#==============================================================================
# THIRD-PARTY MODULE MANIFEST
#
# One module per line:   <git-url> [ref]
#
# No refs are pinned here -- every module tracks its default branch, so each
# build picks up the latest upstream code. The tradeoff is that two builds of
# the same nginx version are not guaranteed identical; add a tag or commit SHA
# as a second field if you ever need to freeze one.
#
# Every entry becomes a --add-module=<clone-dir> on the ./configure line.
# '#' starts a comment. Blank lines are ignored.
#
# If a module does not compile against your nginx version (common -- most of
# these lag upstream by several releases), drop a patch into:
#     builder/patches/modules/<module-name>/*.patch
#
# Modules linking OS libraries (geoip2 -> libmaxminddb) need those libraries
# present in the NGINX UI RUNTIME container too, not just the builder.
# Verify after deploying:  docker exec <ctr> ldd /opt/custom/bin/nginx
#==============================================================================

#------------------------------------------------------------------------------
# NTLM proxy support
#
# Adds `ntlm;` and `ntlm_timeout` inside an upstream block. Derived from
# nginx's own keepalive module.
#
# KNOWN RISK - read before trusting this in production:
#   * Upstream's own README says it is not production-grade; NGINX Plus ships
#     supported NTLM instead.
#   * The repo has had no commits since 2021-06-04, and open issues report it
#     not working on recent nginx:
#       #20 "1.30+ can't be effect"
#       #19 "Nginx1.28.1+ ExchangeSE only log: ntlm auth header found"
#     The default target of 1.31.3 is inside that range. It may compile and
#     still fail to hold connections at runtime - verify against a real NTLM
#     upstream. If it needs source fixes, put them in
#     patches/modules/nginx-ntlm-module/*.patch rather than forking.
#------------------------------------------------------------------------------
https://github.com/gabihodoroaga/nginx-ntlm-module

#------------------------------------------------------------------------------
# headers-more
#
# more_set_headers / more_clear_headers - set, replace, or REMOVE any response
# header, including hiding `Server:`. The built-in add_header can only append,
# and cannot touch headers coming back from an upstream.
#------------------------------------------------------------------------------
https://github.com/openresty/headers-more-nginx-module

#------------------------------------------------------------------------------
# substitutions filter
#
# subs_filter - regular-expression rewriting of RESPONSE BODIES, multiple
# patterns per location. The built-in sub_filter does fixed strings only.
# The usual fix for proxied legacy apps that emit absolute internal URLs.
#------------------------------------------------------------------------------
https://github.com/yaoweibin/ngx_http_substitutions_filter_module

#------------------------------------------------------------------------------
# GeoIP2 / MaxMind -- DISABLED. Do not enable without reading this.
#
# geoip2 {} blocks resolving country/city/ASN from a .mmdb database.
#
# This was enabled once and BROKE THE STACK. The module links libmaxminddb
# dynamically, and that library does not exist in the Nginx UI image -- the
# stock image ships the LEGACY nginx-module-geoip (libgeoip), a different
# library. The result is not a degraded feature, it is a crash loop:
#
#   nginx: error while loading shared libraries: libmaxminddb.so.0:
#          cannot open shared object file: No such file or directory
#
# nginx cannot start AT ALL, because the loader resolves every dependency
# before main() runs. There is no partial-failure mode.
#
# This is the one module here that breaks the project's premise of changing
# nothing inside the runtime image. To use it anyway you must ALSO get
# libmaxminddb into that image -- and supply/refresh the .mmdb database.
#
# build.sh now runs `ldd` inside the container after every build and warns
# about exactly this before you redeploy.
#------------------------------------------------------------------------------
# https://github.com/leev/ngx_http_geoip2_module

#------------------------------------------------------------------------------
# Further options -- uncomment as needed.
#
# Check the runtime library cost before enabling any of these; anything needing
# a library absent from the Nginx UI image will crash-loop nginx the same way
# geoip2 did. Pure-nginx modules (no external -l flags) are always safe.
#
# ngx_brotli needs `git clone --recursive`; compile.sh does a shallow clone
# without submodules, so it needs a change there before it will build.
#------------------------------------------------------------------------------
# https://github.com/stnoonan/spnego-http-auth-nginx-module   # needs libkrb5
# https://github.com/vozlt/nginx-module-vts                   # per-vhost metrics
# https://github.com/nginx/njs                                # JavaScript
# https://github.com/google/ngx_brotli                        # see note above
