unmask

docs

JA4 acquisition, LB / CDN setup, supported distros, FAQ.

Verified (release-gate matrix)

Every release runs install → nginx -t pass → plugin load → admin healthz=200 → challenge served (http=403) on each distro below:

distropackagenginx (tested version)status
AlmaLinux 10 / Rocky 10 / RHEL 10rpm1.26.3verified
AlmaLinux 9 / Rocky 9 / RHEL 9rpm1.20.1verified
AlmaLinux 8 / Rocky 8 / RHEL 8rpm1.14.1verified
CentOS 7 / RHEL 7 (EOL 2024-06)rpm1.20.1 (EPEL)verified
CentOS 6 / RHEL 6 (EOL 2020-11)rpm1.10.3 (EPEL)verified
Debian 13deb1.26.3verified
Debian 12deb1.22.1verified
Ubuntu 26.04deb1.28.3verified
Ubuntu 24.04deb1.24.0verified
Ubuntu 22.04deb1.18.0verified
Alpine 3.xapk1.26.3verified

Same package format (install worth trying)

Derivatives that accept the same rpm / deb / apk packages will often install, but they are not in our CI, so the outcome isn't guaranteed. Reports either way are welcome on the issue tracker:

distroformatnotes
openSUSE Leap / TumbleweedrpmSame package lineage. AppArmor (not SELinux) — confinement may need extra tuning.
FedorarpmRHEL lineage. SELinux postinstall (setsebool automation) applies.
Linux MintdebUbuntu / Debian derivative.
Pop!_OSdebUbuntu derivative.
DevuandebDebian derivative without systemd. Ships sysvinit / openrc init scripts.
Raspbian / Raspberry Pi OSdeb (arm64)Works on a 64-bit OS via the arm64 packages (the native plugin ships arm64 too).

Not currently supported

Distros below are out of scope for now — install attempts won't work:

environmentreason
Arch Linuxpacman .pkg.tar.zst. No AUR package yet (contributors welcome).
Gentooportage ebuild. Same — no recipe yet.
NixOSnix derivation. flake / nixpkgs entry is a future candidate.
FreeBSD / OpenBSDpkg(8). The nginx ABI differs from Linux glibc; needs a separate build.
macOSNot a production server target (docker run with a supported Linux image works for local dev).
Windows / WSLnginx for Windows is ABI-incompatible. WSL distros work using the matching Linux instructions above.

Architectures

unmask supports both x86_64 (amd64) and aarch64 (arm64). Every distro package (main / nginx plugin / web integration) is built for both, and verified on real Ampere arm64 hardware (native + forward-auth + JA4 extraction).