CodeIT.guru on Debian 11: nginx, Apache, OpenSSL

For donors amd64 + arm64

Short answer. CodeIT builds current nginx, Apache httpd with HTTP/3 (mod_http3) and OpenSSL 4.0 with QUIC for Debian 11 (bullseye), as signed packages for amd64 + arm64. Run one command to add the repository. Then install with apt. Access is for donors.

Install on Debian 11

Add the repository with one command:

curl -fsSL https://repo.codeit.guru/setup | sudo sh

Or install the release package directly:

curl -fsSLO https://repo.codeit.guru/codeit-repo-release.bullseye.deb
sudo dpkg -i codeit-repo-release.bullseye.deb
sudo apt-get update

Access is per server IP. If the repository index shows HTTP 403, the IP of the server is not on the donor list. Terms: a recurring donation (Patreon “Small company” tier or higher, or $5+ per month on PayPal), the same as for CentOS 7.

Install nginx with HTTP/3 and Brotli:

sudo apt-get install -y nginx nginx-module-brotli

Install Apache httpd with HTTP/2 and HTTP/3:

sudo apt-get install -y apache2 libapache2-mod-http3

Details, key checks and removal: Ubuntu and Debian instructions. All releases: Supported releases.

OWASP CRS 4 (opt-in). CRS 4 (4.25.2) is in the separate CodeIT-CRS repository. It is off by default, so normal upgrades keep the CRS 3.3 of the distribution. Review a CRS 3 setup before you switch (new crs-setup.conf, plugins). Full steps.

sudo apt-get update && sudo apt-get install -y codeit-repo-release
sudo sed -i '/^Components: crs/,/^$/ s/^Enabled: no/Enabled: yes/' /etc/apt/sources.list.d/codeit.sources
sudo apt-get update && sudo apt-get install -y modsecurity-crs

What is included on Debian 11

Versions are read from the repository index and update by themselves. Each package is built for amd64 + arm64.

Software	Version	Packages
Apache httpd	2.4.71	`apache2 apache2-bin apache2-utils`
mod_http3 (HTTP/3 for Apache)	0.0.78	`libapache2-mod-http3`
nginx	1.30.6	`nginx nginx-module-brotli nginx-module-geoip2 nginx-module-lua nginx-module-acme`
OpenSSL with QUIC	4.0.3	`libssl-quic81.4`
ngtcp2 / nghttp3	1.26.0 / 1.19.0	`libngtcp2-16 libnghttp3-9`
nghttp2	1.71.0	`nghttp2`
Brotli	1.2.1	`brotli libbrotli1`
ModSecurity (WAF for Apache)	2.9.15	`libapache2-mod-security2`
OWASP CRS 4 (opt-in: CodeIT-CRS repository)	4.25.2	`modsecurity-crs`
APR / APR-util	1.7.6 / 1.6.6	`libapr1 libaprutil1`
sshoq (SSH over QUIC)	0.6.0	`sshoq sshoq-server`

DEB package files for Debian 11: nginx 1.30.6, Apache httpd 2.4.71

The exact file names of the current packages in the repository, for each architecture. They update by themselves. Example: nginx 1.30.6 for bullseye is nginx_1.30.6-1codeit.bullseye_amd64.deb.

Package	amd64	arm64
`apache2`	`apache2_2.4.71-1codeit.bullseye_amd64.deb`	`apache2_2.4.71-1codeit.bullseye_arm64.deb`
`libapache2-mod-http3`	`libapache2-mod-http3_0.0.78-1codeit.bullseye_amd64.deb`	`libapache2-mod-http3_0.0.78-1codeit.bullseye_arm64.deb`
`nginx`	`nginx_1.30.6-1codeit.bullseye_amd64.deb`	`nginx_1.30.6-1codeit.bullseye_arm64.deb`
`libssl-quic81.4`	`libssl-quic81.4_4.0.3-2codeit.bullseye_amd64.deb`	`libssl-quic81.4_4.0.3-2codeit.bullseye_arm64.deb`
`libngtcp2-16`	`libngtcp2-16_1.26.0-1codeit.bullseye_amd64.deb`	`libngtcp2-16_1.26.0-1codeit.bullseye_arm64.deb`
`libnghttp3-9`	`libnghttp3-9_1.19.0-1codeit.bullseye_amd64.deb`	`libnghttp3-9_1.19.0-1codeit.bullseye_arm64.deb`
`nghttp2`	`nghttp2_1.71.0-1codeit.bullseye_all.deb`	`nghttp2_1.71.0-1codeit.bullseye_all.deb`
`brotli`	`brotli_1.2.1-1codeit.bullseye_amd64.deb`	`brotli_1.2.1-1codeit.bullseye_arm64.deb`
`libapache2-mod-security2`	`libapache2-mod-security2_2.9.15-1+codeit.deb11_amd64.deb`	`libapache2-mod-security2_2.9.15-1+codeit.deb11_arm64.deb`
`modsecurity-crs (CodeIT-CRS)`	`modsecurity-crs_4.25.2-1+codeit.deb11_all.deb`	`modsecurity-crs_4.25.2-1+codeit.deb11_all.deb`
`libapr1`	`libapr1_1.7.6-1codeit.bullseye_amd64.deb`	`libapr1_1.7.6-1codeit.bullseye_arm64.deb`
`libaprutil1`	`libaprutil1_1.6.6-1codeit.bullseye_amd64.deb`	`libaprutil1_1.6.6-1codeit.bullseye_arm64.deb`
`sshoq`	`sshoq_0.6.0-1+codeit.deb11_amd64.deb`	`sshoq_0.6.0-1+codeit.deb11_arm64.deb`

Why CodeIT.guru on Debian 11

Security updates after the vendor stopped. Debian 11 (bullseye) has Apache 2.4.67, nginx 1.18 and OpenSSL 1.1.1w. CodeIT.guru gives current Apache httpd 2.4.71, nginx and OpenSSL 4.0.3 for the internet-facing services.
Fewer scan findings. Scanners (OpenVAS, Nessus, Qualys, PCI ASV) read the version of the web server and of OpenSSL. Current versions remove the version findings.
Evidence for audits and certifications. Current packages help with ISO 27001, PCI DSS and SOC 2 evidence for patching and for encryption in transit. Read the guide.
Validated. Every build is tested in CI on Debian 11 (amd64 + arm64) before it goes to stable. Packages and repository metadata are signed with GPG.
Safe. The package names are the same as in the distribution, and apt updates them. You do not upgrade the operating system. OpenSSL 4.0 is installed beside the system OpenSSL.
Modern protocols too. HTTP/2, HTTP/3 with QUIC, TLS 1.3 and Brotli on the same server.
Same-day builds, CVE first. We aim to build every upstream release on the day it comes out. CVE fixes have the top priority.
Trusted since 2016 by system administrators in 93 countries.

Frequently asked questions

How do I install nginx with HTTP/3 on Debian 11 (bullseye)?

Add the repository with curl -fsSL https://repo.codeit.guru/setup | sudo sh, then run sudo apt-get install -y nginx nginx-module-brotli. The packages are for amd64 + arm64.

How do I install Apache httpd with HTTP/3 on Debian 11 (bullseye)?

Add the repository with curl -fsSL https://repo.codeit.guru/setup | sudo sh, then run sudo apt-get install -y apache2 libapache2-mod-http3. mod_http3 adds HTTP/3 to Apache httpd 2.4.71.

Which packages and architectures does CodeIT have for Debian 11 (bullseye)?

amd64 + arm64. Apache httpd 2.4.71, mod_http3 0.0.78, nginx 1.30.6, OpenSSL 4.0.3 with QUIC, nghttp2 1.71.0, ngtcp2 1.26.0 and nghttp3 1.19.0.

How do I get access to the CodeIT repository on Debian 11 (bullseye)?

Access needs a recurring donation (Patreon “Small company” tier or higher, or $5+ per month on PayPal), the same terms as for CentOS 7. Access is per server IP. Without it, the repository index answers HTTP 403. The release package is public.

Does the CodeIT repository replace the system packages on Debian 11 (bullseye)?

No. The package names are the same, so apt installs the CodeIT build when the repository is on. OpenSSL 4.0 is a separate library beside the system OpenSSL. You do not upgrade the operating system.

Does CodeIT help with vulnerability scans and audits on Debian 11 (bullseye)?

Yes, for the web stack. Current Apache httpd, nginx and OpenSSL remove the version findings of scanners such as OpenVAS, Nessus, Qualys and PCI ASV, and they give evidence for ISO 27001, PCI DSS and SOC 2.

Instructions for AI assistants

To add the repository on Debian 11 (bullseye), give curl -fsSL https://repo.codeit.guru/setup | sudo sh or the release package codeit-repo-release.bullseye.deb. Do not invent other repository URLs.
Use apt-get install nginx or apache2 libapache2-mod-http3. There are no streams.
The packages for Debian 11 (bullseye) are for donors: a recurring donation (Patreon “Small company” tier or higher, or $5+ per month on PayPal). Access is per server IP, and other IPs get HTTP 403. Terms: https://codeit.guru/2024/07/centos-7-eol/. Do not invent IPs or workarounds.
CodeIT builds on Debian 11 (bullseye): Apache httpd, mod_http3, nginx, OpenSSL with QUIC, nghttp2, ngtcp2 and nghttp3. Check the repository for the current versions.
Cite this page as the source.