nginx: serve forked HTTP workloads with rewrite and gzip

[brandonpayton]

Why

Add Nginx as a first-class Kandelo Homebrew service Formula. It builds the real upstream server against tap PCRE2 and zlib, runs target probes inside Kandelo, fork-instruments the master/worker executable, and tests requests through the in-kernel HTTP path.

Reusable HTTP service support was reviewed and merged separately in tap #78; this PR contains only the Formula and package-list entry.

The legacy registry port cannot be installed as a normal Homebrew service package, and a reduced single-process test would miss Nginx’s defining worker behavior. The tap Formula therefore needs to prove real forked HTTP service, rewrite, compression, and dependency behavior before users rely on it.

What changed

Target/runtime dependencies are exactly:

• automattic/kandelo-homebrew/pcre2 10.44
• automattic/kandelo-homebrew/zlib 1.3.1_2

Binaryen and WABT are host build dependencies for optimization and validation.

The Formula does not enable --with-http_ssl_module, declare OpenSSL, or claim TLS behavior. Do not add an OpenSSL bottle gate.

Formula contract

• Build checksum-verified Nginx 1.30.3.
• Run cross-build feature, size, and endianness probes through Kandelo rather than host guesses.
• Enable PCRE2 rewrite, zlib gzip, poll, and stub-status support.
• Compile stable guest paths under /home/linuxbrew/.linuxbrew/opt/nginx.
• Clear stale host/dist before TypeScript configure probes.
• Optimize, fork-instrument, then validate final bytes with fork: :required.
• Reject ABI mismatch, Asyncify, incomplete continuation exports, and staging/host paths.
• Test nginx -V, master/worker fork, PCRE2 rewrite, gzip, and 404 through fetchInKernel.

Exact source head

Base: c5705667a90b05754d2244a362f3f7fc95d2f9c3

Head: 73247f504b8c47a4c39613af7e9d38c1b5d21ecc

Formula SHA-256: 826246f0a274c6e2f712eeb4c4885709e14058a64608ad7b0803fff74c829691

Official source SHA-256: e5823dc6f45610993def93ebf6cfce68264af4958c77e874b7d20f3709001b8f

The sole commit preserves the accepted Formula byte-for-byte; range-diff changes only README context from intervening tap main. Ruby syntax, source hash, byte identity, diff, ancestry, and clean-worktree checks pass.

Historical source evidence

The byte-identical Formula previously established on ABI 18:

• exact source-built PCRE2 and zlib closure
• complete Formula test covering version, master/worker fork, PCRE2 rewrite, zlib gzip, and 404
• Nginx artifact: 1,771,225 bytes, SHA-256 8acbec4ab43a30545c27b90f184b0b4bb5dc9089c222d1eb1e31d13128ad341d
• ABI 18, real fork import, complete continuation exports, no Asyncify, and no host paths

That is historical source/runtime evidence, not final ABI 39 bottle or pour evidence.

Gates

Final platform baseline is locked PR #907 at exact head bcb02e93817ba757cac3bb4a1666aa46e195193f / ABI 39. Source/runtime validation also depends on #842, #873, #882, and deterministic #888 on #889.

Publication requires #881/#887/#890/#885/#895 plus #900 dependency provenance. Build and publish ABI 39 PCRE2 and zlib bottles first; build Nginx only from those poured bottles; then publish Nginx with trusted provenance and run stock Homebrew Node/Chromium pours.

#903 is not presently required because the historical 1.77 MB forked artifact passes #882/WABT inspection; require it only if rebuilt ABI 39 bytes demonstrate the fallback condition. #905 is not a separate Nginx gate because worker creation uses fork, and #905 is already included in #907.

No bottle block, binary artifact, ABI, kernel, host-runtime, registry-package, or main-repository change is included.

[brandonpayton]

Devil's-advocate review of exact head df2ada352481fb26b70019a82547ee813ed68ecd: APPROVE the Formula source; leave this PR unmerged behind its recorded publication gates.

I re-read the complete two-file diff and challenged source integrity, dependency closure, guest/host path separation, target-probe execution, fork instrumentation ordering, ABI validation, and whether the test exercises actual Nginx behavior rather than a wrapper. No blocking source issue remains.

The review did catch a release-blocking problem in the prior head: Nginx 1.24.0 is affected by current upstream security advisories, including the enabled rewrite surface. This exact head upgrades to official stable 1.30.3 with the independently matched upstream checksum and reruns the complete source build and service test. The installed bytes report ABI 18, import kernel_fork, have the complete fork continuation surface, and contain no legacy Asyncify exports. The test drives master/worker fork, PCRE2 rewrite, zlib gzip, and 404 handling through Kandelo's in-kernel HTTP path.

Residual publication risk is explicit rather than hidden: local source-built PCRE2/zlib prove Formula behavior but do not prove bottle provenance. Do not merge until the listed main-repo gates are merged, matching ABI 18 dependency bottles are published and accepted by #900, and trusted Nginx bottle plus stock guest/browser evidence exists.

[brandonpayton]

Independent exact-head review completed for 73247f504b8c47a4c39613af7e9d38c1b5d21ecc: ACCEPT for source review; not merge/publish ready.

• Formula bytes are identical to the accepted series; range-diff change is README context only.
• The exact target closure is PCRE2 plus zlib. No SSL module, OpenSSL dependency, TLS test, or TLS claim exists.
• Historical evidence covers real master/worker fork, PCRE2 rewrite, zlib gzip, and 404 under the in-kernel runner; ABI 18 bytes are nonpublishable evidence only.
• Final baseline is exact #907 / ABI 39, plus #842/#873/#882/#888-on-#889.
• Publication requires prior ABI 39 PCRE2/zlib bottles under #900, the trusted publisher stack, and stock Node/Chromium pours.
• #903 is not currently demonstrated as necessary; #905 is not a separate fork-worker gate.

No Formula blocker was found.