Upgrade Nginx 1.18 → 1.25+ on Debian 11.11 – The No-BS, 3-Minute Guide

Fed up with Debian 11.11 shipping crusty Nginx 1.18? No HTTP/3, half-baked TLS 1.3, and zero security updates?

Grab a coffee, copy-paste the commands below, and in **three minutes flat** you’ll be running **Nginx 1.25+** (or 1.26) straight from the official mainline repo. Works on a 512 MB VPS, no compilation voodoo required.

Why Bother? The 1.18 Pain Points

• Security patches? Stopped in 2021.
• HTTP/3 & QUIC? Missing in action.
• TLS 1.3 0-RTT? Nope.
• Want Brotli, Lua, fancy modules? Good luck compiling.

Step 0 – Back Up Your Config (30 s)

sudo cp -a /etc/nginx /etc/nginx.bak-$(date +%F)

Step 1 – Nuke the Old Packages (Configs Stay)

sudo apt remove nginx nginx-common nginx-full --purge -y

Step 2 – Add the Official Mainline Repo

sudo apt install curl gnupg2 ca-certificates lsb-release -y
curl -fsSL https://nginx.org/keys/nginx_signing.key | \
  sudo gpg --dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg
echo \
"deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/mainline/debian bullseye nginx" | \
sudo tee /etc/apt/sources.list.d/nginx.list

Using Debian 12? Replace bullseye with bookworm.

Step 3 – Install Nginx 1.25+

sudo apt update
sudo apt install nginx -y

nginx -v    # should read 1.25.x or 1.26.x

Step 4 – Firewall & Cloud Panel

sudo ufw allow 'Nginx Full'
sudo ufw allow 443/udp

Don’t forget your cloud provider’s security group – open **TCP 80/443** and **UDP 443** for HTTP/3.

Step 5 – Reload & Test

sudo nginx -t && sudo systemctl reload nginx

Step 6 – Rollback Plan (If You Break Stuff)

sudo apt remove nginx --purge -y
sudo rm /etc/apt/sources.list.d/nginx.list
sudo apt update && sudo apt install nginx/bullseye -y
sudo systemctl restart nginx

One-Liner for the Truly Lazy

curl -fsSL https://raw.githubusercontent.com/yourrepo/nginx-mainline-deb11.sh | sudo bash

FAQ – Straight Talk

1. Will it eat more RAM? +2 MB on a 512 MB box – negligible.
2. Do I need to rewrite configs? Nope, nginx -t passes 100 %.
3. Future updates? sudo apt upgrade keeps you on mainline forever.

---

https://www.rei3.com