nginx: serve forked HTTP workloads with rewrite and gzip

[brandonpayton]

Purpose

Replace the source-only nginx registry artifact with a first-class Kandelo Homebrew formula that runs the unmodified nginx 1.24.0 service through the normal ABI 18 SDK, fork instrumentation, VFS, process, and in-kernel TCP paths.

The formula preserves nginx's real master/worker process model and publishes a useful HTTP surface: PCRE2-backed rewrites, zlib-backed compression, static files, and the upstream configuration/manual files.

Registry reconciliation

packages/registry/nginx/package.toml remains authoritative for:

• Version: 1.24.0
• Source: https://nginx.org/download/nginx-1.24.0.tar.gz
• SHA-256: 77a2541637b92a621e3ee76776c8b7b40cf6d707e69ba53a940283e30ff2f55d
• License: BSD-2-Clause
• Architecture: wasm32

The registry recipe disabled rewrite and gzip and used hard-coded/compile-only configure answers. This formula instead declares the first-class pcre2 and zlib formulae and exercises the resulting modules at runtime. PCRE2 #37 is merged into tap main, so the declared pcre2 build/runtime dependency now resolves from the PR base.

zlib #39 is not a merge dependency for nginx: that PR makes libz.a usable inside Wasm side modules, while nginx links zlib statically into a main executable. The zlib formula already on tap main satisfies this formula's link contract.

Build and runtime contract

Upstream's supported --crossbuild path still executes target feature probes directly. The formula makes a narrow configure patch that routes those target binaries through Kandelo's Node host. Configure therefore observes actual wasm32/Kandelo behavior for sizes, endianness, poll, mmap, PCRE2, zlib, and the remaining feature surface instead of inheriting host facts or guessed cache values.

The build also:

• uses the stable guest prefix /home/linuxbrew/.linuxbrew/opt/nginx;
• explicitly selects the guest nobody account instead of probing the build host's account database;
• optimizes and fork-instruments the final Wasm;
• rejects ABI mismatch, legacy Asyncify, and incomplete fork instrumentation;
• strips builder/Cellar paths from nginx's embedded configure report;
• installs the executable, upstream configuration, HTML files, and manpage through normal Homebrew paths.

The shared formula support gains a persistent HTTP-service runner. It boots the regular Kandelo rootfs, mounts the formula test tree and keg, starts the service with explicit guest credentials, issues requests through fetchInKernel, and returns status, headers, and response bytes without a host TCP shortcut.

The formula test runs master_process on and checks:

• a PCRE2 rewrite from /old/message.txt to /new/message.txt;
• zlib compression for Accept-Encoding: gzip;
• the expected 404 path.

Platform and publication gates

The PCRE2 dependency is resolved on tap main. Bottle construction and publication still wait for the applicable platform and publisher gates:

• Automattic/kandelo#842, linked-program main-thread stack sizing
• Automattic/kandelo#867, ABI 18 fork continuation correctness
• Automattic/kandelo#873, repository-workspace fork-tool build
• Automattic/kandelo#874, cross-compile function facts
• Automattic/kandelo#882, ABI export guard
• Automattic/kandelo#885, tap-native formula publication
• deterministic fork-instrument output before any bottle hash is treated as reproducible
• the publisher's scoped tap trust and fork-tool prebuild

No bottle block is included.

Validation

All build and runtime validation ran through scripts/dev-shell.sh against the ABI 18 integration runtime. The final source content is commit 18c7526d8d09efa87300fb73f3e6f3e4d32877e9; the staged formula checksum recorded by Homebrew is cc7483494eb0f3c8b30961249df479f9002c3fd2aa673b1f184211dd06aa323d.

• Exact-source brew reinstall --build-from-source passed: 19 installed files, 2 MB, built in 38 seconds.
• brew test --verbose automattic/kandelo-homebrew/nginx passed, including the forked master/worker service, rewrite, gzip, and 404 assertions.
• Chromium booted the exact installed artifact and passed the same rewrite/gzip/404 service scenario.
• Final artifact instance: 1,715,365 bytes; SHA-256 bb40ef62fb5bc1d4f70df639b34345620912a70bceda6577c5226a6c5e7fda3b; ABI 18; complete fork instrumentation; no legacy Asyncify; no host/build paths; stable guest prefix present. This is validation evidence, not a publishable bottle hash while determinism is gated.
• Formula-support tests: 6 runs, 48 assertions, no failures.
• Prettier and standalone TypeScript checks passed for the new runner.
• brew style, brew audit --strict, brew readall --aliases, and git diff --check passed.
• Full Kandelo conformance suites were not rerun because this PR changes the tap formula and formula-test support rather than the kernel, host ABI, or libc. The targeted Node and Chromium process/network paths were both exercised.

Current-main restack

Replayed the single nginx-owned commit from the old PCRE2 branch head adb23647f1f93bc856cbfcf7a9c2f375f7e6226e onto tap main 306d72707b97a92f174876615b2861655ce80bd5, which contains squash-merged PCRE2 #37. The replay was conflict-free. Stable patch ID 617c2cc7de6d67acf4b09317ae197f52df8f484a is unchanged from the previous nginx head.

The nginx formula blob 0849a983667e6f093af9d269da73f10258652571 and HTTP runner blob cf2fd2d12893101987f0cc68b9a28be10e024711 are byte-for-byte identical to both the previous branch head and validated 18c7526d8d09efa87300fb73f3e6f3e4d32877e9. The main-relative PR diff contains only Formula/nginx.rb, the nginx HTTP formula-support helper and tests, and the nginx README entry.

Current head: f9401d829ddca8ec8ce2bf1f9bd0a76f8687f693. Through scripts/dev-shell.sh, Homebrew Ruby syntax passed for the formula and shared support, literal formula loading through the installed tap passed, brew style Formula/nginx.rb passed, the combined support suite passed 22 runs / 200 assertions, and git diff --check passed. The worktree is clean.

No source build, runtime result, or bottle is newly claimed by this restack. The unchanged formula and runner retain the exact artifact evidence above. PCRE2 #37 is now resolved; the remaining bottle gates are the platform and publisher items listed above.

[brandonpayton]

Superseded by the clean split now in place:

• Test HTTP services through Kandelo in-kernel networking #78 merged the reusable HTTP-service runner after exact-head review and real ABI 18 service validation.
• nginx: serve forked HTTP workloads with rewrite and gzip #79 contains the Nginx-only Formula and README change on current tap main.

The replacement Formula also moves from Nginx 1.24.0 to official stable 1.30.3 after review identified current upstream security advisories affecting the older release. #79 has fresh exact-head source-build and Kandelo service evidence and remains deliberately unmerged behind its dependency-bottle and main-repository gates.

Closing this stale, conflict-bearing branch so there is one authoritative Nginx review surface.