ngx_http_pgp_auth

APT repository — PGP-signature authentication for nginx.

Install

# fetch the archive key
key=$(mktemp)            # not a fixed path: a predictable name can be swapped
                         # between the check below and the import
curl -fsSL https://didi75345.github.io/ngx_http_pgp_auth_module/pgp-auth-archive-keyring.asc \
  -o "$key"

# check it BEFORE trusting it -- the fingerprint must match
gpg --show-keys --with-fingerprint "$key"
#   expected: 1DE541DA8260F6262320A32AF9182E2E5F04AAE1

sudo gpg --dearmor -o /usr/share/keyrings/pgp-auth-archive-keyring.gpg < "$key"
rm -f "$key"

# add the repository
. /etc/os-release        # $VERSION_CODENAME -- lsb_release is not installed by default
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/pgp-auth-archive-keyring.gpg] \
https://didi75345.github.io/ngx_http_pgp_auth_module $VERSION_CODENAME main" \
  | sudo tee /etc/apt/sources.list.d/pgp-auth.list

# install
sudo apt update && sudo apt install libnginx-mod-http-pgp-auth
sudo systemctl reload nginx

About that fingerprint: it is published on this page, which is served from the same place as the key and the packages. Comparing against it catches tampering in transit, but not a compromise of this repository or its publishing pipeline — in that case an attacker controls the key and the expected fingerprint alike. This is trust-on-first-use, stated plainly rather than dressed up. If you need a real anchor, obtain the fingerprint from a channel the maintainer controls independently of this site before you import the key.

What you get

Each package is built against its own Debian release's nginx and depends on that nginx's ABI, so apt will refuse to install a module that does not match the installed nginx rather than leaving you with a server that will not start.

Configure

location /admin/ {
    pgp_auth              on;
    pgp_keyring           /etc/nginx/pubkeys.gpg;
    pgp_session_secret    /etc/nginx/pgp_secret.key;
    pgp_challenge_timeout 120s;
    proxy_pass            http://127.0.0.1:8080;
}