [Dovecot, Post-Quantum TLS and Sieve: The BOFH Guide to a Hardened IMAP Server](https://deb.myguard.nl/articles/dovecot-post-quantum-tls-sieve/): A cryptographically relevant quantum computer doesn't exist yet, and a nation-state is almost certainly recording your IMAP session anyway. That's not paranoia, it's procurement: encrypted traffic is cheap to store and patient adversaries are betting that the RSA key protecting your mailbox today will be trivially crackable in 2032. They're probably right. The strategy even has a name in the literature, "harvest now, decrypt later", and it's the single best reason to turn on Dovecot post-quantum TLS this year, not when the headlines force you to. Dovecot post-quantum TLS is the whole point of this guide.
- [HTTP/2 Bomb (CVE-2026-49975): The Memory DoS an AI Found](https://deb.myguard.nl/articles/http2-bomb-cve-2026-49975/): An AI noticed two ten-year-old HTTP/2 tricks could be combined into one critical exploit. CVE-2026-49975, the HTTP/2 Bomb, drives a single server to 32 GB of memory in seconds. Here is how it works on nginx, Apache, IIS, Envoy and Pingora — and how to defend it.
- [Hardened Roundcube Docker: The Webmail Container That Trusts Nobody](https://deb.myguard.nl/articles/hardened-roundcube-docker-image/): Our hardened Roundcube Docker image runs as nobody, can chown nothing, and treats every request as hostile. Here is the full unprivileged + WAF security model — and why default webmail containers are a liability.
- [ViMbAdmin: The Postfix + Dovecot Mailbox Admin Panel (Modernised for PHP 8.5)](https://deb.myguard.nl/articles/vimbadmin-mailbox-admin/): Your mailbox table deserves better than raw SQL at 02:00. ViMbAdmin — modernised for PHP 8.5 — manages Postfix + Dovecot virtual domains, mailboxes and aliases via web UI or JSON-RPC API, with TOTP, brute-force protection and a hardened Docker image.
- [Speed Up Debian Package Builds: eatmydata, mold, ccache, distcc, tmpfs — The Whole Shambam](https://deb.myguard.nl/articles/speed-up-debian-package-builds/): Five tools — eatmydata, mold, ccache, distcc, tmpfs — turn a 14-minute build into 90 seconds. Same compiler, same hardware. Any build system: make, cmake, autotools, ninja, Debian packaging. Here is how to wire them in, what each one breaks, and the order to enable them in.
- [The New deb.myguard.nl Repository Layout: Per-Package APT Trees Explained](https://deb.myguard.nl/articles/deb-myguard-repository-layout/): The deb.myguard.nl APT repository now publishes clean per-distribution and per-package trees under /apt/. Here is why we split the old mixed pool, how the new layout works, and how to add exactly the packages you want.
- [njs + QuickJS-NG on NGINX: real JavaScript in your web server, finally](https://deb.myguard.nl/articles/nginx-njs-quickjs/): Stock njs is an ES5.1 subset with selected ES6 bits and a wall behind every modern feature. Rebuild it against QuickJS-NG and you get a real ES2023 runtime inside NGINX — async/await, BigInt, Proxy, dynamic import(), modern regex, Intl, the lot. Here is what changes, how the build wires it together, and copy-paste examples.
- [Postfix 3.11: Post-Quantum TLS, TLSRPT, Milters and the Modern MTA Stack](https://deb.myguard.nl/articles/postfix-3-11-post-quantum-tls/): This is a tour of what's actually new in Postfix 3.11, why post-quantum key exchange in SMTP is not just security theatre, and how the deb.myguard.nl Postfix package and the matching eilandert/postfix container build it. There is config you can paste, history you can blame, and one moderately bad joke about Sendmail. Buckle in.
- [Google Instant Indexing API for WordPress: end-to-end setup (service account, JWT, OAuth2)](https://deb.myguard.nl/articles/google-instant-indexing-api-wordpress/): Service account, JWT signing, OAuth2 dance, JSON key paste — the complete setup for Google's Instant Indexing API on WordPress, with verified quota via Cloud Monitoring and an honest take on what it actually does for non-JobPosting content.
- [Self-Hosting Aptly: Run Your Own Debian APT Repository Behind NGINX](https://deb.myguard.nl/articles/self-hosting-aptly-apt-repository/): Aptly turns a folder of .deb files into a real signed APT repository — the same way deb.myguard.nl serves thousands of packages. Here is the full self-hosting walkthrough: install, sign, publish, NGINX, automation.
- [HTTP/3 and QUIC on NGINX: Real-World Setup, Tuning, and Gotchas (2026)](https://deb.myguard.nl/articles/http3-quic-nginx-guide/): HTTP/3 finally works in mainline NGINX, but the config has sharp edges. Here is the real-world setup, the UDP sysctl knobs that actually matter, and the gotchas (alt-svc, MTU, ModSecurity, load balancers) that bite you in production.
- [Hardened OpenSSH 10.3 for Debian and Ubuntu: PQ Crypto, AppArmor, 3 sshd Flavours](https://deb.myguard.nl/articles/hardened-openssh/): The myguard OpenSSH 10.3 package rebuilds sshd for production servers: post-quantum key exchange, AEAD-only ciphers, an AppArmor profile, a fail2ban jail, monthly moduli regeneration, three switchable sshd flavours (default / gssapi / minimal), and compiler hardening beyond Debian's default. Includes a 2026 SSH key-generation walkthrough and a stack of server-hardening tips.
- [Docker Hardening for Self-Hosters: Rootless, Read-Only, Cap-Drop, Distroless (2026 Guide)](https://deb.myguard.nl/articles/docker-hardening-rootless-readonly-distroless/): Default Docker is barely a container at all — root, mutable, all caps, shared kernel. This is the ten-flag hardening checklist that turns it into something a real attacker has to work to break: rootless, read-only, cap-drop, no-new-privileges, distroless, secrets, segmentation, scanning. With a worked NGINX + PHP-FPM compose example.
- [Rspamd Explained: How Modern Spam Filtering Actually Works (Bayes, Neural Nets, RBLs and All the Cool Tricks)](https://deb.myguard.nl/articles/rspamd-explained-spam-filtering/): Rspamd is the modern spam filter that runs Bayesian classifiers, neural networks, greylisting, DNS blacklists, Pyzor, Razor, OLEFY and DCC — all at once. Here is what rspamd does, how spam evolved, and why it crushes the inbox war.
- [Valkey Explained: The Redis Fork That Actually Won (And Why Our Debian Package Is Worth It)](https://deb.myguard.nl/articles/valkey-explained-redis-fork/): Valkey is the BSD-licensed, Linux Foundation-backed fork of Redis — and as of 2026 it has overtaken Redis itself. Here is what Valkey is, why it exists, and why our hardened deb.myguard.nl build is the smartest way to install it on Debian or Ubuntu.
- [Self-Hosted Vaultwarden: Docker Setup, Clients & Full Guide](https://deb.myguard.nl/articles/self-hosted-vaultwarden/): Run your own password manager with self-hosted Vaultwarden — a tiny Docker image, full Bitwarden client compatibility, and total control over your encrypted vault.
- [What Is the BREACH Attack? How It Works and How to Stop It](https://deb.myguard.nl/articles/breach-attack-explained-prevention/): BREACH is a compression side-channel attack that can leak CSRF tokens and other secrets over HTTPS. Here is how the BREACH attack works, why padding is weak protection, and how to prevent it properly.
- [What Is Zstd? NGINX, Angie, History and Browser Support](https://deb.myguard.nl/articles/what-is-zstd/): Zstd is the fast compression format suddenly showing up in browsers, package managers, and modern web stacks. Here is what it is, where it came from, which browsers and web servers support it, and how to use it with NGINX and Angie today.
- [Database Boost: Free WordPress Database Optimization Plugin](https://deb.myguard.nl/articles/database-boost-wordpress-plugin/): Meet Database Boost, the free WordPress database optimization plugin that cleans, repairs, optimizes and indexes your database — and actually explains every step in plain English.
- [How to Install ModSecurity and OWASP CRS on NGINX (Step-by-Step)](https://deb.myguard.nl/articles/install-modsecurity-owasp-crs-nginx/): A beginner-friendly, step-by-step guide to installing ModSecurity and the OWASP Core Rule Set on NGINX for Debian and Ubuntu — from zero to a live WAF without taking your site down.
- [Zstd vs Brotli vs zlib-ng: The NGINX Compression Deep Dive](https://deb.myguard.nl/articles/nginx-zstd-vs-brotli-vs-zlib-ng-compression/): Zstd vs Brotli vs zlib-ng only makes sense once you separate browser encodings from compression engines. This deep dive covers support, CPU trade-offs, static vs dynamic compression, and the NGINX production patterns that actually work.
- [Angie 1.11.5 Released: 5 Security Fixes Explained](https://deb.myguard.nl/articles/angie-1-11-5-release-security-fixes/): Angie 1.11.5 fixes five upstream security issues, including HTTP/3, OCSP, rewrite, SCGI/UWSGI, and charset handling hardening. Here is what changed and why it matters.
- [WordPress NGINX Configuration: PHP-FPM Tuning, FastCGI Cache and Redis (2026 Guide)](https://deb.myguard.nl/articles/wordpress-nginx-php-fpm-config/): The complete WordPress + NGINX + PHP-FPM setup for Debian and Ubuntu: server block config, pool tuning, FastCGI caching for anonymous traffic, Redis object cache, Brotli compression, and security hardening with ModSecurity and Snuffleupagus.
- [NGINX Load Balancing: Upstream Config, Health Checks and Failover](https://deb.myguard.nl/articles/nginx-load-balancing-upstream-guide/): NGINX load balancing distributes traffic across multiple backends with automatic failover. This guide covers all five load balancing algorithms, passive health checks, keepalive connection pooling, backup servers, and TCP/UDP load balancing.
- [NGINX Reverse Proxy Configuration: The Complete Setup Guide](https://deb.myguard.nl/articles/nginx-reverse-proxy-configuration-guide/): A reverse proxy puts NGINX in front of your Node.js, Python, or PHP backend — handling SSL termination, caching, buffering, and security. This guide covers proxy_pass, upstream keepalive, caching, WebSocket proxying, and security headers.
- [NGINX Rate Limiting: Protect Your Server from Bots, Scrapers and Brute Force](https://deb.myguard.nl/articles/nginx-rate-limiting-guide/): NGINX rate limiting with limit_req_zone stops credential stuffing, scrapers, and DDoS floods before they reach your application. This guide covers burst handling, per-endpoint limits, IP whitelisting, WordPress-specific config, and Redis-backed cross-server limiting.
- [NGINX Brotli Compression: Install, Configure and Pre-Compress Static Assets](https://deb.myguard.nl/articles/nginx-brotli-compression-module-guide/): Brotli achieves 15-26% better compression than gzip on HTML, CSS, and JavaScript. This guide covers installing the NGINX Brotli module, configuring on-the-fly compression, pre-compressing static assets at level 11, and running Brotli alongside gzip.
- [PHP Snuffleupagus Tutorial — Harden PHP-FPM on Debian and Ubuntu (2026)](https://deb.myguard.nl/articles/php-snuffleupagus/): A friendly, jargon-free walkthrough: install Snuffleupagus from the myguard APT repo, pick the right rulebook for your stack (WordPress, Roundcube, generic PHP, internal agent), wire it into a PHP-FPM pool, and avoid the 5 traps that bite everyone the first time.
- [Postfix + Dovecot Mail Server Setup on Debian 12 and 13 (2026 Guide)](https://deb.myguard.nl/articles/postfix-dovecot-setup-debian/): A complete Postfix + Dovecot + Rspamd mail server on Debian 12 and 13 — with TLS, DKIM, SPF, DMARC, spam filtering, virtual mailboxes, security hardening, and a 10/10 score on mail-tester.com. No shortcuts.
- [NGINX ModSecurity Setup on Debian and Ubuntu: WAF with OWASP Core Rule Set](https://deb.myguard.nl/articles/nginx-modsecurity-setup-debian-ubuntu/): ModSecurity v3 with the OWASP CRS blocks SQL injection, XSS, shell injection, and scanner traffic at the HTTP layer. This guide covers installation, CRS paranoia levels, WordPress tuning, false positive handling, and performance impact.
- [NGINX vs Apache Benchmark 2026: Performance, Memory and Real-World Throughput](https://deb.myguard.nl/articles/nginx-vs-apache-benchmark-2026/): NGINX beats Apache at static files and high concurrency; Apache wins on .htaccess flexibility and legacy app compatibility. Benchmark tables for static files, PHP-FPM, TLS handshakes, and memory under load.
- [How to Enable HTTP/3 on NGINX for Debian and Ubuntu (QUIC Guide 2026)](https://deb.myguard.nl/articles/nginx-http3-quic-debian-ubuntu/): HTTP/3 runs on QUIC over UDP, eliminating TCP head-of-line blocking and enabling 0-RTT connection resumption. This guide covers installation, configuration, 0-RTT security, load balancer setup, and performance tuning.
- [OpenSSL 4.0 for NGINX: Upgrading openssl-nginx from 3.x to 4.0 — What Changes and Why It Matters](https://deb.myguard.nl/articles/openssl-4-nginx-upgrade/): We just upgraded our openssl-nginx package from OpenSSL 3.x to OpenSSL 4.0. This guide explains what openssl-nginx is, what changed in version 4.0, the real pros and cons of upgrading, and how to do it safely on your Debian or Ubuntu server.

## Pages
- [ViMbAdmin CRS Plugin](https://deb.myguard.nl/modsecurity-crs/vimbadmin/): A drop-in OWASP CRS 4.0+ plugin that makes the Core Rule Set play nicely with ViMbAdmin — the Postfix/Dovecot mailbox admin panel — and optionally locks the panel down to a strict allowlist.
- [Vaultwarden CRS Plugin](https://deb.myguard.nl/modsecurity-crs/vaultwarden/): A drop-in OWASP CRS 4.0+ plugin that makes the Core Rule Set play nicely with Vaultwarden — the Rust, Bitwarden-compatible server — and optionally locks the host down to Vaultwarden’s known route map.
- [WordPress Hardening Plugin (ModSecurity CRS)](https://deb.myguard.nl/modsecurity-crs/wordpress-hardening/): An OWASP CRS 4.0+ plugin that adds 40+ extra rules to harden WordPress at the WAF — before PHP ever loads. It does not duplicate what CRS already does (libinjection @detectSQLi/@detectXSS on all arguments); it adds the semantic, typed-parameter validation CRS lacks — exactly where the 2025–2026 wave of AI-discovered WordPress plugin SQLi/XSS CVEs slips through.
- [ModSecurity & OWASP CRS Plugins](https://deb.myguard.nl/modsecurity-crs/): The OWASP Core Rule Set (CRS) running on ModSecurity v3 is the WAF stack we put in front of every app we self-host. The engine and the rule set are generic by design — they don’t know what your application’s legitimate traffic looks like. That gap is exactly what a CRS plugin fills: per-app false-positive exclusions so real requests aren’t blocked, plus optional positive-security allowlists so everything the app doesn’t use is denied.
- [Sitemap](https://deb.myguard.nl/sitemap/)
- [NGINX](https://deb.myguard.nl/nginx/): Index page for nginx-related resources on deb.myguard.nl.
- [Contact](https://deb.myguard.nl/contact/): No ticket portal, no "your request is important to us" hold music. Two channels, both watched by an actual human: GitHub for anything worth keeping on the record, Discord for the back-and-forth. Pick whichever fits the conversation.
- [Where To Find Us — All Our Repos, Docker Images & GitHub Projects](https://deb.myguard.nl/where-to-find-us/): Welcome to the official hub for every place you can find our open-source work, our packaged builds, and the conversations happening around them. If you've landed here from a Reddit thread, a GitHub README, a Docker pull command, or just a curious Google search — congratulations, you're in the right spot. This page is the one-stop directory of everything we publish, host, and tinker with. Bookmark it. Share it with that one friend who always asks "but where do I actually download it?" Yes, this is the answer.
- [NGINX APT Repository for Debian & Ubuntu — 104 Modules, No Compiling](https://deb.myguard.nl/nginx-modules/): Hardened mainline NGINX (and Angie) for Debian and Ubuntu: HTTP/3, kTLS, ModSecurity v3, Brotli, Zstandard, Lua/NJS and 104 dynamic modules — daily rebuilt and ready to apt-install.
- [Debian & Ubuntu APT Repository – Performance-Optimized Packages](https://deb.myguard.nl/): Add the myguard Debian/Ubuntu APT repository and install your first package in under a minute.
- [Articles](https://deb.myguard.nl/articles/)
- [Angie Web Server for Debian & Ubuntu — the Maintained NGINX Fork](https://deb.myguard.nl/angie-modules-optimized-extended/): Angie web server with 50+ dynamic modules: ModSecurity WAF, GeoIP2, Brotli, Zstd, Lua, OpenSSL-NGINX, HTTP/3 QUIC. Native ACME/Let's Encrypt, 100% NGINX config-compatible. Optimized packages for Debian and Ubuntu.
- [Angie and NGINX Docker Images – Daily Rebuilt with All Modules](https://deb.myguard.nl/nginx-dockerized/): Daily-rebuilt Docker images for NGINX and Angie with 50+ dynamic modules selectable via the NGX_MODULES environment variable. Includes PHP-FPM 7.4-8.4, HTTP/3 QUIC, ModSecurity WAF, jemalloc and Brotli. Drop-in replacement for the official nginx Docker image.
- [OpenResty Lua Modules for NGINX and Angie – APT Packages](https://deb.myguard.nl/lua-modules/): APT packages for the full OpenResty lua-resty-* ecosystem for NGINX and Angie on Debian and Ubuntu: Redis, MySQL, HTTP client, JWT, OpenID Connect, WebSocket, rate limiting, LRU cache, DNS resolver, HMAC, session management and more. Includes LuaJIT 2 and lua-cjson.
- [Packages](https://deb.myguard.nl/packages/): deb.myguard.nl is a free, community-driven APT repository providing optimized and security-focused packages for Debian and Ubuntu production servers. Every package is compiled with the right flags, linked against the right libraries, and updated within hours of upstream releases, no waiting for Debian stable freezes.
- [How to Add the myguard APT Repository (Debian & Ubuntu)](https://deb.myguard.nl/how-to-use/): How to add the deb.myguard.nl APT repository to Debian or Ubuntu. Two methods: bootstrap .deb (recommended) or manual setup with GPG signed-by. Covers pinning, verification and common troubleshooting.
- [Docker](https://deb.myguard.nl/docker/): So this page is the short version. The full image catalogue, the docker-compose example, and the three-user security model live on the Angie & NGINX Docker images page. Start there if you want to actually pull something.
- [myguard Debian/Ubuntu Repository – Optimized NGINX, Angie and More](https://deb.myguard.nl/repository/): deb.myguard.nl is a free Debian and Ubuntu APT repository of optimized, performance-hardened packages for NGINX, Angie, Apache, Postfix, Dovecot, OpenSSL+QUIC, Rspamd and more — built and maintained by Thijs Eilander, a systems administrator from Amsterdam.

## Categories
- [nginx](https://deb.myguard.nl/articles/category/nginx/)

## About
deb.myguard.nl is an APT repository of performance-optimized and security-hardened Debian/Ubuntu packages (nginx with HTTP/3, Angie, Apache, OpenSSL, ModSecurity, Postfix, Dovecot, Rspamd, ClamAV, and 50+ others). Maintained by Thijs Eilander. All packages signed; sources, build scripts, and patches are public.

## Apt repository
- Repo: https://deb.myguard.nl
- Source / build host: https://github.com/eilandert

## Cornerstone topics
- nginx & Angie dynamic modules (zstd, brotli, jwt, vts, headers-more, etc.)
- HTTP/3 + QUIC + kTLS hardening
- ModSecurity v3 + OWASP CRS on nginx
- PHP-FPM hardening with Snuffleupagus
- Docker hardening (rootless, read-only, distroless, cap-drop)
- WordPress performance (Redis object cache, WP Fastest Cache, Database Boost)