From 28becd61dab5698aa0b2c9f95b75887d88cef89c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= <zpericic@netst.org>
Date: Sun, 18 Oct 2026 18:34:32 +0200
Subject: [PATCH] angie: initial package 1.12.4, based on Fedora nginx 1.30.6

---
 .gitignore                                    |   8 +
 ...ove-Werror-in-upstream-build-scripts.patch |  31 +
 0002-Disable-ENGINE-support.patch             | 100 +++
 0003-Compile-perl-module-with-O2.patch        |  25 +
 README.dynamic                                |  23 +
 angie-signing.gpg.asc                         |  99 +++
 angie-upgrade                                 | 114 ++++
 angie.conf                                    |  88 +++
 angie.logrotate                               |  14 +
 angie.service                                 |  22 +
 angie.spec                                    | 584 ++++++++++++++++++
 angie.sysusers                                |   3 +
 angie.tmpfiles                                |   4 +
 angie@.service                                |  23 +
 angiemods.attr                                |  14 +
 instance.conf                                 |  20 +
 macros.angiemods.in                           |  19 +
 17 files changed, 1191 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 0001-remove-Werror-in-upstream-build-scripts.patch
 create mode 100644 0002-Disable-ENGINE-support.patch
 create mode 100644 0003-Compile-perl-module-with-O2.patch
 create mode 100644 README.dynamic
 create mode 100644 angie-signing.gpg.asc
 create mode 100755 angie-upgrade
 create mode 100644 angie.conf
 create mode 100644 angie.logrotate
 create mode 100644 angie.service
 create mode 100644 angie.spec
 create mode 100644 angie.sysusers
 create mode 100644 angie.tmpfiles
 create mode 100644 angie@.service
 create mode 100644 angiemods.attr
 create mode 100644 instance.conf
 create mode 100644 macros.angiemods.in

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..2fa14c3
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,8 @@
+*~
+angie*/
+x86_64/
+.*.log
+*swp
+*.rpm
+/angie-*.tar.gz
+/angie-*.tar.gz.asc
diff --git a/0001-remove-Werror-in-upstream-build-scripts.patch b/0001-remove-Werror-in-upstream-build-scripts.patch
new file mode 100644
index 0000000..abe52d5
--- /dev/null
+++ b/0001-remove-Werror-in-upstream-build-scripts.patch
@@ -0,0 +1,31 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Felix Kaechele <felix@kaechele.ca>
+Date: Sun, 7 Jun 2020 12:14:02 -0400
+Subject: [PATCH 1/3] remove Werror in upstream build scripts
+
+removes -Werror in upstream build scripts.  -Werror conflicts with
+-D_FORTIFY_SOURCE=2 causing warnings to turn into errors.
+
+Signed-off-by: Felix Kaechele <felix@kaechele.ca>
+---
+ auto/cc/gcc | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/auto/cc/gcc b/auto/cc/gcc
+index 79a0c71..a516bf0 100644
+--- a/auto/cc/gcc
++++ b/auto/cc/gcc
+@@ -154,7 +154,9 @@ esac
+ 
+ 
+ # stop on warning
+-CFLAGS="$CFLAGS -Werror"
++# This combined with Fedora's FORTIFY_SOURCE=2 option causes it nginx
++# to not compile.
++#CFLAGS="$CFLAGS -Werror"
+ 
+ # debug
+ CFLAGS="$CFLAGS -g"
+-- 
+2.56.0
+
diff --git a/0002-Disable-ENGINE-support.patch b/0002-Disable-ENGINE-support.patch
new file mode 100644
index 0000000..7866b3f
--- /dev/null
+++ b/0002-Disable-ENGINE-support.patch
@@ -0,0 +1,100 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
+Date: Tue, 2 Jul 2024 18:29:18 +0200
+Subject: [PATCH 2/3] Disable ENGINE support
+
+---
+ auto/options                        | 3 +++
+ configure                           | 4 ++++
+ src/event/ngx_event_openssl.c       | 4 ++--
+ src/event/ngx_event_openssl.h       | 2 +-
+ src/event/ngx_event_openssl_cache.c | 2 +-
+ 5 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/auto/options b/auto/options
+index 3d05925..7d3ad00 100644
+--- a/auto/options
++++ b/auto/options
+@@ -48,6 +48,8 @@ USE_THREADS=NO
+ 
+ NGX_FILE_AIO=NO
+ 
++NGX_SSL_NO_ENGINE=NO
++
+ QUIC_BPF=NO
+ 
+ HTTP=YES
+@@ -428,6 +430,7 @@ use the \"--with-mail_ssl_module\" option instead"
+ 
+         --with-openssl=*)                OPENSSL="$value"           ;;
+         --with-openssl-opt=*)            OPENSSL_OPT="$value"       ;;
++        --without-engine)                NGX_SSL_NO_ENGINE=YES      ;;
+ 
+         --with-md5=*)
+             NGX_POST_CONF_MSG="$NGX_POST_CONF_MSG
+diff --git a/configure b/configure
+index f16be92..ad557ae 100755
+--- a/configure
++++ b/configure
+@@ -95,6 +95,10 @@ have=NGX_HTTP_SCGI_TEMP_PATH value="\"$NGX_HTTP_SCGI_TEMP_PATH\""
+ have=NGX_HTTP_ACME_CLIENT_PATH value="\"$NGX_HTTP_ACME_CLIENT_PATH\""
+ . auto/define
+ 
++if [ $NGX_SSL_NO_ENGINE = YES ]; then
++    have=NGX_SSL_NO_ENGINE . auto/have
++fi
++
+ . auto/make
+ . auto/lib/make
+ . auto/install
+diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
+index 9279aa2..442b692 100644
+--- a/src/event/ngx_event_openssl.c
++++ b/src/event/ngx_event_openssl.c
+@@ -7483,7 +7483,7 @@ ngx_openssl_init_conf(ngx_cycle_t *cycle, void *conf)
+ static char *
+ ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+ {
+-#ifndef OPENSSL_NO_ENGINE
++#if !defined(OPENSSL_NO_ENGINE) && !defined(NGX_SSL_NO_ENGINE)
+ 
+     ngx_openssl_conf_t *oscf = conf;
+ 
+@@ -7534,7 +7534,7 @@ ngx_openssl_exit(ngx_cycle_t *cycle)
+ #if OPENSSL_VERSION_NUMBER < 0x10100003L
+ 
+     EVP_cleanup();
+-#ifndef OPENSSL_NO_ENGINE
++#if !defined(OPENSSL_NO_ENGINE) && !defined(NGX_SSL_NO_ENGINE)
+     ENGINE_cleanup();
+ #endif
+ 
+diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
+index 4f48e9c..f1810c9 100644
+--- a/src/event/ngx_event_openssl.h
++++ b/src/event/ngx_event_openssl.h
+@@ -23,7 +23,7 @@
+ #ifndef OPENSSL_NO_DH
+ #include <openssl/dh.h>
+ #endif
+-#ifndef OPENSSL_NO_ENGINE
++#if !defined(OPENSSL_NO_ENGINE) && !defined(NGX_SSL_NO_ENGINE)
+ #include <openssl/engine.h>
+ #endif
+ #include <openssl/evp.h>
+diff --git a/src/event/ngx_event_openssl_cache.c b/src/event/ngx_event_openssl_cache.c
+index 04f67ca..9e954a0 100644
+--- a/src/event/ngx_event_openssl_cache.c
++++ b/src/event/ngx_event_openssl_cache.c
+@@ -712,7 +712,7 @@ ngx_ssl_cache_pkey_create(ngx_ssl_cache_key_t *id, char **err, void *data)
+ 
+     if (id->type == NGX_SSL_CACHE_ENGINE) {
+ 
+-#ifndef OPENSSL_NO_ENGINE
++#if !defined(OPENSSL_NO_ENGINE) && !defined(NGX_SSL_NO_ENGINE)
+ 
+         u_char  *p, *last;
+         ENGINE  *engine;
+-- 
+2.56.0
+
diff --git a/0003-Compile-perl-module-with-O2.patch b/0003-Compile-perl-module-with-O2.patch
new file mode 100644
index 0000000..7f0a825
--- /dev/null
+++ b/0003-Compile-perl-module-with-O2.patch
@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
+Date: Wed, 31 Jul 2024 17:47:10 +0200
+Subject: [PATCH 3/3] Compile perl module with O2
+
+---
+ src/http/modules/perl/Makefile.PL | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/http/modules/perl/Makefile.PL b/src/http/modules/perl/Makefile.PL
+index 7edadcb..2ebb7c4 100644
+--- a/src/http/modules/perl/Makefile.PL
++++ b/src/http/modules/perl/Makefile.PL
+@@ -14,7 +14,7 @@ WriteMakefile(
+     AUTHOR            => 'Igor Sysoev',
+ 
+     CCFLAGS           => "$ENV{NGX_PM_CFLAGS}",
+-    OPTIMIZE          => '-O',
++    OPTIMIZE          => '-O2',
+ 
+     LDDLFLAGS         => "$ENV{NGX_PM_LDFLAGS}",
+ 
+-- 
+2.56.0
+
diff --git a/README.dynamic b/README.dynamic
new file mode 100644
index 0000000..edf5151
--- /dev/null
+++ b/README.dynamic
@@ -0,0 +1,23 @@
+###############
+Dynamic modules
+###############
+
+Dynamic modules are loaded using the "load_module" directive. The RPM package
+for each module has a '.conf' file in the /usr/share/angie/modules directory.
+The '.conf' file contains a single "load_module" directive.
+
+This means that whenever a new dynamic module is installed, it will
+automatically be enabled and Angie will be upgraded in place
+(see angie-upgrade(8)).
+
+--------------------------------------------------------
+Prevent dynamic modules from being enabled automatically
+--------------------------------------------------------
+
+You may want to avoid dynamic modules being enabled automatically. Simply
+remove this line from the top of /etc/angie/angie.conf:
+
+    include /usr/share/angie/modules/*.conf;
+
+To also prevent the automatic in-place upgrade on package installation,
+create the file /etc/angie/rpm-disable-upgrade.
diff --git a/angie-signing.gpg.asc b/angie-signing.gpg.asc
new file mode 100644
index 0000000..af7f6b4
--- /dev/null
+++ b/angie-signing.gpg.asc
@@ -0,0 +1,99 @@
+# Angie GPG Public Key
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGNX2oABEADsThPtBwCqnj4GRYIv2qfsLdsAlnXwMstlKjC9XBbWiWNWCVTB
+Fmc4tqAl7Keb47KO1HmeAZwydtLCQJx1rHClpcQQg7VIo+J3TmDWqcZ/3OTofEYU
+XVwNgjqw9tzKNBaNq/r8hbmUzkcEADshMYTfhQDrb5o3Ga37dmcnphgegCFgFOti
+vnsgVA0w3obmkTjQoaXoAw5QODfT1pNE5L49Le62/WkADtjSUa1b6sAD1+JQI67t
+YWoxqpItnP+h3gjJBO2TI7zR3vocorHClPQ80LVOECX3qpdBSDBIIsYIihaOUrih
+nhc7Ds1fUgtgi4hATVAynUAe0j03KcrO7RPwbIRaVGzI5wd+YQrQP2LdIyc4ZK+e
+/zoQScu25jLyQaDMLs4y2i+nXZnMbmJUZkPKuj9Edi0FbGG3xmHIjrTtzAdQKINL
+fqnUh4EQx4scvRjBlLrRuGEtCQP6wT39s/xzaM9DmuiYBTfPKXnmGtFdoD1CAd5F
+H8YkZxWeOhjfLVq5M+k6/jOD/5Q+rGwHAdszduKc2UPU5zVYPFPtFBVoi6n03VmI
+JOleiEi0T0TyMKIWffa1hTc5c1ZDnefx7gOLbbsE5SSDpJkky5sJm74h75PK798r
+4VGEGa+XtmK6UN+kHQf5QcsYb3AmMtnKAayE/7P9qpY9pOUNh1oRhlLoLQARAQAB
+tCpBbmdpZSAoU2lnbmluZyBLZXkpIDxkZXZvcHNAdGVjaC53YnNydi5ydT6JAk4E
+EwEKADgWIQTrjq89TvGx7PNIZaJherl4y4SadgUCY1fagAIbAwULCQgHAgYVCgkI
+CwIEFgIDAQIeAQIXgAAKCRBherl4y4Sado05EACkUADTuJA/5NY00q06Da5Z1UU6
+bmdMeAZFolopoBPC7Z2hGB+BbFb4iYeqdFqY2jw5Jgv0Mgu8LnaUEiZihslxAqGl
+55ra4zpPoYFhOiOMgAaT6wF+etPDAW2U1gW1wZ/JFDB5aHr6lf8lGGQLi0NxJ4IX
+kUYoP8q/E6v7AnwJb4R9HbcuRgYgwmjBgYAPbbrnPDoHXNV6SIwHiv+n47ZvqXdW
+8uSNybLeiVWfBptWJy9qJunNjgOTOKgSO56aFXscWbZUp89b8UQHWZ/c2rnHxWjY
+yC25ctEG7zRwTMpaqi9yPiOCrmIKmwJjpoyVP982XwDoPYuTpq+Y0UtZRa/FtOfV
+iLi4cGeijpsZterVPJuZKxXxeoB/QhDlD7/T84rrixff09rK+OSItYn7UzfDUolV
+9C+/6xvkR4r8F8PtTedHo6JK8s5+qGC7nmuG53RsZi1ir3iwX0DLB0LIvWVi5z+l
+n5QoJyPjM1QoqG48sCo0ItRBQ80SPMDqJZgIb/cFctQGcW/Q1dt/Gy4zIqrmKj3B
+rINvB2slkJXXLrYnuue6hQTo9irq45pG3KKZeoyXvlKXpIoaHX8R3VBcnIU7NXkZ
+bNcRKRNfOjV2Pgz1BLml6u9f1s6VWcXIWpDr+x+Ijyr6TYyg36cbbUWbqrvKgE7g
+GcQARuDqKah/UR5jf7kCDQRjV9qAARAA6XH8A1fbuGK5rk5Nq+ltqkZ1iiAtt0eX
+Ntc/Hi+UdHuZW8maEpsW/tzg5wLggkpYC3IM/3ylqukzQcIhZFjQ1vDzA6tBFM1J
+38mtyTYTq56jBp1z6spG/aVf0iWJ1l4zjN87q1u1WgdPeuSDBWqC87nL2ZWDvjFo
+ZTU93wWVXycd88UBenGbFYlbDjvFf2m1B/F7eaj/eNlIHDEJ289VuQQa9fzz4V6f
+3CLaXiEUtF18wajxWdckAxegf9AoRefYhFCjkuibW435gaMSbrAqCMGbZMVKdLvF
+9Lfli309NdST7sk33su45fAjqGT7siQk4X3uumhQFGF3chHYsDQFqpWq4ZrjNTrf
+55TIqZ8+zmPm8MuZj5Zd5q2w4ktTx2obnuE30e4puKvbbu1I1hJzKKJFkTIpTypR
+AiDGbUmXHrLxRAdwBCt3fjjKShro3JJkxTXhIxnNrwHGPZ0YsmAUUH/mKwJ+Anqw
+4QVPIzRV02sGHdi9tYwlChTMvn94yk4Nr1yeIkiWAMajsr7lED/NuQVMsbm2KWXP
+vqqZtniYZZM/pEM2OjNv5mtSFJHaGVA2CtMf7Vaxl2MZfs+lEJNfG07Mu7sxXHfw
+uwgJvl+Cj9Yaasz5PpL3jWLYn75YHOiIyGA1x3kpE8frDJB/Xc3C+G4B19GWF/ra
+kBm1uf5RT28AEQEAAYkEbAQYAQoAIBYhBOuOrz1O8bHs80hlomF6uXjLhJp2BQJj
+V9qAAhsCAkAJEGF6uXjLhJp2wXQgBBkBCgAdFiEEocPyrBhwnGb0+3T5JxyRFmbJ
+JLEFAmNX2oAACgkQJxyRFmbJJLFHzw//c1CAR/M9dOvJX2IPOzbX82HgCCm8OBeI
+iQkqS7HhQOGRVvxC0oG7QAROR/urNi6X8/QyXk7YHhtPfXZJzbSJUxBBbwyineL1
+U4pKxnRGn8rGZz5T2RMDYxwe2EluKqFjxpo9lZK782uw7dBHyJw4Xj67LpsUrqWK
++td/jsqYRbws8AXBPVtHNYKyU1u638+2+Ad+d+rqQ/wdYJUIHQdF+kjQizfgKy6j
+CxLnksJkC9SO95LUrMKL97mS3bD8hqt1Dj9tl5UHAn5uuktvSonSKnPxYeo5ntg0
+pkDu9voGCYlOZOo1ASjqJYIMyw2o6ig0OqMACPr0nAlqGa6If/75KfUxcFrls3jD
+nm6lPWNrfsYGOlDGGifQ8fGM+Rc4TmQAqffCTdzGrEjrKuN7gMcrOsH8M1Z5dWmV
+WXT4ET9w6z2V5Xx+hTiJ1T3IfZi2Z+00nij8l+5AmrI0xpyJnrzupcXH22KJqeP5
+6CA9TdkvRborSiIyW5E7Zq0evh8b1o6ufznWT6tKqQzkK4cmfsWjhAy8QkcbnW8P
+X5EZpvGjy9j7O6eSU5fZHTWiXn5+nn5nCNfSeselg+Ma5tjutgk+/20s6pio8Jge
+4kgYQMHLuXLuWZ0McNrypbEZ9fPFjuk56tHZzB1mm9wpKP85Y80CIuCB4nW+jiQb
+q9H3VXtB1DAn/w//WubJ02KIbEFCY3lzv79lkyrFNeSGRbxPUky8qQ8w0YTIxCX6
+QiKXT/XB9Fpq/ZZdL7hUkRtNjf9lkWg8G79+PYaxNIbSR1wX/xfBUgx4SKCtFfpu
+elt/waRrgdSURq0R7x/1mUZmMsuWFxrwBEwKP2aP7OJPJVjANsxM7Wc97o9B/XFG
+PurCr6CY1KFU4kE+aDo45At20iqHxzBrGncmJFgiK46ScPAetRAHA0TBOLmfS62U
+Lys4Gq21D307/omVkzeFapz6hzDJr8b5GAu2XNkNbfoZ6XXXGf18YdqDW/WPQ+74
+nRfkcVcDuxVQnaoEzWO/VgWeRhpKEbd2lgSIxqSQ8gN3ggBhPsgTPR7PKG0W6itd
+HvmAC8X3z7kcNBPJYFZGxNS+X8hnWvHAaQAWorQbYWhEYVlMWdw5WXKd44J8ExWQ
+uCpn9HS6hJy2EY7pK8x9LXZpe3GDwYmP3Ju4fAAWECT3TIBjV+qVegN2MSQD9XNv
+qkUTf1M87bhWlB4e5js572K8p16hYVbCyKUSunQ6WAe0ODkPcK6VhKfKerwcqz90
+jcakkjhzfJvZM0W28KbHtiuS5jqfmHF+HatarW0oxlspURjh2gMpwwhvroszbo5e
+UPD8jG17MWapZaz2gArXEUXzjiE9NHm179Di0F8fWw5LpSBpAH9F8Nprohi5Ag0E
+Y1fbBgEQALF3UUX4JyVHNG37V8bxTFq5ES2HRMDF1JIzN6552dfnoOZyWWoZ3bRM
+gCpdgkFfP9RypmZX9ZYP2uS7H/OT/vt3NRV9Qf8KafDhJxW+40PpyO9MZiIqO7xN
+0UQiObpB9P0Bsc1S4kggDNXgxzSAGlDAcBtf8iiHLDcM5ZF6UIMg+6exVKVu6NaA
+Wlc5FhEw31tqLAFYI6OAMQpmNCnDK4PzepkA3h/8GEeVhdtaRcoMP7Xhk9jLsAmP
+U02Ll3haXWLIiANOwmQKONGvjDmiQ+P6iYQuJkIGGxOQSVtDeFHHhcoqOpRZnuzh
++VwZ/b4XBTa8DVe4oPY6013E9pGRX6k7HrrWIePnISfRBGCcnI6dpcXsXsHOjbLW
+4/Z8IfU1I3gmtbF3cTjy7eI+9YAwPZKcQLZXC5dxl1jOSLLZkA98bsl5MFa3tTo2
+BaVQyT5xV9DsB9gQRs0mzIKEpeGUOBOg5MT4QRH80X77xL4Zz8fgAgy5uqK9M1Wh
+Q5XNU8Yp9iEmLNJJlHmvS2RNJHWEZzFtS/TBzgR4J5bOKB/T1DnCx+1X8ChkEXkb
+4qaBSkoC9wmIjH6oeHCQUNeD3j11JTIlT7zs0bfNeqNEJJ5eAUzKMhTrpwEH83ny
+Q/Z+eUqOOnLrTwJYExpSgeZSdKsHbPDEUMdSQJ9ZifSVx3yZW/a/ABEBAAGJBGwE
+GAEKACAWIQTrjq89TvGx7PNIZaJherl4y4SadgUCY1fbBgIbAgJACRBherl4y4Sa
+dsF0IAQZAQoAHRYhBNTfXffduYkYDZxyENbOxMi2XoSEBQJjV9sGAAoJENbOxMi2
+XoSEyH0QAIaugULdAvF8sQpr5MB0yvKTgiHmK71MR8NYnhZTgKm9v3mtiiQVQSFp
+tDJ+NgJx6y1u4kOCqwMxrSxdlJNzh7EoNF8TWRrfDZ7aJPjBn3f7psGxg9NcIlR4
+vk70ZtkgS/fiHbR2Ro6hK6w+Q046ZpRrRAySxT4aGbU5UdTYGq9sZ3/kpJn1KBfe
+B5pK5V2aMrEbe2GpyO508M73dsymvHzDz7pFISqoYQx0QgXRSOErZHuCAObGOI3c
+/55Hb1531ea7mqdLOLd1YWp7uofOLIVrC8VhjvsQRY0EvY1XdmNxihmx+Hb1Gnpm
+NG9UtBV6FEE8I6jI1gc1sq6YfEpI3oc/cvpHA/IQK7ij/5Z3dGHyhHlq+xBe5ko+
+EcnOXpaCdARq0h/IYJZOchd5xYh/4IdVBq1DGjgXU9QZL/8cGIGPk+Gw60HKKBkN
+drc8g/rhEWEk6RAaD/1BfpgH7O/g6FCMrF1FAxrU4slN4MrD2A/29I6kDDfdUESL
+0hL9bl6Kryje+v7Nqg8oOq7BGz2CZtCwnt06VMEUxPlOUQM9QNpp/Zu9WfhMc0vQ
+JcttpyvbhMhsJf8uNynZh88SFNewytXZX7s6e2wrTc3W5vpsNtLwiEucN+XCoELW
+6biPYyEk2+URFg+IsVkO69A4atWOAclM3iqGs6AgOBPHLVvxxhnTOVsP/09epPIu
+jTZ9LVbx4riUt1t647aSdxm1gITGtAppQx5jMwYWvTlnT3KSx67LrcfPGaZkpBQn
+bMYp+XySP/7F8jk7xFx8qiWXQCY8riJ5cOCw1tA1N+evX9XdhlWkdy93NEWiB9nb
+UwM8CJUxx5H7yP33b0VrZwS4b2grshb6pegTPRYQhP/Yyp6E/LenAVTpSyZE7JBd
+u6ug9n3sFOVqOE7KFLQmBc11093Qz6lGncfrdeSinN2/rr3ZzYbRv7ilH1wfcV/7
+STErX36GxEWQFp8kZuJ07+yd5L48qb+H7UYkG+uy1p5AF4eTeSsSOQIRhwmgXxHs
+X60GmWb87Yu10+hA24BXWzNEj/Yn00CtKnKzwL3VwA68COUNPZoba3KuD9bcmIEH
+EUtjsNF4QF/FfXt84KAt35SO6Ql1LqkPR+xWSswoLyyL0q/N6WpAgc3ukUNGKaqP
+tH79vUvdTrE7wMcDMIBstImP4M6wszRfuaSEKWX601+r1GhwFdN9FjaKO083pl8T
+TCoAIrKtVB8rI5aFaD2Qmh9C7taOmRVK+XNUZXWNAvyyFMfja8+k3fdZuPMxNgEU
+G37uWVSC9Gjr5YE3pulcXxIxi9IGZQjRbBFLQWjkE4gean1tacEsyVOV30SqqF6N
+6aNUJqElOswYSsIc9pip17CdPiDKptxb2OMc
+=Z61u
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/angie-upgrade b/angie-upgrade
new file mode 100755
index 0000000..471f5fa
--- /dev/null
+++ b/angie-upgrade
@@ -0,0 +1,114 @@
+#!/bin/bash
+
+# angie-upgrade - Upgrade all running Angie instances with zero downtime
+
+# Upgrade all running Angie instances by sending the USR2 signal to the
+# master process of each instance, then gracefully stopping the old master.
+# This allows for zero-downtime upgrades of Angie.
+
+# Last updated: 2026-10-18
+
+TIMEOUT=10
+
+wait_for_file() {
+	# usage: wait_for_file <present|absent> <file> <label>
+	local mode=$1 file=$2 label=$3
+	local i
+
+	for ((i=0; i<TIMEOUT; i++)); do
+		[[ $mode == present && -f $file ]] && return 0
+		[[ $mode == absent  && ! -f $file ]] && return 0
+		sleep 1
+	done
+
+	echo "ERROR: $label - file never ${mode}ed: $file" >&2
+	return 1
+}
+
+upgrade_instance() {
+	# usage: upgrade_instance <service-unit> <pid-file>
+	local unit="$1" pid_file="$2"
+	local old_pid_file="${pid_file}.oldbin"
+
+	if [ ! -f "$pid_file" ]; then
+		echo "[$unit] No PID file at $pid_file - skipping."
+		return 0
+	fi
+
+	echo "[$unit] Starting new master process..."
+	/bin/systemctl kill --signal=SIGUSR2 --kill-who=main "$unit"
+
+	wait_for_file present "$old_pid_file" "$unit - new master start" || return 1
+
+	echo "[$unit] New master is up. Gracefully stopping old master..."
+	local old_pid
+	old_pid=$(cat "$old_pid_file" 2>/dev/null)
+	/bin/kill -s QUIT "$old_pid" 2>/dev/null
+
+	wait_for_file absent "$old_pid_file" "$unit - old master stop" || return 1
+
+	echo "[$unit] Done."
+	return 0
+}
+
+overall_rc=0
+
+# Discover every active Angie instance via systemctl
+instances=$(systemctl list-units --type=service --state=running --no-legend "angie*" |
+	awk '{print $1}' |
+	grep -E '^angie(@\w+)?\.service$')
+
+for unit in $instances; do
+	pid_file=$(systemctl show "$unit" -p PIDFile --value)
+
+	if [ -z "$pid_file" ]; then
+		echo "[$unit] Could not determine PID file - skipping." >&2
+		continue
+	fi
+
+	upgrade_instance "$unit" "$pid_file"
+	rc=$?
+	[ $rc -ne 0 ] && overall_rc=$rc
+done
+
+exit $overall_rc
+
+: <<'POD'
+=pod
+
+=encoding UTF-8
+
+=head1 NAME
+
+angie-upgrade - tool to upgrade Angie without any downtime
+
+=head1 SYNOPSIS
+
+angie-upgrade
+
+=head1 DESCRIPTION
+
+This downstream shell script updates Angie without any downtime. After
+upgrading Angie via the package manager, running this script will create
+a new Angie master. This master takes over all new requests. The old
+masters and workers are then gracefully shutdown without breaking any
+existing connections.
+
+For further information, see: L<https://en.angie.software/angie/docs/configuration/runtime/>
+
+=head1 BUGS
+
+If you find any bugs, please send an email to the author.
+
+=head1 AUTHORS
+
+Felix Kaechele E<lt>felix@kaechele.caE<gt>
+
+Adapted for Angie by
+Zoran Peričić E<lt>zpericic@netst.orgE<gt>
+
+Originally written by
+Jamie Nguyen E<lt>jamielinux@fedoraproject.orgE<gt>
+
+=cut
+POD
diff --git a/angie.conf b/angie.conf
new file mode 100644
index 0000000..ea1073b
--- /dev/null
+++ b/angie.conf
@@ -0,0 +1,88 @@
+# For more information on configuration, see:
+#   * Official English Documentation: https://en.angie.software/angie/docs/
+#   * Official Russian Documentation: https://angie.software/angie/docs/
+
+user angie;
+worker_processes auto;
+error_log /var/log/angie/error.log notice;
+pid /run/angie.pid;
+
+# Load dynamic modules. See /usr/share/doc/angie-core/README.dynamic.
+include /usr/share/angie/modules/*.conf;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/angie/access.log  main;
+
+    sendfile            on;
+    tcp_nopush          on;
+    keepalive_timeout   65;
+    types_hash_max_size 4096;
+
+    include             /etc/angie/mime.types;
+    default_type        application/octet-stream;
+
+    server {
+        listen       80;
+        listen       [::]:80;
+        server_name  _;
+        root         /usr/share/angie/html;
+
+        # Load configuration files for the default server block.
+        include /etc/angie/default.d/*.conf;
+    }
+
+    # Load modular configuration files from the /etc/angie/conf.d directory.
+    # See https://en.angie.software/angie/docs/configuration/modules/core/#include
+    # for more information.
+    include /etc/angie/conf.d/*.conf;
+
+# Settings for a TLS enabled server.
+#
+#    server {
+#        listen       443 ssl;
+#        listen       [::]:443 ssl;
+#        http2        on;
+#        server_name  _;
+#        root         /usr/share/angie/html;
+#
+#        ssl_certificate "/etc/pki/angie/server.crt";
+#        ssl_certificate_key "/etc/pki/angie/private/server.key";
+#        ssl_session_cache shared:SSL:1m;
+#        ssl_session_timeout  10m;
+#        ssl_ciphers PROFILE=SYSTEM;
+#        ssl_prefer_server_ciphers on;
+#
+#        # Load configuration files for the default server block.
+#        include /etc/angie/default.d/*.conf;
+#    }
+
+# Settings for a TLS enabled server with certificate obtained via ACME.
+#
+#    resolver 127.0.0.53;
+#
+#    acme_client example https://acme-v02.api.letsencrypt.org/directory;
+#
+#    server {
+#        listen       443 ssl;
+#        listen       [::]:443 ssl;
+#        http2        on;
+#        server_name  example.com;
+#        root         /usr/share/angie/html;
+#
+#        acme example;
+#        ssl_certificate $acme_cert_example;
+#        ssl_certificate_key $acme_cert_key_example;
+#
+#        # Load configuration files for the default server block.
+#        include /etc/angie/default.d/*.conf;
+#    }
+
+}
diff --git a/angie.logrotate b/angie.logrotate
new file mode 100644
index 0000000..2d3d66b
--- /dev/null
+++ b/angie.logrotate
@@ -0,0 +1,14 @@
+/var/log/angie/*.log {
+    create 0640 angie root
+    daily
+    rotate 10
+    missingok
+    notifempty
+    compress
+    delaycompress
+    sharedscripts
+    postrotate
+        /usr/bin/systemctl kill --signal=SIGUSR1 --kill-who=main angie.service 2>/dev/null || \
+        true
+    endscript
+}
diff --git a/angie.service b/angie.service
new file mode 100644
index 0000000..3986cda
--- /dev/null
+++ b/angie.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=The Angie HTTP and reverse proxy server
+After=network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+Type=forking
+PIDFile=/run/angie.pid
+# Angie will fail to start if /run/angie.pid already exists but has the wrong
+# SELinux context. This might happen when running `angie -t` from the cmdline.
+# https://bugzilla.redhat.com/show_bug.cgi?id=1268621
+ExecStartPre=/usr/bin/rm -f /run/angie.pid
+ExecStartPre=/usr/sbin/angie -t
+ExecStart=/usr/sbin/angie
+ExecReload=/usr/sbin/angie -s reload
+KillSignal=SIGQUIT
+TimeoutStopSec=5
+KillMode=mixed
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/angie.spec b/angie.spec
new file mode 100644
index 0000000..1f6772d
--- /dev/null
+++ b/angie.spec
@@ -0,0 +1,584 @@
+%global  _hardened_build     1
+%global  angie_user          angie
+
+# Disable strict symbol checks in the link editor.
+# See: https://src.fedoraproject.org/rpms/redhat-rpm-config/c/078af19
+%undefine _strict_symbol_defs_build
+
+%if 0%{?fedora} || 0%{?epel} == 8
+%bcond_without geoip
+%else
+%bcond_with geoip
+%endif
+
+# gperftools support should be disabled for RHEL >= 8
+# see: https://bugzilla.redhat.com/show_bug.cgi?id=1931402
+%if 0%{?rhel} >= 8
+%global with_gperftools 0
+%else
+# gperftools exists only on selected arches
+# gperftools *detection* is failing on ppc64*, possibly only configure
+# bug, but disable anyway.
+%ifnarch s390 s390x ppc64 ppc64le
+%global with_gperftools 1
+%endif
+%endif
+
+%global with_aio 1
+
+%if 0%{?fedora} > 40 || 0%{?rhel} > 9
+%bcond_with engine
+%else
+%bcond_without engine
+%endif
+
+# kTLS requires OpenSSL 3.0 (default in F36+ and EL9+, available in EPEL8)
+%if 0%{?fedora} >= 36 || 0%{?rhel} >= 9 || 0%{?epel} >= 8
+%global with_ktls 1
+%endif
+
+# Build against OpenSSL 3 on EL8
+%if 0%{?epel} == 8
+%global openssl_pkgversion 3
+%endif
+
+%global angie_abiversion %{version}
+
+%global angie_moduledir %{_libdir}/angie/modules
+%global angie_moduleconfdir %{_datadir}/angie/modules
+%global angie_srcdir %{_usrsrc}/%{name}-%{version}-%{release}
+# Perl module is still called "nginx"; keep it out of the system perl
+# paths so it does not conflict with nginx-mod-http-perl.
+%global angie_perldir %{_libdir}/angie/perl
+
+# Do not generate provides/requires from angie sources, and do not let the
+# private perl module provide perl(nginx)
+%global __provides_exclude_from ^(%{angie_srcdir}|%{angie_perldir})/.*$
+%global __requires_exclude_from ^%{angie_srcdir}/.*$
+
+
+Name:              angie
+Version:           1.12.4
+Release:           1%{?dist}
+
+Summary:           Efficient, powerful and scalable web server, nginx fork
+License:           BSD-2-Clause
+URL:               https://angie.software
+
+Source0:           https://download.angie.software/files/angie-%{version}.tar.gz
+Source1:           https://download.angie.software/files/angie-%{version}.tar.gz.asc
+Source2:           https://angie.software/keys/angie-signing.gpg.asc
+Source10:          angie.service
+Source11:          angie.logrotate
+Source12:          angie.conf
+Source13:          angie-upgrade
+Source15:          macros.angiemods.in
+Source16:          angiemods.attr
+Source18:          angie@.service
+Source19:          angie.sysusers
+Source20:          angie.tmpfiles
+Source200:         README.dynamic
+Source220:         instance.conf
+
+# removes -Werror in upstream build scripts.  -Werror conflicts with
+# -D_FORTIFY_SOURCE=2 causing warnings to turn into errors.
+Patch0:            0001-remove-Werror-in-upstream-build-scripts.patch
+
+# downstream patch (from Fedora nginx) - Disable ENGINE support by default
+# for F41+
+Patch1:            0002-Disable-ENGINE-support.patch
+
+# downstream patch (from Fedora nginx) - Compile perl module with O2
+Patch2:            0003-Compile-perl-module-with-O2.patch
+
+BuildRequires:     make
+BuildRequires:     gcc
+%if 0%{?fedora} > 42
+BuildRequires:     openpgpverify
+%else
+BuildRequires:     gnupg2
+%endif
+%if 0%{?with_gperftools}
+BuildRequires:     gperftools-devel
+%endif
+BuildRequires:     libxcrypt-devel
+BuildRequires:     openssl%{?openssl_pkgversion}-devel
+BuildRequires:     pcre2-devel
+BuildRequires:     perl-podlators
+%if 0%{?fedora} || 0%{?rhel} >= 10 || 0%{?epel} >= 9
+BuildRequires:     zlib-ng-devel
+%else
+BuildRequires:     zlib-devel
+%endif
+
+Requires:          angie-filesystem = %{version}-%{release}
+
+Provides:          webserver
+Recommends:        logrotate
+Requires:          %{name}-core = %{version}-%{release}
+
+BuildRequires:     systemd
+BuildRequires:     systemd-rpm-macros
+%{?systemd_requires}
+
+%description
+Angie is an efficient, powerful, and scalable web server that was forked
+from nginx. It is a web server and a reverse proxy server for HTTP, SMTP,
+POP3 and IMAP protocols, with a strong focus on high concurrency,
+performance and low memory usage.
+
+Compared to nginx it adds a built-in ACME client, a REST API with
+Prometheus metrics, active upstream health probes, dynamic upstream
+configuration via Docker labels and other features.
+
+%package core
+Summary:           Angie minimal core
+Requires:          openssl%{?openssl_pkgversion}-libs
+Requires(pre):     angie-filesystem
+# For external angie modules
+Provides:          angie(abi) = %{angie_abiversion}
+
+%description core
+Angie minimal core.
+
+%package all-modules
+Summary:           A meta package that installs all available Angie modules
+BuildArch:         noarch
+
+%if %{with geoip}
+Requires:          angie-mod-http-geoip = %{version}-%{release}
+Requires:          angie-mod-stream-geoip = %{version}-%{release}
+%endif
+Requires:          angie-mod-http-image-filter = %{version}-%{release}
+Requires:          angie-mod-http-perl = %{version}-%{release}
+Requires:          angie-mod-http-xslt-filter = %{version}-%{release}
+Requires:          angie-mod-mail = %{version}-%{release}
+Requires:          angie-mod-stream = %{version}-%{release}
+
+%description all-modules
+Meta package that installs all available Angie modules.
+
+%package filesystem
+Summary:           The basic directory layout for the Angie server
+BuildArch:         noarch
+# RHEL 9 compat, remove after RHEL 9 EOL
+%{?sysusers_requires_compat}
+
+%description filesystem
+The angie-filesystem package contains the basic directory layout
+for the Angie server including the correct permissions for the
+directories.
+
+%if %{with geoip}
+%package mod-http-geoip
+Summary:           Angie HTTP geoip module
+BuildRequires:     GeoIP-devel
+Requires:          angie(abi) = %{angie_abiversion}
+
+%description mod-http-geoip
+%{summary}.
+
+%package mod-stream-geoip
+Summary:           Angie stream geoip module
+BuildRequires:     GeoIP-devel
+Requires:          angie(abi) = %{angie_abiversion}
+Requires:          angie-mod-stream = %{version}-%{release}
+
+%description mod-stream-geoip
+%{summary}.
+%endif
+
+%package mod-http-image-filter
+Summary:           Angie HTTP image filter module
+BuildRequires:     gd-devel
+Requires:          angie(abi) = %{angie_abiversion}
+Requires:          gd
+
+%description mod-http-image-filter
+%{summary}.
+
+%package mod-http-perl
+Summary:           Angie HTTP perl module
+BuildRequires:     perl-devel
+BuildRequires:     perl-generators
+BuildRequires:     perl(ExtUtils::Embed)
+Requires:          angie(abi) = %{angie_abiversion}
+Requires:          perl(constant)
+
+%description mod-http-perl
+%{summary}.
+
+%package mod-http-xslt-filter
+Summary:           Angie XSLT module
+BuildRequires:     libxslt-devel
+Requires:          angie(abi) = %{angie_abiversion}
+
+%description mod-http-xslt-filter
+%{summary}.
+
+%package mod-mail
+Summary:           Angie mail modules
+Requires:          angie(abi) = %{angie_abiversion}
+
+%description mod-mail
+%{summary}.
+
+%package mod-stream
+Summary:           Angie stream modules
+Requires:          angie(abi) = %{angie_abiversion}
+
+%description mod-stream
+%{summary}.
+
+%package mod-devel
+Summary:           Angie module development files
+Requires:          angie = %{version}-%{release}
+Requires:          make
+Requires:          gcc
+Requires:          gd-devel
+%if 0%{?with_gperftools}
+Requires:          gperftools-devel
+%endif
+%if %{with geoip}
+Requires:          GeoIP-devel
+%endif
+Requires:          libxslt-devel
+Requires:          openssl%{?openssl_pkgversion}-devel
+Requires:          pcre2-devel
+Requires:          perl-devel
+Requires:          perl(ExtUtils::Embed)
+%if 0%{?fedora} || 0%{?rhel} >= 10 || 0%{?epel} >= 9
+Requires:          zlib-ng-devel
+%else
+Requires:          zlib-devel
+%endif
+
+%description mod-devel
+%{summary}.
+
+
+%prep
+%if 0%{?fedora} > 42
+%{openpgpverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+%else
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+%endif
+%autosetup -p1
+cp %{SOURCE200} %{SOURCE10} %{SOURCE12} %{SOURCE18} %{SOURCE220} .
+
+%if 0%{?openssl_pkgversion}
+sed \
+  -e 's|\(ngx_feature_path=\)$|\1%{_includedir}/openssl%{openssl_pkgversion}|' \
+  -e 's|\(ngx_feature_libs="\)|\1-L%{_libdir}/openssl%{openssl_pkgversion} |' \
+  -i auto/lib/openssl/conf
+%endif
+
+# Prepare template config for instances
+sed -e '/^error_log /s|error\.log|@INSTANCE@_error.log|' \
+    -e '/^pid /s|angie\.pid|angie-@INSTANCE@.pid|' \
+    -e '/^ *access_log/s|access\.log|@INSTANCE@_access.log|' \
+    angie.conf >> instance.conf
+touch -r %{SOURCE12} instance.conf
+
+# Prepare sources for installation
+cp -a ../%{name}-%{version} ../%{name}-%{version}-%{release}-src
+mv ../%{name}-%{version}-%{release}-src .
+
+
+%build
+# angie does not utilize a standard configure script.  It has its own
+# and the standard configure options cause the angie configure script
+# to error out.
+if ! ./configure \
+    --prefix=%{_datadir}/angie \
+    --sbin-path=%{_sbindir}/angie \
+    --modules-path=%{angie_moduledir} \
+    --conf-path=%{_sysconfdir}/angie/angie.conf \
+    --error-log-path=%{_localstatedir}/log/angie/error.log \
+    --http-log-path=%{_localstatedir}/log/angie/access.log \
+    --http-client-body-temp-path=%{_localstatedir}/lib/angie/tmp/client_body \
+    --http-proxy-temp-path=%{_localstatedir}/lib/angie/tmp/proxy \
+    --http-fastcgi-temp-path=%{_localstatedir}/lib/angie/tmp/fastcgi \
+    --http-uwsgi-temp-path=%{_localstatedir}/lib/angie/tmp/uwsgi \
+    --http-scgi-temp-path=%{_localstatedir}/lib/angie/tmp/scgi \
+    --http-acme-client-path=%{_localstatedir}/lib/angie/acme \
+    --pid-path=/run/angie.pid \
+    --lock-path=/run/lock/subsys/angie \
+    --user=%{angie_user} \
+    --group=%{angie_user} \
+    --with-compat \
+    --with-debug \
+%if 0%{?with_aio}
+    --with-file-aio \
+%endif
+%if 0%{?with_gperftools}
+    --with-google_perftools_module \
+%endif
+    --with-http_acme_module \
+    --with-http_addition_module \
+    --with-http_auth_request_module \
+    --with-http_dav_module \
+    --with-http_degradation_module \
+    --with-http_flv_module \
+%if %{with geoip}
+    --with-http_geoip_module=dynamic \
+    --with-stream_geoip_module=dynamic \
+%endif
+    --with-http_gunzip_module \
+    --with-http_gzip_static_module \
+    --with-http_image_filter_module=dynamic \
+    --with-http_mp4_module \
+    --with-http_perl_module=dynamic \
+    --with-perl_modules_path=%{angie_perldir} \
+    --with-http_random_index_module \
+    --with-http_realip_module \
+    --with-http_secure_link_module \
+    --with-http_slice_module \
+    --with-http_ssl_module \
+    --with-http_stub_status_module \
+    --with-http_sub_module \
+    --with-http_v2_module \
+    --with-http_v3_module \
+    --with-http_xslt_module=dynamic \
+    --with-mail=dynamic \
+    --with-mail_ssl_module \
+%if 0%{?with_ktls}
+    --with-openssl-opt=enable-ktls \
+%endif
+%if %{without engine}
+    --without-engine \
+%endif
+    --with-pcre \
+    --with-pcre-jit \
+    --with-stream=dynamic \
+    --with-stream_acme_module \
+    --with-stream_mqtt_preread_module \
+    --with-stream_rdp_preread_module \
+    --with-stream_realip_module \
+    --with-stream_ssl_module \
+    --with-stream_ssl_preread_module \
+    --with-threads \
+    --with-cc-opt="%{optflags}" \
+    --with-ld-opt="$RPM_LD_FLAGS"; then
+  : configure failed
+  cat objs/autoconf.err
+  exit 1
+fi
+
+%make_build
+
+
+%install
+%make_install INSTALLDIRS=vendor
+
+find %{buildroot} -type f -name .packlist -exec rm -f '{}' \;
+find %{buildroot} -type f -name perllocal.pod -exec rm -f '{}' \;
+find %{buildroot} -type f -empty -exec rm -f '{}' \;
+find %{buildroot} -type f -iname '*.so' -exec chmod 0755 '{}' \;
+
+# Perl module man page is named nginx(3pm) and would conflict with
+# nginx-mod-http-perl.
+rm -rf %{buildroot}%{_mandir}/man3 %{buildroot}%{angie_perldir}/man3
+
+install -p -D -m 0644 ./angie.service \
+    %{buildroot}%{_unitdir}/angie.service
+install -p -D -m 0644 ./angie@.service \
+    %{buildroot}%{_unitdir}/angie@.service
+install -p -D -m 0644 %{SOURCE11} \
+    %{buildroot}%{_sysconfdir}/logrotate.d/angie
+
+install -p -d -m 0755 %{buildroot}%{_sysconfdir}/systemd/system/angie.service.d
+install -p -d -m 0755 %{buildroot}%{_unitdir}/angie.service.d
+
+install -p -d -m 0755 %{buildroot}%{_sysconfdir}/angie/conf.d
+install -p -d -m 0755 %{buildroot}%{_sysconfdir}/angie/default.d
+
+install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/angie
+install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/angie/tmp
+install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/angie/acme
+install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/angie
+
+install -p -d -m 0755 %{buildroot}%{_datadir}/angie/html
+install -p -d -m 0755 %{buildroot}%{angie_moduleconfdir}
+install -p -d -m 0755 %{buildroot}%{angie_moduledir}
+
+install -p -m 0644 ./angie.conf \
+    %{buildroot}%{_sysconfdir}/angie
+
+install -p -D -m 0644 %{_builddir}/angie-%{version}/objs/angie.8 \
+    %{buildroot}%{_mandir}/man8/angie.8
+
+install -p -D -m 0755 %{SOURCE13} %{buildroot}%{_bindir}/angie-upgrade
+pod2man --section=8 --name=angie-upgrade \
+    --release="%{version}-%{release}" \
+    --center="Angie Zero-Downtime Upgrade Utility" \
+    --date="$(sed -nE 's/# Last updated: (.+)/\1/p' %{SOURCE13})" \
+    %{SOURCE13} > %{buildroot}%{_mandir}/man8/angie-upgrade.8
+
+for i in ftdetect ftplugin indent syntax; do
+    install -p -D -m644 contrib/vim/${i}/angie.vim \
+        %{buildroot}%{_datadir}/vim/vimfiles/${i}/angie.vim
+done
+
+%if %{with geoip}
+echo 'load_module "%{angie_moduledir}/ngx_http_geoip_module.so";' \
+    > %{buildroot}%{angie_moduleconfdir}/mod-http-geoip.conf
+echo 'load_module "%{angie_moduledir}/ngx_stream_geoip_module.so";' \
+    > %{buildroot}%{angie_moduleconfdir}/zz-mod-stream-geoip.conf
+%endif
+echo 'load_module "%{angie_moduledir}/ngx_http_image_filter_module.so";' \
+    > %{buildroot}%{angie_moduleconfdir}/mod-http-image-filter.conf
+echo 'load_module "%{angie_moduledir}/ngx_http_perl_module.so";' \
+    > %{buildroot}%{angie_moduleconfdir}/mod-http-perl.conf
+echo 'load_module "%{angie_moduledir}/ngx_http_xslt_filter_module.so";' \
+    > %{buildroot}%{angie_moduleconfdir}/mod-http-xslt-filter.conf
+echo 'load_module "%{angie_moduledir}/ngx_mail_module.so";' \
+    > %{buildroot}%{angie_moduleconfdir}/mod-mail.conf
+echo 'load_module "%{angie_moduledir}/ngx_stream_module.so";' \
+    > %{buildroot}%{angie_moduleconfdir}/mod-stream.conf
+
+# Install files for supporting angie module builds
+## Install source files
+mkdir -p %{buildroot}%{_usrsrc}
+mv %{name}-%{version}-%{release}-src %{buildroot}%{angie_srcdir}
+## Install rpm macros
+mkdir -p %{buildroot}%{_rpmmacrodir}
+sed -e "s|@@ANGIE_ABIVERSION@@|%{angie_abiversion}|g" \
+    -e "s|@@ANGIE_MODDIR@@|%{angie_moduledir}|g" \
+    -e "s|@@ANGIE_MODCONFDIR@@|%{angie_moduleconfdir}|g" \
+    -e "s|@@ANGIE_SRCDIR@@|%{angie_srcdir}|g" \
+    %{SOURCE15} > %{buildroot}%{_rpmmacrodir}/macros.angiemods
+## Install dependency generator
+install -Dpm0644 %{SOURCE16} %{buildroot}%{_fileattrsdir}/angiemods.attr
+
+# install sysusers file
+install -p -D -m 0644 %{SOURCE19} %{buildroot}%{_sysusersdir}/angie.conf
+
+# tmpfiles.d configuration
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 644 -p %{SOURCE20} %{buildroot}%{_tmpfilesdir}/angie.conf
+
+
+%pre filesystem
+# RHEL 9 compat, remove after RHEL 9 EOL
+%sysusers_create_compat %{SOURCE19}
+
+%post
+%systemd_post angie.service
+
+%preun
+%systemd_preun angie.service
+
+%postun
+%systemd_postun angie.service
+
+# Request zero-downtime upgrade upon installation of a new angie binary or modules
+# A reload is not sufficient here: https://blog.nginx.org/blog/nginx-dynamic-modules-how-they-work#upgradeMod
+%transfiletriggerin -- %{_sbindir}/angie %{angie_moduleconfdir} %{angie_moduledir}
+if [ $1 -ge 1 ]; then
+    test -f %{_sysconfdir}/angie/rpm-disable-upgrade || /usr/bin/angie-upgrade >/dev/null 2>&1 || :
+fi
+
+
+%files
+%doc instance.conf
+%{_datadir}/angie/html/*
+%{_bindir}/angie-upgrade
+%{_datadir}/vim/vimfiles/ftdetect/angie.vim
+%{_datadir}/vim/vimfiles/ftplugin/angie.vim
+%{_datadir}/vim/vimfiles/syntax/angie.vim
+%{_datadir}/vim/vimfiles/indent/angie.vim
+%{_mandir}/man8/angie.8*
+%{_mandir}/man8/angie-upgrade.8*
+%{_unitdir}/angie.service
+%{_unitdir}/angie@.service
+%config(noreplace) %{_sysconfdir}/logrotate.d/angie
+
+%files core
+%license LICENSE
+%doc CHANGES README README.dynamic
+%{_sbindir}/angie
+%config(noreplace) %{_sysconfdir}/angie/fastcgi.conf
+%config(noreplace) %{_sysconfdir}/angie/fastcgi.conf.default
+%config(noreplace) %{_sysconfdir}/angie/fastcgi_params
+%config(noreplace) %{_sysconfdir}/angie/fastcgi_params.default
+%config(noreplace) %{_sysconfdir}/angie/koi-utf
+%config(noreplace) %{_sysconfdir}/angie/koi-win
+%config(noreplace) %{_sysconfdir}/angie/mime.types
+%config(noreplace) %{_sysconfdir}/angie/mime.types.default
+%config(noreplace) %{_sysconfdir}/angie/angie.conf
+%config(noreplace) %{_sysconfdir}/angie/angie.conf.default
+%config(noreplace) %{_sysconfdir}/angie/prometheus_all.conf
+%config(noreplace) %{_sysconfdir}/angie/prometheus_all.conf.default
+%config(noreplace) %{_sysconfdir}/angie/scgi_params
+%config(noreplace) %{_sysconfdir}/angie/scgi_params.default
+%config(noreplace) %{_sysconfdir}/angie/uwsgi_params
+%config(noreplace) %{_sysconfdir}/angie/uwsgi_params.default
+%config(noreplace) %{_sysconfdir}/angie/win-utf
+%attr(770,%{angie_user},root) %dir %{_localstatedir}/lib/angie
+%attr(770,%{angie_user},root) %dir %{_localstatedir}/lib/angie/tmp
+%attr(700,root,root) %dir %{_localstatedir}/lib/angie/acme
+%{_tmpfilesdir}/angie.conf
+%ghost %attr(640,%{angie_user},root) %{_localstatedir}/log/angie/access.log
+%ghost %attr(640,%{angie_user},root) %{_localstatedir}/log/angie/error.log
+%dir %{_libdir}/angie
+%dir %{angie_moduledir}
+%dir %{angie_moduleconfdir}
+
+%files all-modules
+
+%files filesystem
+%dir %{_datadir}/angie
+%dir %{_datadir}/angie/html
+%dir %{_sysconfdir}/angie
+%dir %{_sysconfdir}/angie/conf.d
+%dir %{_sysconfdir}/angie/default.d
+%dir %{_sysconfdir}/systemd/system/angie.service.d
+%dir %{_unitdir}/angie.service.d
+%attr(711,root,root) %dir %{_localstatedir}/log/angie
+%{_sysusersdir}/angie.conf
+
+%if %{with geoip}
+%files mod-http-geoip
+%{angie_moduleconfdir}/mod-http-geoip.conf
+%{angie_moduledir}/ngx_http_geoip_module.so
+
+%files mod-stream-geoip
+%{angie_moduleconfdir}/zz-mod-stream-geoip.conf
+%{angie_moduledir}/ngx_stream_geoip_module.so
+%endif
+
+%files mod-http-image-filter
+%{angie_moduleconfdir}/mod-http-image-filter.conf
+%{angie_moduledir}/ngx_http_image_filter_module.so
+
+%files mod-http-perl
+%{angie_moduleconfdir}/mod-http-perl.conf
+%{angie_moduledir}/ngx_http_perl_module.so
+%{angie_perldir}/
+
+%files mod-http-xslt-filter
+%{angie_moduleconfdir}/mod-http-xslt-filter.conf
+%{angie_moduledir}/ngx_http_xslt_filter_module.so
+
+%files mod-mail
+%{angie_moduleconfdir}/mod-mail.conf
+%{angie_moduledir}/ngx_mail_module.so
+
+%files mod-stream
+%{angie_moduleconfdir}/mod-stream.conf
+%{angie_moduledir}/ngx_stream_module.so
+
+%files mod-devel
+%{_rpmmacrodir}/macros.angiemods
+%{_fileattrsdir}/angiemods.attr
+%{angie_srcdir}/
+
+
+%changelog
+* Sun Oct 18 2026 Zoran Pericic <zpericic@netst.org> - 1.12.4-1
+- Initial package, based on Fedora nginx 1.30.6 packaging
+- Dropped Fedora nginx PIDFile patch (Angie syncs daemon PID file itself)
+- Dropped Fedora nginx SSL passphrase dialog patch (does not apply)
+- Enable ACME (http + stream), MQTT and RDP preread modules
+- Perl module installed into private angie libdir path
diff --git a/angie.sysusers b/angie.sysusers
new file mode 100644
index 0000000..d452cd6
--- /dev/null
+++ b/angie.sysusers
@@ -0,0 +1,3 @@
+#Type Name     ID             GECOS                 Home directory Shell
+g angie -
+u angie - "Angie web server" /var/lib/angie /sbin/nologin
diff --git a/angie.tmpfiles b/angie.tmpfiles
new file mode 100644
index 0000000..07cbac3
--- /dev/null
+++ b/angie.tmpfiles
@@ -0,0 +1,4 @@
+d /var/lib/angie      770 angie root -
+d /var/lib/angie/tmp  770 angie root -
+d /var/lib/angie/acme 700 root  root -
+d /var/log/angie      711 root  root -
diff --git a/angie@.service b/angie@.service
new file mode 100644
index 0000000..84bb416
--- /dev/null
+++ b/angie@.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=The Angie HTTP and reverse proxy server
+After=network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+Type=forking
+Environment=ANGIE_INSTANCE=%i
+PIDFile=/run/angie-%i.pid
+# Angie will fail to start if /run/angie.pid already exists but has the wrong
+# SELinux context. This might happen when running `angie -t` from the cmdline.
+# https://bugzilla.redhat.com/show_bug.cgi?id=1268621
+ExecStartPre=/usr/bin/rm -f /run/angie-%i.pid
+ExecStartPre=/usr/sbin/angie -t -c /etc/angie/%i.conf
+ExecStart=/usr/sbin/angie -c /etc/angie/%i.conf
+ExecReload=/usr/sbin/angie -s reload -c /etc/angie/%i.conf
+KillSignal=SIGQUIT
+TimeoutStopSec=5
+KillMode=mixed
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/angiemods.attr b/angiemods.attr
new file mode 100644
index 0000000..e653252
--- /dev/null
+++ b/angiemods.attr
@@ -0,0 +1,14 @@
+%__angiemods_requires() %{lua:
+    -- Match buildroot paths of the form
+    --    /PATH/OF/BUILDROOT/usr/lib/angie/modules/  and
+    --    /PATH/OF/BUILDROOT/usr/lib64/angie/modules/
+    -- generating a line of the form:
+    --    angie(abi) = VERSION
+    local path = rpm.expand("%1")
+    if path:match("/usr/lib%d*/angie/modules/.*") then
+        local requires = "angie(abi) = " .. rpm.expand("%{_angie_abiversion}")
+        print(requires)
+    end
+}
+
+%__angiemods_path ^%{_prefix}/lib(64)?/angie/modules/.*\\.so$
diff --git a/instance.conf b/instance.conf
new file mode 100644
index 0000000..620d280
--- /dev/null
+++ b/instance.conf
@@ -0,0 +1,20 @@
+#
+# This is an example instance-specific configuration file.
+#
+# To use this example, copy instance.conf to /etc/angie/foobar.conf
+# and replace all the references to @INSTANCE@, for example using:
+#
+#   # sed s/@INSTANCE@/foobar/g < instance.conf > /etc/angie/foobar.conf
+#
+# This new configuration file be used instead of /etc/angie/angie.conf
+# when running:
+#
+#   # systemctl start angie@foobar.service
+#
+# This example configuration adjust the location of the PID file,
+# access and error logs to be instance-specific.  Further
+# customisations will be required for an instance to run
+# simultaneously to angie.service under the default configuration,
+# e.g. changing the port and root directory as appropriate.
+#
+
diff --git a/macros.angiemods.in b/macros.angiemods.in
new file mode 100644
index 0000000..58fd948
--- /dev/null
+++ b/macros.angiemods.in
@@ -0,0 +1,19 @@
+%_angie_abiversion @@ANGIE_ABIVERSION@@
+%_angie_srcdir @@ANGIE_SRCDIR@@
+%_angie_buildsrcdir angie-src
+%_angie_modsrcdir ..
+%_angie_modbuilddir ../%{_vpath_builddir}
+%angie_moddir @@ANGIE_MODDIR@@
+%angie_modconfdir @@ANGIE_MODCONFDIR@@
+
+%angie_modrequires Requires: angie(abi) = %{_angie_abiversion}
+
+%angie_modconfigure(:-:) \\\
+  %undefine _strict_symbol_defs_build \
+  cp -a "%{_angie_srcdir}" "%{_angie_buildsrcdir}" \
+  cd "%{_angie_buildsrcdir}" \
+  ./configure --with-compat --with-cc-opt="%{optflags}" --with-ld-opt="$RPM_LD_FLAGS" \\\
+              --add-dynamic-module=$(realpath %{_angie_modsrcdir}) --builddir=$(realpath %{_angie_modbuilddir}) %{**} \
+  cd -
+
+%angie_modbuild %{__make} -C "%{_angie_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} %{_make_verbose} modules