Skip to content

[feature] Serve precompressed static files #653

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nemesifier wants to merge 2 commits into
base: master
Choose a base branch
from
Open

[feature] Serve precompressed static files #653

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
12d719f
[feature] Added support for pre-compressed gzip/brotli files #560
nemesifier Jul 3, 2026
d0931d5
[fix] Serve precompressed static files in nginx
nemesifier Jul 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions docs/user/settings.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -951,6 +951,14 @@ Nginx
application/x-font-ttf font/opentype``.
- **Default:** ``\*``.

``NGINX_BROTLI_SWITCH``
~~~~~~~~~~~~~~~~~~~~~~~

- **Explanation:** Enables or disables serving precompressed Brotli files
from the static files directory.
- **Valid Values:** ``on``, ``off``.
- **Default:** ``on``.

``NGINX_HTTPS_ALLOWED_IPS``
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Expand Down
4 changes: 0 additions & 4 deletions images/openwisp_dashboard/module_settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,10 +85,6 @@
"BACKEND": "openwisp_utils.storage.CompressStaticFilesStorage",
},
}
BROTLI_STATIC_COMPRESSION = False
# pregenerate static gzip files to save CPU
GZIP_STATIC_COMPRESSION = True

HTTP_SCHEME = request_scheme()
HTTP_PORT = (
os.getenv("NGINX_SSL_PORT", "443")
Expand Down
42 changes: 41 additions & 1 deletion images/openwisp_nginx/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,46 @@
FROM nginx:1.31.2-alpine

@nemesifier nemesifier Jul 4, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai wouldn't this cause problems do dependabot?

@coderabbitai coderabbitai Bot Jul 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🤖 web_search executed:

Does Dependabot support updating Docker FROM image version when using a global ARG variable for the tag in multi-stage builds?

Length of output: 9360

🏁 Script executed:

#!/bin/bash
fd -i dependabot .github -a
cat .github/dependabot.yml 2>/dev/null

Length of output: 1238

@nemesifier, good instinct to double-check, but this pattern should actually work fine with Dependabot.

Docker ecosystem is enabled for /images/openwisp_nginx in .github/dependabot.yml, so the Dockerfile is scanned.

The key thing here is that Dependabot added explicit "global ARG" support (dependabot-core#2057, landed via PR #4837) precisely for this pattern: an ARG with a default value declared before the first FROM, then redeclared inside each stage that needs it. That's exactly what this Dockerfile does:

ARG NGINX_VERSION=1.31.2
...
FROM nginx:${NGINX_VERSION}-alpine AS brotli-builder
ARG NGINX_VERSION
...
FROM nginx:${NGINX_VERSION}-alpine
ARG NGINX_VERSION

Since both FROM lines resolve the same NGINX_VERSION variable (not two independently hardcoded tags), Dependabot's parser treats it as a single dependency and only needs to bump the one ARG NGINX_VERSION=1.31.2 line — it won't try to open separate/conflicting PRs for each FROM. That "two FROM directives" problem (dependabot-core#6700) mainly affects Dockerfiles where each FROM hardcodes its own version string independently (e.g., nginx:1.19.9 and nginx:1.19.9-alpine written separately) — that's not the case here since both stages share the same ARG-driven tag.

So, this should be safe — Dependabot will detect the ARG NGINX_VERSION=1.31.2 line and bump it, updating both stages consistently in a single PR.

ARG NGINX_VERSION=1.31.2

# Build the nginx brotli module against nginx.org's nginx package used by this image.
# Alpine's nginx module packages target Alpine's own nginx build.
FROM nginx:${NGINX_VERSION}-alpine AS brotli-builder

ARG NGINX_VERSION
ARG NGX_BROTLI_VERSION=v1.0.0rc

# hadolint ignore=DL3003,DL3018
RUN apk add --update --no-cache \
brotli-dev \
build-base \
git \
linux-headers \
openssl-dev \
pcre2-dev \
zlib-dev && \
git clone --depth 1 --branch ${NGX_BROTLI_VERSION} --recurse-submodules \
https://github.com/google/ngx_brotli.git /tmp/ngx_brotli && \
wget -q https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz \
-O /tmp/nginx-${NGINX_VERSION}.tar.gz && \
tar xzf /tmp/nginx-${NGINX_VERSION}.tar.gz -C /tmp && \
cd /tmp/nginx-${NGINX_VERSION} && \
./configure \
--with-compat \
--with-cc-opt='-Wno-error=unterminated-string-initialization -Wno-error=vla-parameter' \
--add-dynamic-module=/tmp/ngx_brotli && \
make modules

FROM nginx:${NGINX_VERSION}-alpine

ARG NGINX_VERSION

RUN mkdir -p /etc/nginx/modules

COPY --from=brotli-builder \
/tmp/nginx-${NGINX_VERSION}/objs/ngx_http_brotli_static_module.so \
/etc/nginx/modules/ngx_http_brotli_static_module.so

# hadolint ignore=DL3018
RUN apk add --update --no-cache \
brotli-libs \
py3-pip \
certbot \
certbot-nginx \
Expand Down Expand Up @@ -41,6 +80,7 @@ ENV MODULE_NAME=nginx \
NGINX_GZIP_PROXIED=any \
NGINX_GZIP_MIN_LENGTH=1000 \
NGINX_GZIP_TYPES='text/plain image/svg+xml application/json application/javascript text/xml text/css application/xml application/x-font-ttf font/opentype' \
NGINX_BROTLI_SWITCH=on \
NGINX_CUSTOM_FILE=False \
NGINX_WORKER_PROCESSES=1 \
NGINX_WORKER_CONNECTIONS=1024 \
Expand Down
2 changes: 2 additions & 0 deletions images/openwisp_nginx/nginx.template.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
# Changes in given http block reflect in
# all openwisp server blocks.

load_module modules/ngx_http_brotli_static_module.so;

user nginx;
worker_processes ${NGINX_WORKER_PROCESSES};
worker_rlimit_nofile ${NGINX_WORKER_RLIMIT_NOFILE};
Expand Down
10 changes: 8 additions & 2 deletions images/openwisp_nginx/openwisp.ssl.template.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ server {

# GZIP Configurations
gzip ${NGINX_GZIP_SWITCH};
gzip_static ${NGINX_GZIP_SWITCH};
gzip_comp_level ${NGINX_GZIP_LEVEL};
gzip_proxied ${NGINX_GZIP_PROXIED};
gzip_min_length ${NGINX_GZIP_MIN_LENGTH};
Expand Down Expand Up @@ -61,8 +60,15 @@ server {
allow $NGINX_ADMIN_ALLOW_NETWORK;
deny all;
}
location /static/custom/ {
alias /opt/openwisp/public/custom/static/custom/;
gzip_static ${NGINX_GZIP_SWITCH};
brotli_static ${NGINX_BROTLI_SWITCH};
}
location /static/ {
try_files /custom${DOLLAR}uri /${DOLLAR}uri;
alias /opt/openwisp/public/static/;
gzip_static ${NGINX_GZIP_SWITCH};
brotli_static ${NGINX_BROTLI_SWITCH};
}
location / {
try_files /custom/maintenance.html ${DOLLAR}uri ${DOLLAR}uri/index.html @uwsgi;
Expand Down
9 changes: 8 additions & 1 deletion images/openwisp_nginx/openwisp.template.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,15 @@ server {
proxy_set_header Upgrade ${DOLLAR}http_upgrade;
proxy_set_header Connection "upgrade";
}
location /static/custom/ {
alias /opt/openwisp/public/custom/static/custom/;
gzip_static ${NGINX_GZIP_SWITCH};
brotli_static ${NGINX_BROTLI_SWITCH};
}
location /static/ {
try_files /custom${DOLLAR}uri /${DOLLAR}uri;
alias /opt/openwisp/public/static/;
gzip_static ${NGINX_GZIP_SWITCH};
brotli_static ${NGINX_BROTLI_SWITCH};
}
location / {
error_page 403 = @deny;
Expand Down
Loading