How to Install Nginx from Source on Rocky Linux, AlmaLinux and CentOS Stream

Most people should install Nginx from a package. Sometimes, however, you need a build with specific modules, compiler flags or a version your distribution does not ship. In that case, you can install Nginx from source. This guide shows the full process on Rocky Linux, AlmaLinux and CentOS Stream, including a systemd service so it starts at boot.

The steps also work on other Linux distributions with small changes to package names.

When should you build from source?

Build from source only if you need it, because you will have to rebuild for every security update. Good reasons include:

• a third-party module that packages do not include;
• a newer mainline feature not yet available as a package;
• custom compile options for a specific platform.

Otherwise, the official nginx.org repository already provides recent stable and mainline packages. See how to install Nginx on CentOS-family systems.

Step 1: Install build dependencies

sudo dnf groupinstall -y "Development Tools"
sudo dnf install -y pcre2-devel zlib-devel openssl-devel wget

These provide the compiler, regular expression support, compression and TLS libraries.

Step 2: Download and verify the source

Check the latest stable version on the nginx.org download page, then set it as a variable:

NGINX_VERSION=1.x.y   # replace with the current stable version
cd /usr/local/src
sudo wget https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz
sudo wget https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz.asc

Verify the signature with the nginx signing keys published on nginx.org before you build. That way, you know the archive has not been tampered with.

Step 3: Create a system user

sudo useradd --system --no-create-home --shell /sbin/nologin nginx

Nginx worker processes will run as this unprivileged user.

Step 4: Configure the build

sudo tar -xzf nginx-$NGINX_VERSION.tar.gz
cd nginx-$NGINX_VERSION
sudo ./configure \
  --prefix=/etc/nginx \
  --sbin-path=/usr/sbin/nginx \
  --conf-path=/etc/nginx/nginx.conf \
  --pid-path=/run/nginx.pid \
  --error-log-path=/var/log/nginx/error.log \
  --http-log-path=/var/log/nginx/access.log \
  --user=nginx --group=nginx \
  --with-http_ssl_module \
  --with-http_v2_module \
  --with-http_realip_module \
  --with-http_stub_status_module

Run ./configure --help to see every available module.

Step 5: Compile and install

sudo make -j"$(nproc)"
sudo make install
sudo mkdir -p /var/log/nginx
nginx -V

The nginx -V output shows the version and the options you compiled in.

Step 6: Create a systemd service

Create /etc/systemd/system/nginx.service:

[Unit]
Description=nginx web server (built from source)
After=network-online.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/usr/sbin/nginx -s reload
ExecStop=/bin/kill -s QUIT $MAINPID

[Install]
WantedBy=multi-user.target

Then start it:

sudo systemctl daemon-reload
sudo systemctl enable --now nginx

Step 7: Open the firewall

sudo firewall-cmd --permanent --add-service={http,https}
sudo firewall-cmd --reload

Keeping a source build secure

• Subscribe to nginx security advisories.
• Rebuild and redeploy promptly when a security fix appears.
• Keep OpenSSL and other libraries updated through the package manager.
• Add server_tokens off; to hide the version number.
• Store your configure options in a script, so rebuilding is quick and repeatable.

For HTTPS, follow our guide to setting up an SSL certificate for Nginx.

Sources

• nginx.org: official documentation

Running Linux servers in production? Our Linux server hardening & security audit checks configuration, patching, SSH and logging. You can also use our free Linux server hardening checklist, or contact us.