diff --git a/.github/workflows/ingress-base.yaml b/.github/workflows/ingress-base.yaml
new file mode 100644
index 0000000..8ed5d86
--- /dev/null
+++ b/.github/workflows/ingress-base.yaml
@@ -0,0 +1,62 @@
+name: ingress-base
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [ ingress-base ]
+  workflow_dispatch:
+
+env:
+  REPO: kubernetes/ingress-nginx
+  Version: "1.21" # ingress build script 
+  PROJECT: ingress-nginx
+  BRANCH: controller-v1.9.6 # should compatibe with env.Version
+  REGISTRY_NAME: "docker.io"
+  REGISTRY_USER: "${{ secrets.DOCKER_HUB_USER }}"
+  REGISTRY_PASS: "${{ secrets.DOCKER_HUB_PASSWORD }}"
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-22.04 #[self-hosted, linux, x64]
+    steps:
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+
+    - name: Check out repo code
+      uses: actions/checkout@v4
+
+    - name: Check out build code
+      uses: actions/checkout@v4
+      with:
+        repository: ${{ env.REPO }}
+        ref: ${{ env.BRANCH }} 
+        path: ${{ env.PROJECT }}
+
+    - name: Login to Registry
+      uses: docker/login-action@v2
+      with:
+        registry: ${{ env.REGISTRY_NAME }}
+        username: ${{ env.REGISTRY_USER }}
+        password: ${{ env.REGISTRY_PASS }}
+
+    - name: Image Build And Push
+      shell: bash
+      run: |
+        set -ex
+        # 覆盖默认build.sh, 支持 sm 密码 ssl 库
+        cp -f ingress/build-${{ env.Version }}.sh ${{ env.PROJECT }}/images/nginx/rootfs/build.sh
+
+        # 删除 openssl 相关
+        sed -i '/openssl/d' ${{ env.PROJECT }}/images/nginx/rootfs/Dockerfile
+
+        # build 
+        cd ${{ env.PROJECT }}/images/nginx/rootfs
+        docker buildx build \
+          --no-cache \
+          --platform linux/amd64 \
+          --output "type=image,push=true" \
+          --tag yylt/nginx:latest \
+          --tag yylt/nginx:${{ env.Version }} \
+          --file ./Dockerfile ./
diff --git a/.github/workflows/nginx-base.yaml b/.github/workflows/nginx-base.yaml
deleted file mode 100644
index b7606b1..0000000
--- a/.github/workflows/nginx-base.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-name: nginx-base
-permissions:
-  contents: read
-
-on:
-  push:
-    branches: [ nginx-base ]
-
-env:
-  GO111MODULE: on 
-  PROJECT: ingress-nginx
-  BRANCH: main
-
-jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-    - name: Get current date
-      id: date
-      run: echo "::set-output name=date::$(date +'%Y%m%d%H%M')"
-
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v1
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v1
-
-    - name: Check out repo code
-      uses: actions/checkout@v4
-
-    - name: Check out build code
-      uses: actions/checkout@v4
-      with:
-        repository: kubernetes/${{ env.PROJECT }}
-        ref: ${{ env.BRANCH }}
-        path: ${{ env.PROJECT }}
-    - name: Cache Docker layers
-      uses: actions/cache@v2
-      id: cache
-      with:
-        path: /tmp/.buildx-cache
-        key: ${{ runner.os }}-buildx-${{ github.sha }}
-        restore-keys: |
-          ${{ runner.os }}-buildx-
-
-    - name: Login to DockerHub
-      uses: docker/login-action@v1
-      with:
-        username: ${{ secrets.DOCKER_HUB_USER }}
-        password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-
-    - name: Docker Buildx (push)
-      run: |
-        cd ${{ env.PROJECT }}/images/nginx/rootfs/
-        docker buildx build \
-          --cache-from "type=local,src=/tmp/.buildx-cache" \
-          --platform linux/amd64,linux/arm64 \
-          --output "type=image,push=true" \
-          --tag yylt/nginx-base:${{ steps.date.outputs.date }} \
-          --file ./Dockerfile ./
-
diff --git a/examples/sts.yaml b/examples/sts.yaml
new file mode 100644
index 0000000..937ba4b
--- /dev/null
+++ b/examples/sts.yaml
@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: test
+spec:
+  selector:
+    matchLabels:
+      app: test
+  template:
+    metadata:
+      labels:
+        app: test
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: node-1
+      tolerations:
+        - effect: NoExecute
+          key: node.kubernetes.io/not-ready
+          operator: Exists
+          tolerationSeconds: 2
+        - effect: NoExecute
+          key: node.kubernetes.io/unreachable
+          operator: Exists
+          tolerationSeconds: 2 
+      containers:
+      - image: nginx:latest
+        imagePullPolicy: IfNotPresent
+        name: test
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+    - port: 80
+  selector:
+    app: test
+---
diff --git a/ingress/build-1.21.sh b/ingress/build-1.21.sh
new file mode 100644
index 0000000..866dc92
--- /dev/null
+++ b/ingress/build-1.21.sh
@@ -0,0 +1,766 @@
+#!/bin/bash
+
+# Copyright 2015 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# FROM https://github.com/kubernetes/ingress-nginx/blob/controller-v1.9.6/images/nginx/rootfs/build.sh 
+# ssl support SM, more info: https://github.com/guanzhi/GmSSL
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+export NGINX_VERSION=1.21.6
+
+# Check for recent changes: https://github.com/guanzhi/GmSSL/compare/v3.3.1...master
+export GMSSL_VERSION=34fa519dc0f94a9a3995d9daf09c84cdac37abd8
+
+# Check for recent changes: https://github.com/GmSSL/OpenSSL-Compatibility-Layer/compare/v0.8.1...master
+export GMSSL_LAYER_VERSION=4c9b076a980652df1e0cc2eef2e430f07f239588
+
+# Check for recent changes: https://github.com/vision5/ngx_devel_kit/compare/v0.3.2...master
+export NDK_VERSION=0.3.2
+
+# Check for recent changes: https://github.com/openresty/set-misc-nginx-module/compare/v0.33...master
+export SETMISC_VERSION=0.33
+
+# Check for recent changes: https://github.com/openresty/headers-more-nginx-module/compare/v0.34...master
+export MORE_HEADERS_VERSION=0.34
+
+# Check for recent changes: https://github.com/atomx/nginx-http-auth-digest/compare/v1.0.0...atomx:master
+export NGINX_DIGEST_AUTH=1.0.0
+
+# Check for recent changes: https://github.com/yaoweibin/ngx_http_substitutions_filter_module/compare/v0.6.4...master
+export NGINX_SUBSTITUTIONS=b8a71eacc7f986ba091282ab8b1bbbc6ae1807e0
+
+# Check for recent changes: https://github.com/opentracing-contrib/nginx-opentracing/compare/v0.19.0...master
+export NGINX_OPENTRACING_VERSION=0.19.0
+
+#Check for recent changes: https://github.com/opentracing/opentracing-cpp/compare/v1.6.0...master
+export OPENTRACING_CPP_VERSION=f86b33f3d9e7322b1298ba62d5ffa7a9519c4c41
+
+# Check for recent changes: https://github.com/rnburn/zipkin-cpp-opentracing/compare/v0.5.2...master
+export ZIPKIN_CPP_VERSION=f69593138ff84ca2f6bc115992e18ca3d35f344a
+
+# Check for recent changes: https://github.com/jbeder/yaml-cpp/compare/yaml-cpp-0.7.0...master
+export YAML_CPP_VERSION=yaml-cpp-0.7.0
+
+# Check for recent changes: https://github.com/jaegertracing/jaeger-client-cpp/compare/v0.7.0...master
+export JAEGER_VERSION=0.7.0
+
+# Check for recent changes: https://github.com/msgpack/msgpack-c/compare/cpp-3.3.0...master
+export MSGPACK_VERSION=3.3.0
+
+# Check for recent changes: https://github.com/DataDog/dd-opentracing-cpp/compare/v1.3.7...master
+export DATADOG_CPP_VERSION=1.3.7
+
+# Check for recent changes: https://github.com/SpiderLabs/ModSecurity-nginx/compare/v1.0.3...master
+export MODSECURITY_VERSION=1.0.3
+
+# Check for recent changes: https://github.com/SpiderLabs/ModSecurity/compare/v3.0.11...v3/master
+export MODSECURITY_LIB_VERSION=bbde9381cbccb49ea73f6194b08b478adc53f3bc
+
+# Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v3.3.2...v3.3/master
+export OWASP_MODSECURITY_CRS_VERSION=v3.3.5
+
+# Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.25...master
+export LUA_NGX_VERSION=0.10.25
+
+# Check for recent changes: https://github.com/openresty/stream-lua-nginx-module/compare/v0.0.13...master
+export LUA_STREAM_NGX_VERSION=0.0.13
+
+# Check for recent changes: https://github.com/openresty/lua-upstream-nginx-module/compare/8aa93ead98ba2060d4efd594ae33a35d153589bf...master
+export LUA_UPSTREAM_VERSION=8aa93ead98ba2060d4efd594ae33a35d153589bf
+
+# Check for recent changes: https://github.com/openresty/lua-cjson/compare/2.1.0.11...openresty:master
+export LUA_CJSON_VERSION=2.1.0.11
+
+# Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/3.4...master
+export GEOIP2_VERSION=a607a41a8115fecfc05b5c283c81532a3d605425
+
+# Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20230410...v2.1-agentzh
+export LUAJIT_VERSION=2.1-20230410
+
+# Check for recent changes: https://github.com/openresty/lua-resty-balancer/compare/v0.04...master
+export LUA_RESTY_BALANCER=0.04
+
+# Check for recent changes: https://github.com/openresty/lua-resty-lrucache/compare/v0.13...master
+export LUA_RESTY_CACHE=0.13
+
+# Check for recent changes: https://github.com/openresty/lua-resty-core/compare/v0.1.27...master
+export LUA_RESTY_CORE=0.1.27
+
+# Check for recent changes: https://github.com/utix/lua-resty-cookie/compare/9533f47...master
+export LUA_RESTY_COOKIE_VERSION=9533f479371663107b515590fc9daf00d61ebf11
+
+# Check for recent changes: https://github.com/openresty/lua-resty-dns/compare/v0.22...master
+export LUA_RESTY_DNS=0.22
+
+# Check for recent changes: https://github.com/ledgetech/lua-resty-http/compare/v0.16.1...master
+export LUA_RESTY_HTTP=0ce55d6d15da140ecc5966fa848204c6fd9074e8
+
+# Check for recent changes: https://github.com/openresty/lua-resty-lock/compare/v0.09...master
+export LUA_RESTY_LOCK=0.09
+
+# Check for recent changes: https://github.com/openresty/lua-resty-upload/compare/v0.11...master
+export LUA_RESTY_UPLOAD_VERSION=0.11
+
+# Check for recent changes: https://github.com/openresty/lua-resty-string/compare/v0.15...master
+export LUA_RESTY_STRING_VERSION=0.15
+
+# Check for recent changes: https://github.com/openresty/lua-resty-memcached/compare/v0.17...master
+export LUA_RESTY_MEMCACHED_VERSION=0.17
+
+# Check for recent changes: https://github.com/openresty/lua-resty-redis/compare/v0.30...master
+export LUA_RESTY_REDIS_VERSION=0.30
+
+# Check for recent changes: https://github.com/api7/lua-resty-ipmatcher/compare/v0.6.1...master
+export LUA_RESTY_IPMATCHER_VERSION=0.6.1
+
+# Check for recent changes: https://github.com/ElvinEfendi/lua-resty-global-throttle/compare/v0.2.0...main
+export LUA_RESTY_GLOBAL_THROTTLE_VERSION=0.2.0
+
+# Check for recent changes:  https://github.com/microsoft/mimalloc/compare/v1.7.6...master
+export MIMALOC_VERSION=1.7.6
+
+export BUILD_PATH=/tmp/build
+
+ARCH=$(uname -m)
+
+if [[ ${ARCH} == "s390x" ]]; then
+  export LUAJIT_VERSION=9d5750d28478abfdcaefdfdc408f87752a21e431
+  export LUA_RESTY_CORE=0.1.17
+  export LUA_NGX_VERSION=0.10.15
+  export LUA_STREAM_NGX_VERSION=0.0.7
+fi
+
+get_src()
+{
+  hash="$1"
+  url="$2"
+  f=$(basename "$url")
+
+  echo "Downloading $url"
+
+  curl -sSL "$url" -o "$f"
+  echo "$hash  $f" | sha256sum -c - || exit 10
+  tar xzf "$f"
+  rm -rf "$f"
+}
+
+# install required packages to build
+apk add \
+  bash \
+  gcc \
+  clang \
+  libc-dev \
+  make \
+  automake \
+  pcre-dev \
+  zlib-dev \
+  linux-headers \
+  libxslt-dev \
+  gd-dev \
+  perl-dev \
+  libedit-dev \
+  mercurial \
+  alpine-sdk \
+  findutils \
+  curl \
+  ca-certificates \
+  patch \
+  libaio-dev \
+  cmake \
+  util-linux \
+  lmdb-tools \
+  wget \
+  curl-dev \
+  libprotobuf \
+  git g++ pkgconf flex bison doxygen yajl-dev lmdb-dev libtool autoconf libxml2 libxml2-dev \
+  python3 \
+  libmaxminddb-dev \
+  bc \
+  unzip \
+  dos2unix \
+  yaml-cpp \
+  coreutils
+
+mkdir -p /etc/nginx
+
+mkdir --verbose -p "$BUILD_PATH"
+cd "$BUILD_PATH"
+
+# download, verify and extract the source files
+get_src c34cc5536f1c1642cc0a1c7d1c7e077a5fe03be8f80c0794de63e2002f477990 \
+         https://github.com/guanzhi/GmSSL/archive/$GMSSL_VERSION.tar.gz
+
+get_src 271bf6d5c7e070534ae0f464b3d807c64bc22333ec1c7db44e084d22bb581093 \
+         https://github.com/GmSSL/OpenSSL-Compatibility-Layer/archive/$GMSSL_LAYER_VERSION.tar.gz
+
+get_src 66dc7081488811e9f925719e34d1b4504c2801c81dee2920e5452a86b11405ae \
+        "https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz"
+
+get_src aa961eafb8317e0eb8da37eb6e2c9ff42267edd18b56947384e719b85188f58b \
+        "https://github.com/vision5/ngx_devel_kit/archive/v$NDK_VERSION.tar.gz"
+
+get_src cd5e2cc834bcfa30149e7511f2b5a2183baf0b70dc091af717a89a64e44a2985 \
+        "https://github.com/openresty/set-misc-nginx-module/archive/v$SETMISC_VERSION.tar.gz"
+
+get_src 0c0d2ced2ce895b3f45eb2b230cd90508ab2a773299f153de14a43e44c1209b3 \
+        "https://github.com/openresty/headers-more-nginx-module/archive/v$MORE_HEADERS_VERSION.tar.gz"
+
+get_src f09851e6309560a8ff3e901548405066c83f1f6ff88aa7171e0763bd9514762b \
+        "https://github.com/atomx/nginx-http-auth-digest/archive/v$NGINX_DIGEST_AUTH.tar.gz"
+
+get_src a98b48947359166326d58700ccdc27256d2648218072da138ab6b47de47fbd8f \
+        "https://github.com/yaoweibin/ngx_http_substitutions_filter_module/archive/$NGINX_SUBSTITUTIONS.tar.gz"
+
+get_src 6f97776ebdf019b105a755c7736b70bdbd7e575c7f0d39db5fe127873c7abf17 \
+        "https://github.com/opentracing-contrib/nginx-opentracing/archive/v$NGINX_OPENTRACING_VERSION.tar.gz"
+
+get_src cbe625cba85291712253db5bc3870d60c709acfad9a8af5a302673d3d201e3ea \
+        "https://github.com/opentracing/opentracing-cpp/archive/$OPENTRACING_CPP_VERSION.tar.gz"
+
+get_src 71de3d0658935db7ccea20e006b35e58ddc7e4c18878b9523f2addc2371e9270 \
+        "https://github.com/rnburn/zipkin-cpp-opentracing/archive/$ZIPKIN_CPP_VERSION.tar.gz"
+
+get_src 32a42256616cc674dca24c8654397390adff15b888b77eb74e0687f023c8751b \
+        "https://github.com/SpiderLabs/ModSecurity-nginx/archive/v$MODSECURITY_VERSION.tar.gz"
+
+get_src 43e6a9fcb146ad871515f0d0873947e5d497a1c9c60c58cb102a97b47208b7c3 \
+        "https://github.com/jbeder/yaml-cpp/archive/$YAML_CPP_VERSION.tar.gz"
+
+get_src 3a3a03060bf5e3fef52c9a2de02e6035cb557f389453d8f3b0c1d3d570636994 \
+        "https://github.com/jaegertracing/jaeger-client-cpp/archive/v$JAEGER_VERSION.tar.gz"
+
+get_src 754c3ace499a63e45b77ef4bcab4ee602c2c414f58403bce826b76ffc2f77d0b \
+        "https://github.com/msgpack/msgpack-c/archive/cpp-$MSGPACK_VERSION.tar.gz"
+
+if [[ ${ARCH} == "s390x" ]]; then
+get_src 7d5f3439c8df56046d0564b5857fd8a30296ab1bd6df0f048aed7afb56a0a4c2 \
+        "https://github.com/openresty/lua-nginx-module/archive/v$LUA_NGX_VERSION.tar.gz"
+get_src 99c47c75c159795c9faf76bbb9fa58e5a50b75286c86565ffcec8514b1c74bf9 \
+        "https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz"
+else
+get_src bc764db42830aeaf74755754b900253c233ad57498debe7a441cee2c6f4b07c2 \
+        "https://github.com/openresty/lua-nginx-module/archive/v$LUA_NGX_VERSION.tar.gz"
+
+get_src 01b715754a8248cc7228e0c8f97f7488ae429d90208de0481394e35d24cef32f \
+        "https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz"
+fi
+
+get_src a92c9ee6682567605ece55d4eed5d1d54446ba6fba748cff0a2482aea5713d5f \
+        "https://github.com/openresty/lua-upstream-nginx-module/archive/$LUA_UPSTREAM_VERSION.tar.gz"
+
+if [[ ${ARCH} == "s390x" ]]; then
+get_src 266ed1abb70a9806d97cb958537a44b67db6afb33d3b32292a2d68a2acedea75 \
+        "https://github.com/openresty/luajit2/archive/$LUAJIT_VERSION.tar.gz"
+else
+get_src 77bbcbb24c3c78f51560017288f3118d995fe71240aa379f5818ff6b166712ff \
+        "https://github.com/openresty/luajit2/archive/v$LUAJIT_VERSION.tar.gz"
+fi
+
+get_src 8d39c6b23f941a2d11571daaccc04e69539a3fcbcc50a631837560d5861a7b96 \
+        "https://github.com/DataDog/dd-opentracing-cpp/archive/v$DATADOG_CPP_VERSION.tar.gz"
+
+get_src b6c9c09fd43eb34a71e706ad780b2ead26549a9a9f59280fe558f5b7b980b7c6 \
+        "https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz"
+
+get_src deb4ab1ffb9f3d962c4b4a2c4bdff692b86a209e3835ae71ebdf3b97189e40a9 \
+        "https://github.com/openresty/lua-resty-upload/archive/v$LUA_RESTY_UPLOAD_VERSION.tar.gz"
+
+get_src bdbf271003d95aa91cab0a92f24dca129e99b33f79c13ebfcdbbcbb558129491 \
+        "https://github.com/openresty/lua-resty-string/archive/v$LUA_RESTY_STRING_VERSION.tar.gz"
+
+get_src 16d72ed133f0c6df376a327386c3ef4e9406cf51003a700737c3805770ade7c5 \
+        "https://github.com/openresty/lua-resty-balancer/archive/v$LUA_RESTY_BALANCER.tar.gz"
+
+if [[ ${ARCH} == "s390x" ]]; then
+get_src 8f5f76d2689a3f6b0782f0a009c56a65e4c7a4382be86422c9b3549fe95b0dc4 \
+        "https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz"
+else
+get_src 39baab9e2b31cc48cecf896cea40ef6e80559054fd8a6e440cc804a858ea84d4 \
+        "https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz"
+fi
+
+get_src a77b9de160d81712f2f442e1de8b78a5a7ef0d08f13430ff619f79235db974d4 \
+        "https://github.com/openresty/lua-cjson/archive/$LUA_CJSON_VERSION.tar.gz"
+
+get_src a404c790553617424d743b82a9f01feccd0d2930b306b370c665ca3b7c09ccb6 \
+        "https://github.com/utix/lua-resty-cookie/archive/$LUA_RESTY_COOKIE_VERSION.tar.gz"
+
+get_src 573184006b98ccee2594b0d134fa4d05e5d2afd5141cbad315051ccf7e9b6403 \
+        "https://github.com/openresty/lua-resty-lrucache/archive/v$LUA_RESTY_CACHE.tar.gz"
+
+get_src b4ddcd47db347e9adf5c1e1491a6279a6ae2a3aff3155ef77ea0a65c998a69c1 \
+        "https://github.com/openresty/lua-resty-lock/archive/v$LUA_RESTY_LOCK.tar.gz"
+
+get_src 70e9a01eb32ccade0d5116a25bcffde0445b94ad35035ce06b94ccd260ad1bf0 \
+        "https://github.com/openresty/lua-resty-dns/archive/v$LUA_RESTY_DNS.tar.gz"
+
+get_src 9fcb6db95bc37b6fce77d3b3dc740d593f9d90dce0369b405eb04844d56ac43f \
+        "https://github.com/ledgetech/lua-resty-http/archive/$LUA_RESTY_HTTP.tar.gz"
+
+get_src 02733575c4aed15f6cab662378e4b071c0a4a4d07940c4ef19a7319e9be943d4 \
+        "https://github.com/openresty/lua-resty-memcached/archive/v$LUA_RESTY_MEMCACHED_VERSION.tar.gz"
+
+get_src c15aed1a01c88a3a6387d9af67a957dff670357f5fdb4ee182beb44635eef3f1 \
+        "https://github.com/openresty/lua-resty-redis/archive/v$LUA_RESTY_REDIS_VERSION.tar.gz"
+
+get_src efb767487ea3f6031577b9b224467ddbda2ad51a41c5867a47582d4ad85d609e \
+        "https://github.com/api7/lua-resty-ipmatcher/archive/v$LUA_RESTY_IPMATCHER_VERSION.tar.gz"
+
+get_src 0fb790e394510e73fdba1492e576aaec0b8ee9ef08e3e821ce253a07719cf7ea \
+        "https://github.com/ElvinEfendi/lua-resty-global-throttle/archive/v$LUA_RESTY_GLOBAL_THROTTLE_VERSION.tar.gz"
+
+get_src d74f86ada2329016068bc5a243268f1f555edd620b6a7d6ce89295e7d6cf18da \
+        "https://github.com/microsoft/mimalloc/archive/refs/tags/v${MIMALOC_VERSION}.tar.gz"
+
+# improve compilation times
+CORES=$(($(grep -c ^processor /proc/cpuinfo) - 1))
+
+export MAKEFLAGS=-j${CORES}
+export CTEST_BUILD_FLAGS=${MAKEFLAGS}
+export HUNTER_JOBS_NUMBER=${CORES}
+export HUNTER_USE_CACHE_SERVERS=true
+
+# Install luajit from openresty fork
+export LUAJIT_LIB=/usr/local/lib
+export LUA_LIB_DIR="$LUAJIT_LIB/lua"
+export LUAJIT_INC=/usr/local/include/luajit-2.1
+
+cd "$BUILD_PATH/luajit2-$LUAJIT_VERSION"
+make CCDEBUG=-g
+make install
+
+ln -s /usr/local/bin/luajit /usr/local/bin/lua
+ln -s "$LUAJIT_INC" /usr/local/include/lua
+
+cd "$BUILD_PATH"
+
+# Git tuning
+git config --global --add core.compression -1
+
+# build gmssl && gmssl_compatibility_layer
+cd "$BUILD_PATH/GmSSL-$GMSSL_VERSION"
+mkdir build && cd build
+cmake ..
+make && make test && make install
+
+cd "$BUILD_PATH/OpenSSL-Compatibility-Layer-$GMSSL_LAYER_VERSION"
+mkdir build && cd build
+cmake ..
+make &&  make install
+
+# build opentracing lib
+cd "$BUILD_PATH/opentracing-cpp-$OPENTRACING_CPP_VERSION"
+mkdir .build
+cd .build
+
+cmake -DCMAKE_BUILD_TYPE=Release \
+      -DBUILD_TESTING=OFF \
+      -DBUILD_SHARED_LIBS=OFF \
+      -DBUILD_MOCKTRACER=OFF \
+      -DBUILD_STATIC_LIBS=ON \
+      -DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
+      ..
+
+make
+make install
+
+# build yaml-cpp
+# TODO @timmysilv: remove this and jaeger sed calls once it is fixed in jaeger-client-cpp
+cd "$BUILD_PATH/yaml-cpp-$YAML_CPP_VERSION"
+mkdir .build
+cd .build
+
+cmake -DCMAKE_BUILD_TYPE=Release \
+      -DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
+      -DYAML_BUILD_SHARED_LIBS=ON \
+      -DYAML_CPP_BUILD_TESTS=OFF \
+      -DYAML_CPP_BUILD_TOOLS=OFF \
+      ..
+
+make
+make install
+
+# build jaeger lib
+cd "$BUILD_PATH/jaeger-client-cpp-$JAEGER_VERSION"
+sed -i 's/-Werror/-Wno-psabi/' CMakeLists.txt
+# use the above built yaml-cpp instead until a new version of jaeger-client-cpp fixes the yaml-cpp issue
+# tl;dr new hunter is needed for new yaml-cpp, but new hunter has a conflict with old Thrift and new Boost
+sed -i 's/hunter_add_package(yaml-cpp)/#hunter_add_package(yaml-cpp)/' CMakeLists.txt
+sed -i 's/yaml-cpp::yaml-cpp/yaml-cpp/' CMakeLists.txt
+
+cat <<EOF > export.map
+{
+    global:
+        OpenTracingMakeTracerFactory;
+    local: *;
+};
+EOF
+
+mkdir .build
+cd .build
+
+cmake -DCMAKE_BUILD_TYPE=Release \
+      -DBUILD_TESTING=OFF \
+      -DJAEGERTRACING_BUILD_EXAMPLES=OFF \
+      -DJAEGERTRACING_BUILD_CROSSDOCK=OFF \
+      -DJAEGERTRACING_COVERAGE=OFF \
+      -DJAEGERTRACING_PLUGIN=ON \
+      -DHUNTER_CONFIGURATION_TYPES=Release \
+      -DBUILD_SHARED_LIBS=OFF \
+      -DJAEGERTRACING_WITH_YAML_CPP=ON \
+      -DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
+      ..
+
+make
+make install
+
+export HUNTER_INSTALL_DIR=$(cat _3rdParty/Hunter/install-root-dir) \
+
+mv libjaegertracing_plugin.so /usr/local/lib/libjaegertracing_plugin.so
+
+
+# build zipkin lib
+cd "$BUILD_PATH/zipkin-cpp-opentracing-$ZIPKIN_CPP_VERSION"
+
+cat <<EOF > export.map
+{
+    global:
+        OpenTracingMakeTracerFactory;
+    local: *;
+};
+EOF
+
+mkdir .build
+cd .build
+
+cmake -DCMAKE_BUILD_TYPE=Release \
+      -DBUILD_SHARED_LIBS=OFF \
+      -DBUILD_PLUGIN=ON \
+      -DBUILD_TESTING=OFF \
+      -DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
+      ..
+
+make
+make install
+
+# build msgpack lib
+cd "$BUILD_PATH/msgpack-c-cpp-$MSGPACK_VERSION"
+
+mkdir .build
+cd .build
+cmake -DCMAKE_BUILD_TYPE=Release \
+      -DBUILD_SHARED_LIBS=OFF \
+      -DMSGPACK_BUILD_EXAMPLES=OFF \
+      -DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
+      ..
+
+make
+make install
+
+# build datadog lib
+cd "$BUILD_PATH/dd-opentracing-cpp-$DATADOG_CPP_VERSION"
+
+mkdir .build
+cd .build
+
+cmake -DCMAKE_BUILD_TYPE=Release \
+      -DBUILD_TESTING=OFF \
+      -DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
+      ..
+
+make
+make install
+
+# Get Brotli source and deps
+cd "$BUILD_PATH"
+git clone --depth=100 https://github.com/google/ngx_brotli.git
+cd ngx_brotli
+# https://github.com/google/ngx_brotli/issues/156
+git reset --hard 63ca02abdcf79c9e788d2eedcc388d2335902e52
+git submodule init
+git submodule update
+
+cd "$BUILD_PATH"
+git clone --depth=1 https://github.com/ssdeep-project/ssdeep
+cd ssdeep/
+
+./bootstrap
+./configure
+
+make
+make install
+
+# build modsecurity library
+cd "$BUILD_PATH"
+git clone -n https://github.com/SpiderLabs/ModSecurity
+cd ModSecurity/
+git checkout $MODSECURITY_LIB_VERSION
+git submodule init
+git submodule update
+
+sh build.sh
+
+# https://github.com/SpiderLabs/ModSecurity/issues/1909#issuecomment-465926762
+sed -i '115i LUA_CFLAGS="${LUA_CFLAGS} -DWITH_LUA_JIT_2_1"' build/lua.m4
+sed -i '117i AC_SUBST(LUA_CFLAGS)' build/lua.m4
+
+./configure \
+  --disable-doxygen-doc \
+  --disable-doxygen-html \
+  --disable-examples
+
+make
+make install
+
+mkdir -p /etc/nginx/modsecurity
+cp modsecurity.conf-recommended /etc/nginx/modsecurity/modsecurity.conf
+cp unicode.mapping /etc/nginx/modsecurity/unicode.mapping
+
+# Replace serial logging with concurrent
+sed -i 's|SecAuditLogType Serial|SecAuditLogType Concurrent|g' /etc/nginx/modsecurity/modsecurity.conf
+
+# Concurrent logging implies the log is stored in several files
+echo "SecAuditLogStorageDir /var/log/audit/" >> /etc/nginx/modsecurity/modsecurity.conf
+
+# Download owasp modsecurity crs
+cd /etc/nginx/
+
+git clone -b $OWASP_MODSECURITY_CRS_VERSION https://github.com/coreruleset/coreruleset
+mv coreruleset owasp-modsecurity-crs
+cd owasp-modsecurity-crs
+
+mv crs-setup.conf.example crs-setup.conf
+mv rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
+mv rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
+cd ..
+
+# OWASP CRS v3 rules
+echo "
+Include /etc/nginx/owasp-modsecurity-crs/crs-setup.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-912-DOS-PROTECTION.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-922-MULTIPART-ATTACK.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-950-DATA-LEAKAGES.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf
+Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
+" > /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf
+
+# build nginx
+cd "$BUILD_PATH/nginx-$NGINX_VERSION"
+
+# apply nginx patches
+for PATCH in `ls /patches`;do
+  echo "Patch: $PATCH"
+  if [[ "$PATCH" == *.txt ]]; then
+    patch -p0 < /patches/$PATCH
+  else
+    patch -p1 < /patches/$PATCH
+  fi
+done
+
+WITH_FLAGS="--with-debug \
+  --with-compat \
+  --with-pcre-jit \
+  --with-http_ssl_module \
+  --with-http_stub_status_module \
+  --with-http_realip_module \
+  --with-http_auth_request_module \
+  --with-http_addition_module \
+  --with-http_gzip_static_module \
+  --with-http_sub_module \
+  --with-http_v2_module \
+  --with-stream \
+  --with-stream_ssl_module \
+  --with-stream_realip_module \
+  --with-stream_ssl_preread_module \
+  --with-threads \
+  --with-http_secure_link_module \
+  --with-http_gunzip_module"
+
+# "Combining -flto with -g is currently experimental and expected to produce unexpected results."
+# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html
+CC_OPT="-g -O2 -fPIE -fstack-protector-strong \
+  -Wformat \
+  -Werror=format-security \
+  -Wno-deprecated-declarations \
+  -fno-strict-aliasing \
+  -D_FORTIFY_SOURCE=2 \
+  --param=ssp-buffer-size=4 \
+  -DTCP_FASTOPEN=23 \
+  -fPIC \
+  -I$HUNTER_INSTALL_DIR/include \
+  -Wno-cast-function-type"
+
+LD_OPT="-fPIE -fPIC -pie -Wl,-z,relro -Wl,-z,now -L$HUNTER_INSTALL_DIR/lib"
+
+if [[ ${ARCH} != "aarch64" ]]; then
+  WITH_FLAGS+=" --with-file-aio"
+fi
+
+if [[ ${ARCH} == "x86_64" ]]; then
+  CC_OPT+=' -m64 -mtune=generic'
+fi
+
+WITH_MODULES=" \
+  --add-module=$BUILD_PATH/ngx_devel_kit-$NDK_VERSION \
+  --add-module=$BUILD_PATH/set-misc-nginx-module-$SETMISC_VERSION \
+  --add-module=$BUILD_PATH/headers-more-nginx-module-$MORE_HEADERS_VERSION \
+  --add-module=$BUILD_PATH/ngx_http_substitutions_filter_module-$NGINX_SUBSTITUTIONS \
+  --add-module=$BUILD_PATH/lua-nginx-module-$LUA_NGX_VERSION \
+  --add-module=$BUILD_PATH/stream-lua-nginx-module-$LUA_STREAM_NGX_VERSION \
+  --add-module=$BUILD_PATH/lua-upstream-nginx-module-$LUA_UPSTREAM_VERSION \
+  --add-dynamic-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \
+  --add-dynamic-module=$BUILD_PATH/nginx-opentracing-$NGINX_OPENTRACING_VERSION/opentracing \
+  --add-dynamic-module=$BUILD_PATH/ModSecurity-nginx-$MODSECURITY_VERSION \
+  --add-dynamic-module=$BUILD_PATH/ngx_http_geoip2_module-${GEOIP2_VERSION} \
+  --add-dynamic-module=$BUILD_PATH/ngx_brotli"
+
+./configure \
+  --prefix=/usr/local/nginx \
+  --conf-path=/etc/nginx/nginx.conf \
+  --modules-path=/etc/nginx/modules \
+  --http-log-path=/var/log/nginx/access.log \
+  --error-log-path=/var/log/nginx/error.log \
+  --lock-path=/var/lock/nginx.lock \
+  --pid-path=/run/nginx.pid \
+  --http-client-body-temp-path=/var/lib/nginx/body \
+  --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
+  --http-proxy-temp-path=/var/lib/nginx/proxy \
+  --http-scgi-temp-path=/var/lib/nginx/scgi \
+  --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
+  ${WITH_FLAGS} \
+  --without-mail_pop3_module \
+  --without-mail_smtp_module \
+  --without-mail_imap_module \
+  --without-http_uwsgi_module \
+  --without-http_scgi_module \
+  --with-cc-opt="${CC_OPT}" \
+  --with-ld-opt="${LD_OPT}" \
+  --user=www-data \
+  --group=www-data \
+  ${WITH_MODULES}
+
+make
+make modules
+make install
+
+cd "$BUILD_PATH/lua-resty-core-$LUA_RESTY_CORE"
+make install
+
+cd "$BUILD_PATH/lua-resty-balancer-$LUA_RESTY_BALANCER"
+make all
+make install
+
+export LUA_INCLUDE_DIR=/usr/local/include/luajit-2.1
+ln -s $LUA_INCLUDE_DIR /usr/include/lua5.1
+
+cd "$BUILD_PATH/lua-cjson-$LUA_CJSON_VERSION"
+make all
+make install
+
+cd "$BUILD_PATH/lua-resty-cookie-$LUA_RESTY_COOKIE_VERSION"
+make all
+make install
+
+cd "$BUILD_PATH/lua-resty-lrucache-$LUA_RESTY_CACHE"
+make install
+
+cd "$BUILD_PATH/lua-resty-dns-$LUA_RESTY_DNS"
+make install
+
+cd "$BUILD_PATH/lua-resty-lock-$LUA_RESTY_LOCK"
+make install
+
+# required for OCSP verification
+cd "$BUILD_PATH/lua-resty-http-$LUA_RESTY_HTTP"
+make install
+
+cd "$BUILD_PATH/lua-resty-upload-$LUA_RESTY_UPLOAD_VERSION"
+make install
+
+cd "$BUILD_PATH/lua-resty-string-$LUA_RESTY_STRING_VERSION"
+make install
+
+cd "$BUILD_PATH/lua-resty-memcached-$LUA_RESTY_MEMCACHED_VERSION"
+make install
+
+cd "$BUILD_PATH/lua-resty-redis-$LUA_RESTY_REDIS_VERSION"
+make install
+
+cd "$BUILD_PATH/lua-resty-ipmatcher-$LUA_RESTY_IPMATCHER_VERSION"
+INST_LUADIR=/usr/local/lib/lua make install
+
+cd "$BUILD_PATH/lua-resty-global-throttle-$LUA_RESTY_GLOBAL_THROTTLE_VERSION"
+make install
+
+cd "$BUILD_PATH/mimalloc-$MIMALOC_VERSION"
+mkdir -p out/release
+cd out/release
+
+cmake ../..
+
+make
+make install
+
+# update image permissions
+writeDirs=( \
+  /etc/nginx \
+  /usr/local/nginx \
+  /opt/modsecurity/var/log \
+  /opt/modsecurity/var/upload \
+  /opt/modsecurity/var/audit \
+  /var/log/audit \
+  /var/log/nginx \
+);
+
+adduser -S -D -H -u 101 -h /usr/local/nginx -s /sbin/nologin -G www-data -g www-data www-data
+
+for dir in "${writeDirs[@]}"; do
+  mkdir -p ${dir};
+  chown -R www-data.www-data ${dir};
+done
+
+rm -rf /etc/nginx/owasp-modsecurity-crs/.git
+rm -rf /etc/nginx/owasp-modsecurity-crs/util/regression-tests
+
+# remove .a files
+find /usr/local -name "*.a" -print | xargs /bin/rm
\ No newline at end of file