This repository is the source code for NGINX, a production-grade web server, reverse proxy, load balancer, API gateway, and mail proxy. The codebase is written entirely in C and is a definitive example of high-performance systems architecture. It employs a modular, event-driven, multi-process (master/worker) model. The core infrastructure is built around a set of highly optimized, self-contained data structures and utilities: a slab allocator for shared memory, a memory pool for request-scoped allocation, a red-black tree for timers and caches, a radix tree for IP routing, a hash table with wildcard support for server name matching, and an incremental JSON parser. The build system (auto/) is a sophisticated set of shell scripts that handle platform detection, dependency configuration, and module compilation. The code supports HTTP/1.x, HTTP/2, HTTP/3 (QUIC), TCP/UDP proxying (Stream module), and mail protocols (POP3, IMAP, SMTP). It is actively maintained, with a strong focus on performance, stability, and security. The code is exceptionally clean and well-structured for a project of its age and complexity, though it contains some platform-specific #ifdef sprawl and duplication between HTTP and Stream modules (e.g., upstream least_time, map).

The NGINX Prometheus Exporter is a production-grade Go service that bridges NGINX and NGINX Plus metrics into Prometheus. In operation, Prometheus scrapes the exporter's HTTP endpoint (default :9113/metrics) and on each scrape the exporter fetches live metrics from either the NGINX stub_status page or the NGINX Plus REST API, converts them into typed Prometheus metrics (gauge/counter), and serves them alongside an nginx_up/nginxplus_up health gauge. The binary supports multiple concurrent scrape targets, TLS client auth against NGINX, unix domain sockets, PROXY protocol v2 outbound connections, and the full exporter-toolkit web configuration surface (TLS termination, basic auth, systemd socket activation). Architecturally it is a compact, idiomatic Go application with three layers: the main package owns CLI flags (kingpin), TLS setup, transport construction, and HTTP server lifecycle; the client package is a minimal self-contained stub_status HTTP client; the collector package implements prometheus.Collector in two variants — NginxCollector for OSS (7 metrics) and NginxPlusCollector for Plus (roughly 300 metrics spanning server zones, upstreams, stream zones, zone sync, resolvers, limit zones, cache, workers, and license state). The Plus collector is the dominant subsystem; its notable design feature is a LabelUpdater interface backed by RWMutex-protected maps that allows an external system (NGINX Ingress Controller) to dynamically inject additional label names and values into upstream/server-zone/cache metrics between scrapes. The release and quality engineering around the code is exceptional: GoReleaser multi-arch builds (10 OSes, 12 architectures), cosign-signed artifacts, SBOM/provenance attestations, multi-registry Docker publishing (DockerHub, GHCR, ECR, Quay), Homebrew/Scoop/Nix distribution, OpenSSF Scorecards, CodeQL, anchore image scanning, and a 60-linter golangci-lint configuration. A retract directive in go.mod cleanly handles a broken v1.5.2 release, indicating disciplined release management. Dependencies are current (Go 1.25, prometheus client_golang v1.24, exporter-toolkit v0.17). The main weakness is that the Plus collector is a single ~3000-line monolith with heavy repetition in metric emission and only minimal unit-test coverage for its most complex paths.