feat: add support for pacman package manager in NGINX installer scripts

README.md

@@ -31,7 +31,7 @@ pwsh ./<tool>_installer.ps1
 | `podman/` | `podman_installer.sh` | Linux | Distribution repositories |
 | `terraform/` | `terraform_installer.sh` | Linux | HashiCorp repositories |
 | `TLS-tools/` | `TLS-checker.ps1` | Cross-platform | Tests TLS versions, HTTP versions, QUIC, HSTS, compression |
-| `TLS-tools/` | `testssl.sh` (submodule) | Linux | Comprehensive TLS/SSL scanner by Dirk Wetter — pinned at v3.2.3 |
+| `TLS-tools/` | `testssl.sh` (submodule) | Linux | Comprehensive TLS/SSL scanner by Dirk Wetter — pinned at a specific version |
 | `windows/` | `Enable-WinRM.ps1` | Windows | Configures WinRM for remote management |
 | `windows/` | `Get-InstalledSoftware.ps1` | Windows | Lists installed software from registry |
 | `windows/` | `configure-Windows-VM.ps1` | Windows | Disables unnecessary services for VMs |

TLS-tools/README.md

@@ -6,7 +6,7 @@ Tools for testing TLS/SSL configurations and HTTP security features.
 
 Cross-platform PowerShell script that tests TLS versions, HTTP versions, compression, QUIC, and HSTS using a self-contained cURL binary.
 
-**Requirements:** PowerShell 7.5.0+
+**Requirements:** PowerShell 7.5+
 
 ```powershell
 .\TLS-checker.ps1 -Domain "example.com" -TestType All
@@ -17,7 +17,7 @@ Cross-platform PowerShell script that tests TLS versions, HTTP versions, compres
 
 Really strong TLS/SSL scanner. This one is included as a submodule from a project that I like. It scans ciphers, protocols, certificates, and vulnerabilities.
 
-Currently, the Git submodule is pinned at v3.2.3. If missing after cloning, run:
+Currently, the Git submodule is pinned at a specific version. If missing after cloning, run:
 
 ```bash
 git submodule update --init

TLS-tools/TLS-checker.ps1

@@ -4,7 +4,7 @@
   TLS & HTTP feature tester using static cURL binary.
 .DESCRIPTION
   Downloads a self-contained curl if needed, then tests compression, TLS versions,
-  HTTP versions, QUIC, and HSTS for given domains. Requires PowerShell 7.5.0 or higher.
+  HTTP versions, QUIC, and HSTS for given domains. Requires PowerShell 7.5 or higher.
 .PARAMETER Domain
   The domain to test (can be provided interactively)
 .PARAMETER TestType
@@ -34,7 +34,7 @@
 .EXAMPLE
   .\TLS-checker.ps1 -Domain "example.com" -TestType "All" -PreferMusl
 .NOTES
-  Requires: PowerShell 7.5.0+
+  Requires: PowerShell 7.5+
 
   If you experience issues on Linux, try running with -Verbose to see detailed debugging information.
   This will show platform detection, curl binary selection, and connection attempts.

ansible/ansible_installer.sh

@@ -2,7 +2,7 @@
 #
 # Ansible Installer Script
 #
-# Installs Ansible 13.5.0 (with its bundled ansible-core dependency) in a Python 3.14 virtual environment.
+# Installs Ansible (with its bundled ansible-core dependency) in a Python virtual environment.
 # Note: 'ansible' is the community package; 'ansible-core' is the engine it ships with.
 # Supports Debian/Ubuntu (apt) and RHEL/Fedora (dnf).
 # Run as root.
@@ -141,7 +141,7 @@ else
 fi
 
 # === Install Ansible ===
-info "Installing Ansible 13.5.0 (community package, bundles ansible-core~=2.20.4)..."
+info "Installing Ansible (community package, bundles ansible-core)..."
 (
     source "$VENV_DIR/bin/activate"
     command -v pip &>/dev/null || error "pip not found in venv."

nginx/nginx_installer.ps1

@@ -3,7 +3,7 @@
     NGINX Installer Script for Linux (PowerShell)
 
 .DESCRIPTION
-    Builds and installs NGINX with OpenSSL 3.6, HTTP/3, zstd compression,
+    Builds and installs NGINX with OpenSSL, HTTP/3, zstd compression,
     and ACME support on Linux.
 
 .PARAMETER Command
@@ -156,6 +156,8 @@ function Get-PkgMgr {
         return 'apt'
     } elseif (Get-Command dnf -ErrorAction SilentlyContinue) {
         return 'dnf'
+    } elseif (Get-Command pacman -ErrorAction SilentlyContinue) {
+        return 'pacman'
     } else {
         return 'unknown'
     }
@@ -189,8 +191,13 @@ function Install-Dependencies {
         'dnf' {
             & dnf install -y -q gcc gcc-c++ make pcre2-devel zlib-devel libzstd-devel curl perl cargo pkgconf-pkg-config clang gawk cmake 2>&1 | Out-Null
         }
+        'pacman' {
+            if (-not (& pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf 2>&1 | Out-Null)) {
+                Write-Log WARN "pacman install failed, will try rustup for cargo. Note: zlib is not required (zlib-ng-compat provides it)."
+            }
+        }
         default {
-            Stop-Script 'Unsupported package manager. Only apt and dnf are supported.'
+            Stop-Script 'Unsupported package manager. Only apt, dnf and pacman are supported.'
         }
     }
 
@@ -227,6 +234,10 @@ function Update-SystemPackages {
             if ($LASTEXITCODE -ne 0) { Stop-Script 'dnf upgrade failed' }
             if ($dnfOutput) { $dnfOutput | Out-Host }
         }
+        'pacman' {
+            & pacman -Syu --noconfirm 2>&1 | Out-Null
+            if ($LASTEXITCODE -ne 0) { Stop-Script 'pacman upgrade failed' }
+        }
         default {
             Write-Log 'WARN' 'Unable to detect package manager'
         }
@@ -360,6 +371,7 @@ function Build-Nginx {
         switch ($mgr) {
             'apt' { & apt-get install -y libssl-dev 2>&1 | Out-Null }
             'dnf' { & dnf install -y openssl-devel 2>&1 | Out-Null }
+            'pacman' { & pacman -Sy --noconfirm openssl 2>&1 | Out-Null }
         }
         Write-Log 'INFO' 'Using system OpenSSL'
     }
@@ -371,13 +383,10 @@ function Build-Nginx {
     Push-Location $nginxSrc
 
     # Verify libzstd availability
-    $ldconfigOut = bash -lc 'ldconfig -p 2>/dev/null || true'
-    if (-not ($ldconfigOut -match 'libzstd\.so')) {
-        $zstdPaths = @('/usr/lib/libzstd.so', '/usr/lib64/libzstd.so', '/usr/local/lib/libzstd.so')
-        $found = $zstdPaths | Where-Object { Test-Path $_ }
-        if (-not $found) {
-            Stop-Script 'Shared libzstd not found. Install libzstd-dev/devel'
-        }
+    $zstdPaths = @('/usr/lib/libzstd.so', '/usr/lib/libzstd.so.1', '/usr/lib64/libzstd.so', '/usr/lib64/libzstd.so.1', '/usr/local/lib/libzstd.so')
+    $found = $zstdPaths | Where-Object { Test-Path $_ }
+    if (-not $found) {
+        Stop-Script 'Shared libzstd not found. Install libzstd-dev/devel'
     }
 
     $pcre2Path   = Join-Path $Script:BUILD_DIR 'pcre2'
@@ -548,6 +557,7 @@ function New-NginxSelfSignedCertificate {
         switch ($mgr) {
             'apt' { & apt-get install -y openssl 2>&1 | Out-Null }
             'dnf' { & dnf install -y openssl 2>&1 | Out-Null }
+            'pacman' { & pacman -Sy --noconfirm openssl 2>&1 | Out-Null }
         }
         $opensslBin = (Get-Command openssl -ErrorAction SilentlyContinue)?.Source
     }
@@ -610,7 +620,8 @@ http {
     tcp_nopush      on;
     tcp_nodelay     on;
     keepalive_timeout  65;
-    types_hash_max_size 2048;
+    types_hash_max_size 4096;
+    types_hash_bucket_size 128;
 
     # Gzip compression
     gzip  on;
@@ -740,8 +751,10 @@ function Install-Nginx {
     }
 
     # Install dynamic modules
-    Copy-Item "$Script:BUILD_DIR/nginx/objs/*.so" -Destination $Script:NGINX_MODULES_PATH -Force -ErrorAction SilentlyContinue
-    Copy-Item "$Script:BUILD_DIR/nginx-acme/objs/ngx_http_acme_module.so" -Destination $Script:NGINX_MODULES_PATH -Force -ErrorAction SilentlyContinue
+    Copy-Item "$Script:BUILD_DIR/nginx/objs/*.so" -Destination $Script:NGINX_MODULES_PATH -Force
+    if ($LASTEXITCODE -ne 0) { Stop-Script "Failed to copy NGINX modules" }
+    Copy-Item "$Script:BUILD_DIR/nginx-acme/objs/ngx_http_acme_module.so" -Destination $Script:NGINX_MODULES_PATH -Force
+    if ($LASTEXITCODE -ne 0) { Stop-Script "Failed to copy ACME module" }
 
     # Install configuration files
     Install-HtmlFiles
@@ -752,6 +765,9 @@ function Install-Nginx {
     bash -c 'id nginx 2>/dev/null || useradd -r -s /sbin/nologin nginx' | Out-Null
 
     bash -c "chown -R nginx:nginx /var/log/nginx /var/cache/nginx /var/lib/nginx" | Out-Null
+    bash -c "chown root:nginx /etc/nginx/ssl" | Out-Null
+    bash -c "chmod 640 /etc/nginx/ssl/nginx.key" | Out-Null
+    bash -c "chmod 644 /etc/nginx/ssl/nginx.crt" | Out-Null
     bash -c "chmod 755 /etc/nginx/conf.d '$Script:NGINX_MODULES_PATH'" | Out-Null
 
     # Create systemd service

nginx/nginx_installer.sh

@@ -6,7 +6,7 @@ set -euo pipefail
 # ============================================================================
 #
 # Description:
-#   Builds and installs NGINX with OpenSSL 3.6, HTTP/3, zstd compression,
+#   Builds and installs NGINX with OpenSSL, HTTP/3, zstd compression,
 #   and ACME support on Linux.
 #
 # Usage:
@@ -126,6 +126,8 @@ Detect-PkgMgr() {
         echo "apt"
     elif command -v dnf >/dev/null 2>&1; then
         echo "dnf"
+    elif command -v pacman >/dev/null 2>&1; then
+        echo "pacman"
     else
         echo "unknown"
     fi
@@ -153,8 +155,13 @@ Install-Dependencies() {
         dnf)
             dnf install -y -q gcc gcc-c++ make pcre2-devel zlib-devel libzstd-devel curl perl cargo pkgconf-pkg-config clang gawk cmake >/dev/null 2>&1
             ;;
+        pacman)
+            if ! pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf >/dev/null 2>&1; then
+                Write-Log WARN "pacman install failed, will try rustup for cargo. Note: zlib is not required (zlib-ng-compat provides it)."
+            fi
+            ;;
         *)
-            Stop-Script "Unsupported package manager. Only apt and dnf are supported."
+            Stop-Script "Unsupported package manager. Only apt, dnf and pacman are supported."
             ;;
     esac
 
@@ -188,6 +195,9 @@ Update-SystemPackages() {
                 Stop-Script "dnf upgrade failed"
             fi
             ;;
+        pacman)
+            pacman -Syu --noconfirm >/dev/null 2>&1 || Write-Log WARN "pacman upgrade failed"
+            ;;
         *)
             Write-Log WARN "Unable to detect package manager"
             ;;
@@ -294,7 +304,9 @@ Build-Nginx() {
                 use_system_ssl=true
                 Write-Log WARN "OpenSSL build failed"
             else
-                make install_sw 2>&1 | grep -v '^DEBUG:' || true
+                if ! make install_sw >/dev/null 2>&1; then
+                    Stop-Script "OpenSSL make install_sw failed"
+                fi
                 ssl_opt="--with-openssl=$BUILD_DIR/openssl"
                 Write-Log INFO "OpenSSL built successfully"
             fi
@@ -308,6 +320,7 @@ Build-Nginx() {
         case $mgr in
             apt) apt-get install -y libssl-dev >/dev/null 2>&1 ;;
             dnf) dnf install -y openssl-devel >/dev/null 2>&1 ;;
+            pacman) pacman -Sy --noconfirm openssl >/dev/null 2>&1 ;;
         esac
         Write-Log INFO "Using system OpenSSL"
     fi
@@ -320,14 +333,9 @@ Build-Nginx() {
     export CC=gcc
 
     # Verify libzstd availability
-    if command -v ldconfig >/dev/null 2>&1; then
-        if ! ldconfig -p 2>/dev/null | grep -q "libzstd.so"; then
-            Stop-Script "Shared libzstd not found. Install libzstd-dev/devel"
-        fi
-    else
-        if [[ ! -f /usr/lib/libzstd.so && ! -f /usr/lib64/libzstd.so && ! -f /usr/local/lib/libzstd.so ]]; then
-            Stop-Script "Shared libzstd not found"
-        fi
+    if [[ ! -f /usr/lib/libzstd.so && ! -f /usr/lib/libzstd.so.1 && 
+          ! -f /usr/lib64/libzstd.so && ! -f /usr/lib64/libzstd.so.1 ]]; then
+        Stop-Script "Shared libzstd not found. Install libzstd-dev/devel"
     fi
 
     export LDFLAGS="-lzstd"
@@ -483,6 +491,7 @@ New-SelfSignedCertificate() {
         case $mgr in
             apt) apt-get install -y openssl >/dev/null 2>&1 ;;
             dnf) dnf install -y openssl >/dev/null 2>&1 ;;
+            pacman) pacman -Sy --noconfirm openssl >/dev/null 2>&1 ;;
         esac
         ssl_bin=$(command -v openssl || true)
     fi
@@ -560,7 +569,8 @@ http {
     tcp_nopush      on;
     tcp_nodelay     on;
     keepalive_timeout  65;
-    types_hash_max_size 2048;
+    types_hash_max_size 4096;
+    types_hash_bucket_size 128;
 
     # Gzip compression
     gzip  on;
@@ -659,6 +669,9 @@ Install-Nginx() {
         Stop-Script "Nginx install failed"
     fi
 
+    # Verify nginx binary exists
+    [[ -x /usr/sbin/nginx ]] || Stop-Script "NGINX binary not found after install"
+
     # Create directories
     mkdir -p /etc/nginx/{conf.d,sites-available,sites-enabled}
     mkdir -p "${NGINX_MODULES_PATH}"
@@ -685,6 +698,9 @@ Install-Nginx() {
     fi
 
     chown -R nginx:nginx /var/log/nginx /var/cache/nginx /var/lib/nginx
+    chown root:nginx /etc/nginx/ssl
+    chmod 640 /etc/nginx/ssl/nginx.key
+    chmod 644 /etc/nginx/ssl/nginx.crt
     chmod 755 /etc/nginx/conf.d "${NGINX_MODULES_PATH}"
 
     # Create systemd service

renovate.json

@@ -229,6 +229,30 @@
       "matchStrings": ["K8S_VERSION:-(?<currentValue>v[0-9.]+)"],
       "depNameTemplate": "kubernetes/kubernetes",
       "datasourceTemplate": "github-releases"
+    },
+    {
+      "description": "Request Python versie in ansible installer",
+      "customType": "regex",
+      "managerFilePatterns": ["/^ansible/ansible_installer\\.sh$/"],
+      "matchStrings": ["REQ_PYTHON_VERSION=\"(?<currentValue>[0-9.]+)\""] ,
+      "depNameTemplate": "python",
+      "datasourceTemplate": "py"
+    },
+    {
+      "description": "Build Python versie in ansible installer",
+      "customType": "regex",
+      "managerFilePatterns": ["/^ansible/ansible_installer\\.sh$/"],
+      "matchStrings": ["BUILD_PYTHON_VERSION=\"(?<currentValue>[0-9.]+)\""] ,
+      "depNameTemplate": "python",
+      "datasourceTemplate": "py"
+    },
+    {
+      "description": "vagrant-vmware-utility in Windows installer",
+      "customType": "regex",
+      "managerFilePatterns": ["/^windows/Install-VagrantVMware\\.ps1$/"],
+      "matchStrings": ["vagrant-vmware-utility/(?<currentValue>[0-9.]+)/"],
+      "depNameTemplate": "hashicorp/vagrant-vmware-utility",
+      "datasourceTemplate": "github-releases"
     }
   ],
   "vulnerabilityAlerts": {