APT Repository Setup

The GetPageSpeed Extras APT repository hosts nginx-module-* packages for supported Debian and Ubuntu releases.

Free 30-day trial

Important

Install standard NGINX and eligible modules with apt-get install without an account or subscription. Repository setup and apt-get update are public too.

Modules with license enforcement have a 30-day grace period, starting at the server's first anonymous license check-in. After the grace period, supported modules keep serving pages but add a small GetPageSpeed notice to HTML responses. An active GetPageSpeed Repository subscription covering the server's public IP removes the notice.

Pro modules and NGINX-MOD require Pro or higher from the start. EDGE and Plesk packages retain their separate plan requirements. The same free-install trial applies to standard RPM packages; see what installs freely.

Quick install (recommended)

A single .deb lays down the keyring, the deb822 sources file with all three channels, the nginx APT pin, and a getpagespeed-extras-channel helper to switch between them. Inspect it before installing if you prefer.

curl -fsSL https://extras.getpagespeed.com/release-latest.deb \
  -o /tmp/getpagespeed-extras-release.deb
sudo apt-get install -y /tmp/getpagespeed-extras-release.deb

The package writes /etc/apt/sources.list.d/getpagespeed-extras.sources with three deb822 stanzas: stable (Enabled: yes), <codename>-mainline (Enabled: no), and <codename>-nginx-mod (Enabled: no). Stable is always on; flip the other two with the helper:

sudo getpagespeed-extras-channel stable      # only stable
sudo getpagespeed-extras-channel mainline    # stable + mainline
sudo getpagespeed-extras-channel nginx-mod   # stable + nginx-mod (+ APT pin)

Pick the channel you want, then update and install:

sudo apt-get update
sudo apt-get install nginx-module-brotli

The update step downloads public repository metadata. The example installs nginx-module-brotli without a subscription so you can try it immediately. See the trial and plan requirements above before choosing other modules or switching to NGINX-MOD.

Tip

getpagespeed-extras-channel nginx-mod also installs the recommended APT pin at /etc/apt/preferences.d/getpagespeed-nginx.pref. If you run stable or mainline and have another nginx source on the system (e.g. the ondrej PPA or nginx.org), see the Pin GetPageSpeed nginx packages section below.

Channel reference

Channel	Suites enabled	When to use
stable	<codename>	Production-grade NGINX stable + dynamic modules.
mainline	<codename> + <codename>-mainline	Latest NGINX mainline (and matching modules).
nginx-mod	<codename> + <codename>-nginx-mod	GetPageSpeed-patched stable nginx (upstream_check, upstream_api, extended limit_req_rate units).

nginx-mod is ABI-compatible with the stable nginx package, so any nginx-module-* package from the matching stable suite loads against it without rebuild. Installing nginx-mod swaps out any existing nginx package (it declares Conflicts: nginx). Supported codenames at launch: jammy, noble, resolute, bookworm.

GetPageSpeed EDGE

EDGE is a separate, closed Ultra product that coexists with nginx. Its package bytes require authenticated repository access, and the installed server also requires a valid Ultra token at /etc/edge/license.jwt.

After installing the repository keyring with the quick-install package above, enable the matching EDGE suite and install:

distro=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
codename=$(lsb_release -cs)
echo "deb [signed-by=/etc/apt/keyrings/getpagespeed.gpg] https://extras.getpagespeed.com/${distro} ${codename}-edge main" \
  | sudo tee /etc/apt/sources.list.d/getpagespeed-edge.list
sudo apt-get update
sudo apt-get install edge

EDGE DEB packages are available for Ubuntu jammy, noble and resolute, and Debian bookworm, on amd64 and arm64.

Migrating from other nginx repositories

If you already have nginx installed from the ondrej PPA, nginx.org, or stock Debian/Ubuntu packages:

1. Run the Quick install above. Pick the channel you want (mainline for the latest, nginx-mod for the patched stable, stable for plain stable).
2. The release package (11-78 and later) installs the APT pin for every channel, so GetPageSpeed nginx wins over the other source. See Pin GetPageSpeed nginx packages.

3. Update and replace nginx in one command:

   sudo apt-get update
   sudo apt-get install nginx nginx-module-geoip2
   

   APT will automatically replace conflicting packages (nginx-core, nginx-common, nginx-full, nginx-extras, nginx-light) with GetPageSpeed's transitional packages that depend on the unified nginx package.

4. Verify the active source:

   apt-cache policy nginx
   

   The output should show extras.getpagespeed.com with priority 1001.

---

Manual setup (advanced)

If you'd rather configure the keyring and source list yourself — for example to inspect every step, drop a custom-shaped source file, or avoid running a third-party .deb — follow the manual flow below. It produces the same end state, minus the getpagespeed-extras-channel helper.

Install the APT keyring

Download the repository keyring and place it under /etc/apt/keyrings:

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://extras.getpagespeed.com/deb-archive-keyring.gpg \
  | sudo tee /etc/apt/keyrings/getpagespeed.gpg >/dev/null

Add the APT source

You can either use the interactive helper below or copy one of the static examples.

Interactive generator

Select your distribution, codename, and NGINX branch to generate both the sources.list entry and a ready-to-run shell command:

Distribution Debian Ubuntu Codename NGINX branch stable mainline nginx-mod (stable + GetPageSpeed patches)

sources.list contents:

Shell command to create file:

Alternative: auto-detect distro and codename

If you prefer a single universal command that works on any supported Debian or Ubuntu system, you can use lsb_release to detect the distribution and codename automatically.

For the stable branch:

distro=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
codename=$(lsb_release -cs)
echo "deb [signed-by=/etc/apt/keyrings/getpagespeed.gpg] https://extras.getpagespeed.com/${distro} ${codename} main" \
  | sudo tee /etc/apt/sources.list.d/getpagespeed-extras.list

For the mainline branch:

echo "deb [signed-by=/etc/apt/keyrings/getpagespeed.gpg] https://extras.getpagespeed.com/${distro} ${codename}-mainline main" \
  | sudo tee -a /etc/apt/sources.list.d/getpagespeed-extras.list

For the nginx-mod branch, enable both the nginx-mod suite and the matching stable suite so dynamic nginx-module-* packages remain installable alongside the patched nginx:

sudo tee /etc/apt/sources.list.d/getpagespeed-extras.list <<EOF
deb [signed-by=/etc/apt/keyrings/getpagespeed.gpg] https://extras.getpagespeed.com/${distro} ${codename}-nginx-mod main
deb [signed-by=/etc/apt/keyrings/getpagespeed.gpg] https://extras.getpagespeed.com/${distro} ${codename} main
EOF

Pin GetPageSpeed nginx packages

The release package (11-78 and later) installs this file for you. With the manual setup, or if you have (or may later add) another nginx source such as the ondrej/nginx PPA or nginx.org packages, create it yourself so that GetPageSpeed packages always take priority:

sudo tee /etc/apt/preferences.d/getpagespeed-nginx.pref > /dev/null <<'EOF'
Package: nginx nginx-mod nginx-common nginx-core nginx-full nginx-extras nginx-light nginx-module-* libnginx-mod-*
Pin: origin extras.getpagespeed.com
Pin-Priority: 1001
EOF

APT gives every repository priority 500 by default; between equal priorities the higher version wins. Priority 1001 makes APT prefer these packages even if it means downgrading or replacing versions from other repositories. That matters because GetPageSpeed modules depend on the exact ABI of GetPageSpeed's nginx (nginx-r<version>). The pin covers nginx packages only: every other package from this repository stays at 500 and competes with your distribution by version, and a package held with apt-mark hold stays held.

Tip

This step is required for the manual setup whenever any other nginx repository is configured on the system. Check with apt-cache policy nginx. Deleting the file opts out; package upgrades do not recreate it, while getpagespeed-extras-channel does.

After adding the source and pin, run sudo apt-get update, then sudo apt-get install nginx-module-<name>.

Automatic updates

unattended-upgrades installs updates only from your distribution's own archives by default. It refreshes the GetPageSpeed index every day, yet leaves nginx and its modules at the version you first installed, security releases included. To let it install GetPageSpeed updates as well, add a drop-in file:

sudo tee /etc/apt/apt.conf.d/52unattended-upgrades-getpagespeed > /dev/null <<'EOF'
Unattended-Upgrade::Origins-Pattern {
    "origin=GetPageSpeed";
};
EOF

The pattern matches every GetPageSpeed channel: stable, mainline, NGINX-MOD and EDGE. nginx and its modules upgrade together in one transaction, and the package upgrades the running nginx binary in place, falling back to a restart. Confirm that the origin is allowed and see what the next run would upgrade:

sudo unattended-upgrade --dry-run --debug 2>&1 | grep -E 'Allowed origins|will be upgraded'

If you update by hand instead, use sudo apt update && sudo apt upgrade. Avoid apt-get upgrade: it never installs new dependencies, so it holds nginx back whenever a release adds one.

Inspect the release package

The release package is small and readable. List every file and read its maintainer scripts before installing:

curl -fsSLO https://extras.getpagespeed.com/release-latest.deb
dpkg-deb --info release-latest.deb       # metadata and dependencies
dpkg-deb --contents release-latest.deb   # every file it installs
dpkg-deb --control release-latest.deb ctl
cat ctl/postinst ctl/postrm              # maintainer scripts

The sources file trusts the keyring through Signed-By: for this repository only, never system-wide. The install hook in /etc/apt/apt.conf.d/99-getpagespeed-extras.conf runs before any download: when a transaction includes packages from this repository, it sends their names to www.getpagespeed.com and stops with a subscribe link if the server is not covered. Compare the keyring against the full fingerprints on the GetPageSpeed signing keys page:

gpg --show-keys --with-fingerprint /etc/apt/keyrings/deb-archive-keyring.gpg