Adding metadata

author: root <root@alpha.trunkmasters.com> 2026-06-12 19:09:37 -0500
committer: root <root@alpha.trunkmasters.com> 2026-06-12 19:09:37 -0500
commit: b590c8d7572b727d565cc0b8ff660d43569845de (patch)
tree: 06f7a4102ea4e845df8b66660f252920d52952f9 /www-servers
parent: 24f9cbfc4c34fdb6a6e03311674414e881ceab47 (diff)
download: baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.gz
baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.xz
baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.zip
195 files changed, 13354 insertions, 0 deletions
diff --git a/www-servers/adsf/Manifest b/www-servers/adsf/Manifest
new file mode 100644
index 000000000000..55e53ed02666
--- /dev/null
+++ b/www-servers/adsf/Manifest
@@ -0,0 +1,2 @@
+DIST adsf-1.5.2.tar.gz 185809 BLAKE2B c4853e9f182ec97009e78c9675a4f7d40d2612c12a8b488cf0278435c0924a93088a4ad04e8372e9a2b6dacb7c77c917059b6bcc5a0557db3b2bb3cab2f4defb SHA512 df6ccd28432f527836f551d5e441f4bfccc91766ad1039dbcbdb2e6ef03d69d1adea17b146d45892c2fb8fca14c742206736b191b6317762e66d73a4dd45722a
+DIST adsf-1.5.3.tar.gz 186147 BLAKE2B 1b416cc6832c1c6bc94039d6da6fc4ee21aedff64c231aa98d41dacfb25e2ec6630247830b286e12f855d2583163a2ec2f28d7c6bb6a037d559cc62f70ac8274 SHA512 51ee3204aa8b71c9ba8f0993574c0b384b3533eed5d2c5a86318e47034dbe4b95bcd884a95866927321e406c533d703258637f71b04f39748cb563bd12ac0182
diff --git a/www-servers/adsf/adsf-1.5.2-r1.ebuild b/www-servers/adsf/adsf-1.5.2-r1.ebuild
new file mode 100644
index 000000000000..81e94248ae90
--- /dev/null
+++ b/www-servers/adsf/adsf-1.5.2-r1.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+USE_RUBY="ruby32 ruby33 ruby34"
+
+RUBY_FAKEGEM_EXTRADOC="NEWS.md ../README.md"
+
+RUBY_FAKEGEM_RECIPE_DOC="none"
+
+RUBY_FAKEGEM_GEMSPEC="adsf.gemspec"
+
+inherit ruby-fakegem
+
+DESCRIPTION="A Dead Simple Fileserver is a static file server that can launch in a directory"
+HOMEPAGE="https://github.com/denisdefreyne/adsf/"
+SRC_URI="https://github.com/denisdefreyne/adsf/archive/${PV}.tar.gz -> ${P}.tar.gz"
+RUBY_S="${P}/adsf"
+LICENSE="MIT"
+
+SLOT="0"
+KEYWORDS="~amd64 ~riscv"
+IUSE="test"
+
+ruby_add_rdepend "
+	|| ( dev-ruby/rack:3.1 dev-ruby/rack:3.0 dev-ruby/rack:2.2 )
+	>=dev-ruby/rackup-2.1:2
+	|| ( dev-ruby/webrick www-servers/puma )
+"
+
+ruby_add_bdepend "test? ( dev-ruby/rack-test dev-ruby/webrick )"
+
+all_ruby_prepare() {
+	sed -i -e '/simplecov/,/SimpleCov.command_name/ s:^:#:' \
+		-e '/websocket/ s:^:#:' test/helper.rb || die
+	sed -e '/test_receives_update/,/^  end/ s:^:#:' \
+		-e '/test_non_local_interfaces/askip "networking"' \
+		-e '/test_default_config__serve_index_html_in_subdir_missing_slash/askip "encoding"' \
+		-e /'test_auto_extenion__defers_to_subdir_with_index/askip "encoding"' \
+		-i test/test_server.rb || die
+	sed -i -e '/rubocop/I s:^:#:' Rakefile || die
+	rm -f test/test_version.rb || die
+
+	sed -i -e "s:require_relative ':require './:" ${RUBY_FAKEGEM_GEMSPEC} || die
+}
diff --git a/www-servers/adsf/adsf-1.5.3.ebuild b/www-servers/adsf/adsf-1.5.3.ebuild
new file mode 100644
index 000000000000..d22704027f19
--- /dev/null
+++ b/www-servers/adsf/adsf-1.5.3.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+USE_RUBY="ruby32 ruby33 ruby34"
+
+RUBY_FAKEGEM_EXTRADOC="NEWS.md ../README.md"
+
+RUBY_FAKEGEM_RECIPE_DOC="none"
+
+RUBY_FAKEGEM_GEMSPEC="adsf.gemspec"
+
+inherit ruby-fakegem
+
+DESCRIPTION="A Dead Simple Fileserver is a static file server that can launch in a directory"
+HOMEPAGE="https://github.com/denisdefreyne/adsf/"
+SRC_URI="https://github.com/denisdefreyne/adsf/archive/${PV}.tar.gz -> ${P}.tar.gz"
+RUBY_S="${P}/adsf"
+LICENSE="MIT"
+
+SLOT="0"
+KEYWORDS="~amd64 ~riscv"
+IUSE="test"
+
+ruby_add_rdepend "
+	|| ( dev-ruby/rack:3.2 dev-ruby/rack:3.1 dev-ruby/rack:3.0 dev-ruby/rack:2.2 )
+	>=dev-ruby/rackup-2.1:2
+	|| ( dev-ruby/webrick www-servers/puma )
+"
+
+ruby_add_bdepend "test? ( dev-ruby/rack-test dev-ruby/webrick )"
+
+all_ruby_prepare() {
+	sed -i -e '/simplecov/,/SimpleCov.command_name/ s:^:#:' \
+		-e '/websocket/ s:^:#:' test/helper.rb || die
+	sed -e '/test_receives_update/,/^  end/ s:^:#:' \
+		-e '/test_non_local_interfaces/askip "networking"' \
+		-e '/test_default_config__serve_index_html_in_subdir_missing_slash/askip "encoding"' \
+		-e /'test_auto_extenion__defers_to_subdir_with_index/askip "encoding"' \
+		-i test/test_server.rb || die
+	sed -i -e '/rubocop/I s:^:#:' Rakefile || die
+	rm -f test/test_version.rb || die
+
+	sed -i -e "s:require_relative ':require './:" ${RUBY_FAKEGEM_GEMSPEC} || die
+}
diff --git a/www-servers/adsf/metadata.xml b/www-servers/adsf/metadata.xml
new file mode 100644
index 000000000000..f49b4748acef
--- /dev/null
+++ b/www-servers/adsf/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <upstream>
+    <remote-id type="rubygems">adsf</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/apache/Manifest b/www-servers/apache/Manifest
new file mode 100644
index 000000000000..78d86b034323
--- /dev/null
+++ b/www-servers/apache/Manifest
@@ -0,0 +1,3 @@
+DIST gentoo-apache-2.4.66-20251205.tar.bz2 26982 BLAKE2B 20d0c947c2ad6486af87a588a2851998905f18427da6b5c546819daa043d7d4d5d57b5a0cc0788eb7a7f8b8368079dbc96d47e7771d0b90c8177638f9b0fedf2 SHA512 3e5f25c92531516eca6bd257082931d5df703e1138913513e6d930d04bfbbb621d673899231dad9aac37973484fd11987c6f964b943a44473fb6e60be9a86c62
+DIST httpd-2.4.66.tar.bz2 7504564 BLAKE2B 3e702c9eda81440733516b6fe26f44cd358c385203de5a674f65e3806b0204bae4eb845e3a9ab340b2d731f98c9a0e72f616dd3ad070421b31e7814bbfcd6469 SHA512 49031a3465d956ee3b755e65810b6c35561ddd5fac2c624a273b733c238e115b914cd7b246837e5a3090ccfded6e0b8b3059bfd1f8ce4419081c805a38d05a4b
+DIST httpd-2.4.67.tar.bz2 7493067 BLAKE2B c7f389588b8081080bf81b2f2ffcc585742811a5c7ddc3b63838bb8aad61586e7b8e8854cdb20b56963cc70a952124849b499a7affbf2bad44162f236bb5fbed SHA512 5ae29fc8edb253453271613cb18754de0d943d1f82361059c81f8ebe1f057b894675506550bd1341bfa9416226b569a7bac08f497c53e8bb6dede87f4f41eae4
diff --git a/www-servers/apache/apache-2.4.66.ebuild b/www-servers/apache/apache-2.4.66.ebuild
new file mode 100644
index 000000000000..f1a1ef255833
--- /dev/null
+++ b/www-servers/apache/apache-2.4.66.ebuild
@@ -0,0 +1,262 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# latest gentoo apache files
+GENTOO_PATCHSTAMP="20251205"
+GENTOO_DEVELOPER="graaff"
+GENTOO_PATCHNAME="gentoo-apache-2.4.66"
+
+# IUSE/USE_EXPAND magic
+IUSE_MPMS_FORK="prefork"
+IUSE_MPMS_THREAD="event worker"
+
+# << obsolete modules:
+# authn_default authz_default mem_cache
+# mem_cache is replaced by cache_disk
+# ?? buggy modules
+# proxy_scgi: startup error: undefined symbol "ap_proxy_release_connection", no fix found
+# >> added modules for reason:
+# compat: compatibility with 2.2 access control
+# authz_host: new module for access control
+# authn_core: functionality provided by authn_alias in previous versions
+# authz_core: new module, provides core authorization capabilities
+# cache_disk: replacement for mem_cache
+# lbmethod_byrequests: Split off from mod_proxy_balancer in 2.3
+# lbmethod_bytraffic: Split off from mod_proxy_balancer in 2.3
+# lbmethod_bybusyness: Split off from mod_proxy_balancer in 2.3
+# lbmethod_heartbeat: Split off from mod_proxy_balancer in 2.3
+# slotmem_shm: Slot-based shared memory provider (for lbmethod_byrequests).
+# socache_shmcb: shared object cache provider. Default config with ssl needs it
+# unixd: fixes startup error: Invalid command 'User'
+IUSE_MODULES="access_compat actions alias allowmethods asis auth_basic auth_digest auth_form
+authn_anon authn_core authn_dbd authn_dbm authn_file authn_socache authz_core
+authz_dbd authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex
+brotli cache cache_disk cache_socache cern_meta charset_lite cgi cgid dav dav_fs dav_lock
+dbd deflate dir dumpio env expires ext_filter file_cache filter headers http2
+ident imagemap include info lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness
+lbmethod_heartbeat log_config log_forensic logio lua macro md mime mime_magic negotiation
+proxy proxy_ajp proxy_balancer proxy_connect proxy_ftp proxy_hcheck proxy_html proxy_http proxy_scgi
+proxy_http2 proxy_fcgi proxy_uwsgi proxy_wstunnel request rewrite ratelimit remoteip reqtimeout
+session session_cookie session_crypto session_dbd setenvif slotmem_shm socache_memcache
+socache_shmcb speling status substitute systemd unique_id userdir usertrack
+unixd version vhost_alias watchdog xml2enc"
+# The following are also in the source as of this version, but are not available
+# for user selection:
+# bucketeer case_filter case_filter_in echo http isapi optional_fn_export
+# optional_fn_import optional_hook_export optional_hook_import
+
+# inter-module dependencies
+# TODO: this may still be incomplete
+MODULE_DEPENDS="
+	auth_form:request
+	auth_form:session
+	brotli:filter
+	dav_fs:dav
+	dav_lock:dav
+	deflate:filter
+	cache_disk:cache
+	ext_filter:filter
+	file_cache:cache
+	lbmethod_byrequests:proxy_balancer
+	lbmethod_byrequests:slotmem_shm
+	lbmethod_bytraffic:proxy_balancer
+	lbmethod_bybusyness:proxy_balancer
+	lbmethod_heartbeat:proxy_balancer
+	log_forensic:log_config
+	logio:log_config
+	cache_disk:cache
+	cache_socache:cache
+	md:watchdog
+	mime_magic:mime
+	proxy_ajp:proxy
+	proxy_balancer:proxy
+	proxy_balancer:slotmem_shm
+	proxy_connect:proxy
+	proxy_ftp:proxy
+	proxy_hcheck:proxy
+	proxy_hcheck:watchdog
+	proxy_html:proxy
+	proxy_html:xml2enc
+	proxy_http:proxy
+	proxy_http2:proxy
+	proxy_scgi:proxy
+	proxy_uwsgi:proxy
+	proxy_fcgi:proxy
+	proxy_wstunnel:proxy
+	session_cookie:session
+	session_dbd:dbd
+	session_dbd:session
+	socache_memcache:cache
+	substitute:filter
+"
+
+# module<->define mappings
+MODULE_DEFINES="
+	auth_digest:AUTH_DIGEST
+	authnz_ldap:AUTHNZ_LDAP
+	cache:CACHE
+	cache_disk:CACHE
+	cache_socache:CACHE
+	dav:DAV
+	dav_fs:DAV
+	dav_lock:DAV
+	file_cache:CACHE
+	http2:HTTP2
+	info:INFO
+	ldap:LDAP
+	lua:LUA
+	md:SSL
+	proxy:PROXY
+	proxy_ajp:PROXY
+	proxy_balancer:PROXY
+	proxy_connect:PROXY
+	proxy_fcgi:PROXY
+	proxy_ftp:PROXY
+	proxy_hcheck:PROXY
+	proxy_html:PROXY
+	proxy_http:PROXY
+	proxy_http2:PROXY
+	proxy_scgi:PROXY
+	proxy_uwsgi:PROXY
+	proxy_wstunnel:PROXY
+	socache_shmcb:SSL
+	socache_memcache:CACHE
+	ssl:SSL
+	status:STATUS
+	suexec:SUEXEC
+	systemd:SYSTEMD
+	userdir:USERDIR
+"
+
+# critical modules for the default config
+MODULE_CRITICAL="
+	authn_core
+	authz_core
+	authz_host
+	dir
+	mime
+	unixd
+"
+inherit apache-2 systemd tmpfiles toolchain-funcs
+
+DESCRIPTION="The Apache Web Server"
+HOMEPAGE="https://httpd.apache.org/"
+
+# some helper scripts are Apache-1.1, thus both are here
+LICENSE="Apache-2.0 Apache-1.1"
+SLOT="2"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos ~x64-solaris"
+
+DEPEND="${RDEPEND}"
+
+pkg_setup() {
+	# dependent critical modules which are not allowed in global scope due
+	# to USE flag conditionals (bug #499260)
+	use ssl && MODULE_CRITICAL+=" socache_shmcb"
+	use doc && MODULE_CRITICAL+=" alias negotiation setenvif"
+	apache-2_pkg_setup
+}
+
+src_configure() {
+	# Brain dead check.
+	tc-is-cross-compiler && export ap_cv_void_ptr_lt_long="no"
+
+	apache-2_src_configure
+}
+
+src_compile() {
+	if tc-is-cross-compiler ; then
+		# This header is the same across targets, so use the build compiler.
+		pushd server >/dev/null
+		emake gen_test_char
+		tc-export_build_env BUILD_CC
+		${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} \
+			gen_test_char.c -o gen_test_char $(apr-1-config --includes) || die
+		popd >/dev/null
+	fi
+
+	default
+}
+
+src_install() {
+	apache-2_src_install
+	local i
+	local apache_tools_prune_list=(
+		/usr/bin/{htdigest,logresolve,htpasswd,htdbm,ab,httxt2dbm}
+		/usr/sbin/{checkgid,fcgistarter,htcacheclean,rotatelogs}
+		/usr/share/man/man1/{logresolve.1,htdbm.1,htdigest.1,htpasswd.1,dbmmanage.1,ab.1}
+		/usr/share/man/man8/{rotatelogs.8,htcacheclean.8}
+	)
+	for i in ${apache_tools_prune_list[@]} ; do
+		rm "${ED}"/${i} || die "Failed to prune apache-tools bits"
+	done
+
+	# Clean up empty directories created by the apache install system
+	rmdir "${ED}"/var/{run,www} || die
+
+	dobin support/apxs
+
+	# Note: wait for mod_systemd to be included in some forthcoming release,
+	# Then apache2.4.service can be used and systemd support controlled
+	# through --enable-systemd
+	systemd_newunit "${FILESDIR}/apache2.4-hardened.service" "apache2.service"
+	dotmpfiles "${FILESDIR}/apache.conf"
+	#insinto /etc/apache2/modules.d
+	#doins "${FILESDIR}/00_systemd.conf"
+
+	# Install http2 module config
+	insinto /etc/apache2/modules.d
+	doins "${FILESDIR}"/41_mod_http2.conf
+
+	# Fix path to apache libdir
+	sed "s|@LIBDIR@|$(get_libdir)|" -i "${ED}"/usr/sbin/apache2ctl || die
+}
+
+pkg_postinst() {
+	apache-2_pkg_postinst || die "apache-2_pkg_postinst failed"
+
+	tmpfiles_process apache.conf #662544
+
+	# warnings that default config might not work out of the box
+	local mod cmod
+	for mod in ${MODULE_CRITICAL} ; do
+		if ! use "apache2_modules_${mod}"; then
+			echo
+			ewarn "Warning: Critical module not installed!"
+			ewarn "Modules 'authn_core', 'authz_core' and 'unixd'"
+			ewarn "are highly recomended but might not be in the base profile yet."
+			ewarn "Default config for ssl needs module 'socache_shmcb'."
+			ewarn "Enabling the following flags is highly recommended:"
+			for cmod in ${MODULE_CRITICAL} ; do
+				use "apache2_modules_${cmod}" || \
+					ewarn "+ apache2_modules_${cmod}"
+			done
+			echo
+			break
+		fi
+	done
+	# warning for proxy_balancer and missing load balancing scheduler
+	if use apache2_modules_proxy_balancer; then
+		local lbset=
+		for mod in lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness lbmethod_heartbeat; do
+			if use "apache2_modules_${mod}"; then
+				lbset=1 && break
+			fi
+		done
+		if [[ ! ${lbset} ]] ; then
+			echo
+			ewarn "Info: Missing load balancing scheduler algorithm module"
+			ewarn "(They were split off from proxy_balancer in 2.3)"
+			ewarn "In order to get the ability of load balancing, at least"
+			ewarn "one of these modules has to be present:"
+			ewarn "lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness lbmethod_heartbeat"
+			echo
+		fi
+	fi
+
+	# removed in 2.4.63
+	ewarn "Attention: The tls module based on rustls-ffi has been moved to its own package."
+	ewarn "emerge www-apache/mod_tls to continue using the tls module."
+}
diff --git a/www-servers/apache/apache-2.4.67.ebuild b/www-servers/apache/apache-2.4.67.ebuild
new file mode 100644
index 000000000000..f1a1ef255833
--- /dev/null
+++ b/www-servers/apache/apache-2.4.67.ebuild
@@ -0,0 +1,262 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# latest gentoo apache files
+GENTOO_PATCHSTAMP="20251205"
+GENTOO_DEVELOPER="graaff"
+GENTOO_PATCHNAME="gentoo-apache-2.4.66"
+
+# IUSE/USE_EXPAND magic
+IUSE_MPMS_FORK="prefork"
+IUSE_MPMS_THREAD="event worker"
+
+# << obsolete modules:
+# authn_default authz_default mem_cache
+# mem_cache is replaced by cache_disk
+# ?? buggy modules
+# proxy_scgi: startup error: undefined symbol "ap_proxy_release_connection", no fix found
+# >> added modules for reason:
+# compat: compatibility with 2.2 access control
+# authz_host: new module for access control
+# authn_core: functionality provided by authn_alias in previous versions
+# authz_core: new module, provides core authorization capabilities
+# cache_disk: replacement for mem_cache
+# lbmethod_byrequests: Split off from mod_proxy_balancer in 2.3
+# lbmethod_bytraffic: Split off from mod_proxy_balancer in 2.3
+# lbmethod_bybusyness: Split off from mod_proxy_balancer in 2.3
+# lbmethod_heartbeat: Split off from mod_proxy_balancer in 2.3
+# slotmem_shm: Slot-based shared memory provider (for lbmethod_byrequests).
+# socache_shmcb: shared object cache provider. Default config with ssl needs it
+# unixd: fixes startup error: Invalid command 'User'
+IUSE_MODULES="access_compat actions alias allowmethods asis auth_basic auth_digest auth_form
+authn_anon authn_core authn_dbd authn_dbm authn_file authn_socache authz_core
+authz_dbd authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex
+brotli cache cache_disk cache_socache cern_meta charset_lite cgi cgid dav dav_fs dav_lock
+dbd deflate dir dumpio env expires ext_filter file_cache filter headers http2
+ident imagemap include info lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness
+lbmethod_heartbeat log_config log_forensic logio lua macro md mime mime_magic negotiation
+proxy proxy_ajp proxy_balancer proxy_connect proxy_ftp proxy_hcheck proxy_html proxy_http proxy_scgi
+proxy_http2 proxy_fcgi proxy_uwsgi proxy_wstunnel request rewrite ratelimit remoteip reqtimeout
+session session_cookie session_crypto session_dbd setenvif slotmem_shm socache_memcache
+socache_shmcb speling status substitute systemd unique_id userdir usertrack
+unixd version vhost_alias watchdog xml2enc"
+# The following are also in the source as of this version, but are not available
+# for user selection:
+# bucketeer case_filter case_filter_in echo http isapi optional_fn_export
+# optional_fn_import optional_hook_export optional_hook_import
+
+# inter-module dependencies
+# TODO: this may still be incomplete
+MODULE_DEPENDS="
+	auth_form:request
+	auth_form:session
+	brotli:filter
+	dav_fs:dav
+	dav_lock:dav
+	deflate:filter
+	cache_disk:cache
+	ext_filter:filter
+	file_cache:cache
+	lbmethod_byrequests:proxy_balancer
+	lbmethod_byrequests:slotmem_shm
+	lbmethod_bytraffic:proxy_balancer
+	lbmethod_bybusyness:proxy_balancer
+	lbmethod_heartbeat:proxy_balancer
+	log_forensic:log_config
+	logio:log_config
+	cache_disk:cache
+	cache_socache:cache
+	md:watchdog
+	mime_magic:mime
+	proxy_ajp:proxy
+	proxy_balancer:proxy
+	proxy_balancer:slotmem_shm
+	proxy_connect:proxy
+	proxy_ftp:proxy
+	proxy_hcheck:proxy
+	proxy_hcheck:watchdog
+	proxy_html:proxy
+	proxy_html:xml2enc
+	proxy_http:proxy
+	proxy_http2:proxy
+	proxy_scgi:proxy
+	proxy_uwsgi:proxy
+	proxy_fcgi:proxy
+	proxy_wstunnel:proxy
+	session_cookie:session
+	session_dbd:dbd
+	session_dbd:session
+	socache_memcache:cache
+	substitute:filter
+"
+
+# module<->define mappings
+MODULE_DEFINES="
+	auth_digest:AUTH_DIGEST
+	authnz_ldap:AUTHNZ_LDAP
+	cache:CACHE
+	cache_disk:CACHE
+	cache_socache:CACHE
+	dav:DAV
+	dav_fs:DAV
+	dav_lock:DAV
+	file_cache:CACHE
+	http2:HTTP2
+	info:INFO
+	ldap:LDAP
+	lua:LUA
+	md:SSL
+	proxy:PROXY
+	proxy_ajp:PROXY
+	proxy_balancer:PROXY
+	proxy_connect:PROXY
+	proxy_fcgi:PROXY
+	proxy_ftp:PROXY
+	proxy_hcheck:PROXY
+	proxy_html:PROXY
+	proxy_http:PROXY
+	proxy_http2:PROXY
+	proxy_scgi:PROXY
+	proxy_uwsgi:PROXY
+	proxy_wstunnel:PROXY
+	socache_shmcb:SSL
+	socache_memcache:CACHE
+	ssl:SSL
+	status:STATUS
+	suexec:SUEXEC
+	systemd:SYSTEMD
+	userdir:USERDIR
+"
+
+# critical modules for the default config
+MODULE_CRITICAL="
+	authn_core
+	authz_core
+	authz_host
+	dir
+	mime
+	unixd
+"
+inherit apache-2 systemd tmpfiles toolchain-funcs
+
+DESCRIPTION="The Apache Web Server"
+HOMEPAGE="https://httpd.apache.org/"
+
+# some helper scripts are Apache-1.1, thus both are here
+LICENSE="Apache-2.0 Apache-1.1"
+SLOT="2"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos ~x64-solaris"
+
+DEPEND="${RDEPEND}"
+
+pkg_setup() {
+	# dependent critical modules which are not allowed in global scope due
+	# to USE flag conditionals (bug #499260)
+	use ssl && MODULE_CRITICAL+=" socache_shmcb"
+	use doc && MODULE_CRITICAL+=" alias negotiation setenvif"
+	apache-2_pkg_setup
+}
+
+src_configure() {
+	# Brain dead check.
+	tc-is-cross-compiler && export ap_cv_void_ptr_lt_long="no"
+
+	apache-2_src_configure
+}
+
+src_compile() {
+	if tc-is-cross-compiler ; then
+		# This header is the same across targets, so use the build compiler.
+		pushd server >/dev/null
+		emake gen_test_char
+		tc-export_build_env BUILD_CC
+		${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} \
+			gen_test_char.c -o gen_test_char $(apr-1-config --includes) || die
+		popd >/dev/null
+	fi
+
+	default
+}
+
+src_install() {
+	apache-2_src_install
+	local i
+	local apache_tools_prune_list=(
+		/usr/bin/{htdigest,logresolve,htpasswd,htdbm,ab,httxt2dbm}
+		/usr/sbin/{checkgid,fcgistarter,htcacheclean,rotatelogs}
+		/usr/share/man/man1/{logresolve.1,htdbm.1,htdigest.1,htpasswd.1,dbmmanage.1,ab.1}
+		/usr/share/man/man8/{rotatelogs.8,htcacheclean.8}
+	)
+	for i in ${apache_tools_prune_list[@]} ; do
+		rm "${ED}"/${i} || die "Failed to prune apache-tools bits"
+	done
+
+	# Clean up empty directories created by the apache install system
+	rmdir "${ED}"/var/{run,www} || die
+
+	dobin support/apxs
+
+	# Note: wait for mod_systemd to be included in some forthcoming release,
+	# Then apache2.4.service can be used and systemd support controlled
+	# through --enable-systemd
+	systemd_newunit "${FILESDIR}/apache2.4-hardened.service" "apache2.service"
+	dotmpfiles "${FILESDIR}/apache.conf"
+	#insinto /etc/apache2/modules.d
+	#doins "${FILESDIR}/00_systemd.conf"
+
+	# Install http2 module config
+	insinto /etc/apache2/modules.d
+	doins "${FILESDIR}"/41_mod_http2.conf
+
+	# Fix path to apache libdir
+	sed "s|@LIBDIR@|$(get_libdir)|" -i "${ED}"/usr/sbin/apache2ctl || die
+}
+
+pkg_postinst() {
+	apache-2_pkg_postinst || die "apache-2_pkg_postinst failed"
+
+	tmpfiles_process apache.conf #662544
+
+	# warnings that default config might not work out of the box
+	local mod cmod
+	for mod in ${MODULE_CRITICAL} ; do
+		if ! use "apache2_modules_${mod}"; then
+			echo
+			ewarn "Warning: Critical module not installed!"
+			ewarn "Modules 'authn_core', 'authz_core' and 'unixd'"
+			ewarn "are highly recomended but might not be in the base profile yet."
+			ewarn "Default config for ssl needs module 'socache_shmcb'."
+			ewarn "Enabling the following flags is highly recommended:"
+			for cmod in ${MODULE_CRITICAL} ; do
+				use "apache2_modules_${cmod}" || \
+					ewarn "+ apache2_modules_${cmod}"
+			done
+			echo
+			break
+		fi
+	done
+	# warning for proxy_balancer and missing load balancing scheduler
+	if use apache2_modules_proxy_balancer; then
+		local lbset=
+		for mod in lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness lbmethod_heartbeat; do
+			if use "apache2_modules_${mod}"; then
+				lbset=1 && break
+			fi
+		done
+		if [[ ! ${lbset} ]] ; then
+			echo
+			ewarn "Info: Missing load balancing scheduler algorithm module"
+			ewarn "(They were split off from proxy_balancer in 2.3)"
+			ewarn "In order to get the ability of load balancing, at least"
+			ewarn "one of these modules has to be present:"
+			ewarn "lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness lbmethod_heartbeat"
+			echo
+		fi
+	fi
+
+	# removed in 2.4.63
+	ewarn "Attention: The tls module based on rustls-ffi has been moved to its own package."
+	ewarn "emerge www-apache/mod_tls to continue using the tls module."
+}
diff --git a/www-servers/apache/files/41_mod_http2.conf b/www-servers/apache/files/41_mod_http2.conf
new file mode 100644
index 000000000000..e4c9454e0127
--- /dev/null
+++ b/www-servers/apache/files/41_mod_http2.conf
@@ -0,0 +1,9 @@
+<IfDefine SSL>
+  <IfModule http2_module>
+    # enable debugging for this module
+    #LogLevel http2:info
+
+    #Enable HTTP/2 support
+    Protocols h2 h2c http/1.1
+  </IfModule>
+</IfDefine>
diff --git a/www-servers/apache/files/apache.conf b/www-servers/apache/files/apache.conf
new file mode 100644
index 000000000000..74888d81a752
--- /dev/null
+++ b/www-servers/apache/files/apache.conf
@@ -0,0 +1,3 @@
+d /run/apache2 710 root apache
+d /run/apache_ssl_mutex
+d /var/cache/apache2 750 apache apache
diff --git a/www-servers/apache/files/apache2.4-hardened.service b/www-servers/apache/files/apache2.4-hardened.service
new file mode 100644
index 000000000000..fe66567e1e80
--- /dev/null
+++ b/www-servers/apache/files/apache2.4-hardened.service
@@ -0,0 +1,25 @@
+[Unit]
+Description=The Apache HTTP Server
+After=network.target remote-fs.target nss-lookup.target
+
+[Service]
+EnvironmentFile=/etc/conf.d/apache2
+ExecStart=/usr/sbin/apache2 $APACHE2_OPTS -DFOREGROUND
+ExecReload=/usr/sbin/apache2 $APACHE2_OPTS -k graceful
+ExecStop=/usr/sbin/apache2 $APACHE2_OPTS -k graceful-stop
+# We want systemd to give httpd some time to finish gracefully, but still want
+# it to kill httpd after TimeoutStopSec if something went wrong during the
+# graceful stop. Normally, Systemd sends SIGTERM signal right after the
+# ExecStop, which would kill httpd. We are sending useless SIGCONT here to give
+# httpd time to finish.
+KillSignal=SIGCONT
+PrivateTmp=true
+#Hardening
+CapabilityBoundingSet=CAP_CHOWN CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_KILL CAP_NET_BIND_SERVICE CAP_IPC_LOCK
+SecureBits=noroot-locked
+ProtectSystem=full
+PrivateDevices=true
+MemoryDenyWriteExecute=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/www-servers/apache/metadata.xml b/www-servers/apache/metadata.xml
new file mode 100644
index 000000000000..c67b48f215e5
--- /dev/null
+++ b/www-servers/apache/metadata.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>apache-bugs@gentoo.org</email>
+    <name>Apache project</name>
+  </maintainer>
+  <longdescription>
+		The Apache HTTP Server Project is an effort to develop and maintain an
+		open-source HTTP server for modern operating systems. The goal of this
+		project is to provide a secure, efficient and extensible server that
+		provides HTTP services in sync with the current HTTP standards.
+	</longdescription>
+  <use>
+    <flag name="static">Link in apache2 modules statically rather then plugins</flag>
+    <flag name="suexec">Install suexec with apache</flag>
+    <flag name="suexec-caps">Install suexec with capabilities instead of SUID</flag>
+    <flag name="suexec-syslog">Log suexec to syslog instead of to a separate file</flag>
+  </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:apache:http_server</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/caddy/Manifest b/www-servers/caddy/Manifest
new file mode 100644
index 000000000000..456488c44bc1
--- /dev/null
+++ b/www-servers/caddy/Manifest
@@ -0,0 +1,4 @@
+DIST caddy-2.10.2-docs.tar.gz 24741 BLAKE2B dc6a483d2fefcb984d5a56b868206c660a22f2480eabc6f7fd12a527c4307a080da4db5caa98b56921038021970a40d1c7317712b7ad6f468b6c8b5a49dc27ea SHA512 281dff2e6cce1f9c9e4273bab4832356baf9e4b0119f854cb9b839dd44fa55e394d4e08ad067e2ed01ac75a39189d66ad79c73ad1738b3012af21543b280dde4
+DIST caddy-2.10.2-r1-deps.tar.xz 12283836 BLAKE2B 52fdb35f8261216a42f3fb3064fa31ccebc73042280f17f41caac9356d11ea435f2e1e98138970a43f9d2548fba198d436c48d686bdbc97498d6f8b555db12f5 SHA512 4e2eaa10f828605b4ce65fade8af0cc691ce51c88d905575ec1f62f751982ef286aaf59acebd3c2ccc5786f280b68656da18e8e6cf17ff3d73581f997ffbf8c5
+DIST caddy-2.10.2-r1-go-mod-sum.patch 151305 BLAKE2B 7b3d5cf700d6f29aa9338b77e0692d00188a120f2dcb6870a3f64c1d0cb4190e7a492dbe6258baa77cad52645617aa6934f128faca6ab88e5278849907201f04 SHA512 9a7a4040f1fe7b8e9bd84b22d06a5f2b67a9e039562d86fe3319a15c1063524ce52361263f03a252ee6df38748eaa3b8b56cf16e99599d783862f70fbb5d2b8b
+DIST caddy-2.10.2.tar.gz 735883 BLAKE2B 3413f0406ae2a1a329fb65cac84dd3eeb1d41466d8603ff67533a320ea37dbe70592ae621d66ec14d4783bf4773425d86e991ed62f14f6057b91522ff2a7f46b SHA512 986b11e26cdaa4fbe554cf7b6bb333404fc33190945ef995122518a3fe2fe582a4cf4d2a8ab463e045857650e9deb88123f8d86a93dbdc465635755b00356205
diff --git a/www-servers/caddy/caddy-2.10.2-r1.ebuild b/www-servers/caddy/caddy-2.10.2-r1.ebuild
new file mode 100644
index 000000000000..635a3c90b4bd
--- /dev/null
+++ b/www-servers/caddy/caddy-2.10.2-r1.ebuild
@@ -0,0 +1,157 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit fcaps go-module systemd shell-completion
+
+DESCRIPTION="Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS"
+HOMEPAGE="https://caddyserver.com"
+
+if [[ "${PV}" == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/caddyserver/caddy.git"
+else
+	SRC_URI="
+		https://github.com/caddyserver/caddy/archive/v${PV}.tar.gz -> ${P}.tar.gz
+		https://github.com/rahilarious/gentoo-distfiles/releases/download/${PF}/deps.tar.xz -> ${PF}-deps.tar.xz
+		https://github.com/rahilarious/gentoo-distfiles/releases/download/${PF}/go-mod-sum.patch -> ${PF}-go-mod-sum.patch
+		https://github.com/caddyserver/dist/archive/refs/tags/v${PV}.tar.gz -> ${P}-docs.tar.gz
+"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+# MAIN
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD ECL-2.0 MIT CC0-1.0"
+SLOT="0"
+
+IUSE='dynamicdns dns-alidns dns-azure dns-cloudflare dns-cloudns dns-digitalocean dns-duckdns dns-dynv6 dns-gandi dns-godaddy dns-googleclouddns dns-he dns-hetzner dns-huaweicloud dns-linode dns-mailinabox dns-namecheap dns-netcup dns-netlify dns-ovh dns-porkbun dns-powerdns dns-rfc2136 dns-route53 dns-vultr events-handlers-exec security webdav'
+RESTRICT="test"
+
+BDEPEND=">=dev-lang/go-1.25.1"
+RDEPEND="
+	acct-user/http
+	acct-group/http"
+DEPEND="${RDEPEND}"
+
+FILECAPS=(
+	-m 755 'cap_net_bind_service=+ep' usr/bin/"${PN}"
+)
+
+# takes a module as an only arg
+add_custom_module() {
+	local LINE_NO=$(grep -n 'plug in Caddy modules here' cmd/caddy/main.go | awk -F: '{print $1;}' || die)
+	sed -i -e "${LINE_NO:?}a \        _ \"$1\"" cmd/caddy/main.go || die
+}
+
+src_unpack() {
+	declare -A MOOMODULES || die
+
+	use dynamicdns && { MOOMODULES[ddns]="github.com/mholt/caddy-dynamicdns" || die ; }
+	use events-handlers-exec && { MOOMODULES[exec]="github.com/mholt/caddy-events-exec" || die ; }
+	use security && { MOOMODULES[sec]="github.com/greenpau/caddy-security" || die ; }
+	use webdav && { MOOMODULES[webdav]="github.com/mholt/caddy-webdav" || die ; }
+
+	# alphabetically sorted popular DNS providers plugins
+	# more info on https://caddyserver.com/docs/modules/
+	use dns-alidns && { MOOMODULES[alidns]="github.com/caddy-dns/alidns" || die ; }
+	use dns-azure && { MOOMODULES[azure]="github.com/caddy-dns/azure" || die ; }
+	use dns-cloudflare && { MOOMODULES[cloudflare]="github.com/caddy-dns/cloudflare" || die ; }
+	use dns-cloudns && { MOOMODULES[cloudns]="github.com/caddy-dns/cloudns" || die ; }
+	use dns-digitalocean && { MOOMODULES[do]="github.com/caddy-dns/digitalocean" || die ; }
+	use dns-duckdns && { MOOMODULES[duck]="github.com/caddy-dns/duckdns" || die ; }
+	use dns-dynv6 && { MOOMODULES[dynv6]="github.com/caddy-dns/dynv6" || die ; }
+	use dns-gandi && { MOOMODULES[gandi]="github.com/caddy-dns/gandi" || die ; }
+	use dns-godaddy && { MOOMODULES[godaddy]="github.com/caddy-dns/godaddy" || die ; }
+	use dns-googleclouddns && { MOOMODULES[gcpdns]="github.com/caddy-dns/googleclouddns" || die ; }
+	use dns-he && { MOOMODULES[he]="github.com/caddy-dns/he" || die ; }
+	use dns-hetzner && { MOOMODULES[hetzner]="github.com/caddy-dns/hetzner" || die ; }
+	use dns-huaweicloud && { MOOMODULES[huaweicloud]="github.com/caddy-dns/huaweicloud" || die ; }
+	use dns-linode && { MOOMODULES[linode]="github.com/caddy-dns/linode" || die ; }
+	use dns-mailinabox && { MOOMODULES[miabox]="github.com/caddy-dns/mailinabox" || die ; }
+	use dns-namecheap && { MOOMODULES[namecheap]="github.com/caddy-dns/namecheap" || die ; }
+	use dns-netcup && { MOOMODULES[netcup]="github.com/caddy-dns/netcup" || die ; }
+	use dns-netlify && { MOOMODULES[netlify]="github.com/caddy-dns/netlify" || die ; }
+	use dns-ovh && { MOOMODULES[ovh]="github.com/caddy-dns/ovh" || die ; }
+	use dns-porkbun && { MOOMODULES[porkbun]="github.com/caddy-dns/porkbun" || die ; }
+	use dns-powerdns && { MOOMODULES[powerdns]="github.com/caddy-dns/powerdns" || die ; }
+	use dns-rfc2136 && { MOOMODULES[rfc]="github.com/caddy-dns/rfc2136" || die ; }
+	use dns-route53 && { MOOMODULES[route53]="github.com/caddy-dns/route53" || die ; }
+	use dns-vultr && { MOOMODULES[vultr]="github.com/caddy-dns/vultr" || die ; }
+
+	export MY_MODULES="${MOOMODULES[@]}" || die
+
+	if [[ "${PV}" == 9999* ]]; then
+		# clone main git repo
+		git-r3_src_unpack
+
+		# get extra modules
+		pushd "${P}" || die
+		for moo in ${MY_MODULES}; do
+			add_custom_module "${moo}"
+			ego get "${moo}"
+		done
+		popd || die
+
+		# clone dist repo (docs and misc)
+		EGIT_REPO_URI="https://github.com/caddyserver/dist.git"
+		EGIT_CHECKOUT_DIR="${WORKDIR}/dist-${PV}"
+		git-r3_src_unpack
+
+		go-module_live_vendor
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|User=caddy|User=http|g;s|Group=caddy|Group=http|g;" ../dist-*/init/*service || die
+
+	if [[ "${PV}" != 9999* ]]; then
+		eapply "${DISTDIR}/${PF}"-go-mod-sum.patch
+
+		for moo in ${MY_MODULES}; do
+			add_custom_module "${moo}"
+		done
+	fi
+}
+
+src_compile() {
+	# https://github.com/caddyserver/caddy/blob/master/caddy.go#L843
+	if [[ ${PV} == 9999* ]]; then
+		local CUSTOM_VER="git-$(git rev-parse --short HEAD)"
+	else
+		local CUSTOM_VER="${PV}"
+	fi
+
+	ego build -ldflags "-X github.com/caddyserver/caddy/v2.CustomVersion=${CUSTOM_VER}" ./cmd/caddy
+	local sh
+	for sh in bash fish zsh; do
+		./caddy completion "${sh}" > completion."${sh}" || die
+	done
+	./caddy manpage -o manpages || die
+}
+
+src_install() {
+	default
+
+	dobin "${PN}"
+	insinto /etc/"${PN}"
+	doins ../dist-*/config/Caddyfile
+	systemd_dounit ../dist-*/init/*.service
+	newinitd "${FILESDIR}"/initd-2.7.5 "${PN}"
+	newconfd "${FILESDIR}"/confd-2.7.5 "${PN}"
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/logrotated" "${PN}"
+	insinto /usr/share/"${PN}"
+	doins ../dist-*/welcome/index.html
+
+	newbashcomp completion.bash "${PN}"
+	newfishcomp completion.fish "${PN}".fish
+	newzshcomp completion.zsh _"${PN}"
+	newdoc ../dist-*/init/README.md systemd-services-README.md
+	doman manpages/*
+}
diff --git a/www-servers/caddy/caddy-9999.ebuild b/www-servers/caddy/caddy-9999.ebuild
new file mode 100644
index 000000000000..76e47aa691ef
--- /dev/null
+++ b/www-servers/caddy/caddy-9999.ebuild
@@ -0,0 +1,157 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit fcaps go-module systemd shell-completion
+
+DESCRIPTION="Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS"
+HOMEPAGE="https://caddyserver.com"
+
+if [[ "${PV}" == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/caddyserver/caddy.git"
+else
+	SRC_URI="
+		https://github.com/caddyserver/caddy/archive/v${PV}.tar.gz -> ${P}.tar.gz
+		https://github.com/rahilarious/gentoo-distfiles/releases/download/${PF}/deps.tar.xz -> ${PF}-deps.tar.xz
+		https://github.com/rahilarious/gentoo-distfiles/releases/download/${PF}/go-mod-sum.patch -> ${PF}-go-mod-sum.patch
+		https://github.com/caddyserver/dist/archive/refs/tags/v${PV}.tar.gz -> ${P}-docs.tar.gz
+"
+	KEYWORDS="~amd64 ~arm64 ~loong ~riscv"
+fi
+
+# MAIN
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD ECL-2.0 MIT CC0-1.0"
+SLOT="0"
+
+IUSE='dynamicdns dns-alidns dns-azure dns-cloudflare dns-cloudns dns-digitalocean dns-duckdns dns-dynv6 dns-gandi dns-godaddy dns-googleclouddns dns-he dns-hetzner dns-huaweicloud dns-linode dns-mailinabox dns-namecheap dns-netcup dns-netlify dns-ovh dns-porkbun dns-powerdns dns-rfc2136 dns-route53 dns-vultr events-handlers-exec security webdav'
+RESTRICT="test"
+
+BDEPEND=">=dev-lang/go-1.25.1"
+RDEPEND="
+	acct-user/http
+	acct-group/http"
+DEPEND="${RDEPEND}"
+
+FILECAPS=(
+	-m 755 'cap_net_bind_service=+ep' usr/bin/"${PN}"
+)
+
+# takes a module as an only arg
+add_custom_module() {
+	local LINE_NO=$(grep -n 'plug in Caddy modules here' cmd/caddy/main.go | awk -F: '{print $1;}' || die)
+	sed -i -e "${LINE_NO:?}a \        _ \"$1\"" cmd/caddy/main.go || die
+}
+
+src_unpack() {
+	declare -A MOOMODULES || die
+
+	use dynamicdns && { MOOMODULES[ddns]="github.com/mholt/caddy-dynamicdns" || die ; }
+	use events-handlers-exec && { MOOMODULES[exec]="github.com/mholt/caddy-events-exec" || die ; }
+	use security && { MOOMODULES[sec]="github.com/greenpau/caddy-security" || die ; }
+	use webdav && { MOOMODULES[webdav]="github.com/mholt/caddy-webdav" || die ; }
+
+	# alphabetically sorted popular DNS providers plugins
+	# more info on https://caddyserver.com/docs/modules/
+	use dns-alidns && { MOOMODULES[alidns]="github.com/caddy-dns/alidns" || die ; }
+	use dns-azure && { MOOMODULES[azure]="github.com/caddy-dns/azure" || die ; }
+	use dns-cloudflare && { MOOMODULES[cloudflare]="github.com/caddy-dns/cloudflare" || die ; }
+	use dns-cloudns && { MOOMODULES[cloudns]="github.com/caddy-dns/cloudns" || die ; }
+	use dns-digitalocean && { MOOMODULES[do]="github.com/caddy-dns/digitalocean" || die ; }
+	use dns-duckdns && { MOOMODULES[duck]="github.com/caddy-dns/duckdns" || die ; }
+	use dns-dynv6 && { MOOMODULES[dynv6]="github.com/caddy-dns/dynv6" || die ; }
+	use dns-gandi && { MOOMODULES[gandi]="github.com/caddy-dns/gandi" || die ; }
+	use dns-godaddy && { MOOMODULES[godaddy]="github.com/caddy-dns/godaddy" || die ; }
+	use dns-googleclouddns && { MOOMODULES[gcpdns]="github.com/caddy-dns/googleclouddns" || die ; }
+	use dns-he && { MOOMODULES[he]="github.com/caddy-dns/he" || die ; }
+	use dns-hetzner && { MOOMODULES[hetzner]="github.com/caddy-dns/hetzner" || die ; }
+	use dns-huaweicloud && { MOOMODULES[huaweicloud]="github.com/caddy-dns/huaweicloud" || die ; }
+	use dns-linode && { MOOMODULES[linode]="github.com/caddy-dns/linode" || die ; }
+	use dns-mailinabox && { MOOMODULES[miabox]="github.com/caddy-dns/mailinabox" || die ; }
+	use dns-namecheap && { MOOMODULES[namecheap]="github.com/caddy-dns/namecheap" || die ; }
+	use dns-netcup && { MOOMODULES[netcup]="github.com/caddy-dns/netcup" || die ; }
+	use dns-netlify && { MOOMODULES[netlify]="github.com/caddy-dns/netlify" || die ; }
+	use dns-ovh && { MOOMODULES[ovh]="github.com/caddy-dns/ovh" || die ; }
+	use dns-porkbun && { MOOMODULES[porkbun]="github.com/caddy-dns/porkbun" || die ; }
+	use dns-powerdns && { MOOMODULES[powerdns]="github.com/caddy-dns/powerdns" || die ; }
+	use dns-rfc2136 && { MOOMODULES[rfc]="github.com/caddy-dns/rfc2136" || die ; }
+	use dns-route53 && { MOOMODULES[route53]="github.com/caddy-dns/route53" || die ; }
+	use dns-vultr && { MOOMODULES[vultr]="github.com/caddy-dns/vultr" || die ; }
+
+	export MY_MODULES="${MOOMODULES[@]}" || die
+
+	if [[ "${PV}" == 9999* ]]; then
+		# clone main git repo
+		git-r3_src_unpack
+
+		# get extra modules
+		pushd "${P}" || die
+		for moo in ${MY_MODULES}; do
+			add_custom_module "${moo}"
+			ego get "${moo}"
+		done
+		popd || die
+
+		# clone dist repo (docs and misc)
+		EGIT_REPO_URI="https://github.com/caddyserver/dist.git"
+		EGIT_CHECKOUT_DIR="${WORKDIR}/dist-${PV}"
+		git-r3_src_unpack
+
+		go-module_live_vendor
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|User=caddy|User=http|g;s|Group=caddy|Group=http|g;" ../dist-*/init/*service || die
+
+	if [[ "${PV}" != 9999* ]]; then
+		eapply "${DISTDIR}/${PF}"-go-mod-sum.patch
+
+		for moo in ${MY_MODULES}; do
+			add_custom_module "${moo}"
+		done
+	fi
+}
+
+src_compile() {
+	# https://github.com/caddyserver/caddy/blob/master/caddy.go#L843
+	if [[ ${PV} == 9999* ]]; then
+		local CUSTOM_VER="git-$(git rev-parse --short HEAD)"
+	else
+		local CUSTOM_VER="${PV}"
+	fi
+
+	ego build -ldflags "-X github.com/caddyserver/caddy/v2.CustomVersion=${CUSTOM_VER}" ./cmd/caddy
+	local sh
+	for sh in bash fish zsh; do
+		./caddy completion "${sh}" > completion."${sh}" || die
+	done
+	./caddy manpage -o manpages || die
+}
+
+src_install() {
+	default
+
+	dobin "${PN}"
+	insinto /etc/"${PN}"
+	doins ../dist-*/config/Caddyfile
+	systemd_dounit ../dist-*/init/*.service
+	newinitd "${FILESDIR}"/initd-2.7.5 "${PN}"
+	newconfd "${FILESDIR}"/confd-2.7.5 "${PN}"
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/logrotated" "${PN}"
+	insinto /usr/share/"${PN}"
+	doins ../dist-*/welcome/index.html
+
+	newbashcomp completion.bash "${PN}"
+	newfishcomp completion.fish "${PN}".fish
+	newzshcomp completion.zsh _"${PN}"
+	newdoc ../dist-*/init/README.md systemd-services-README.md
+	doman manpages/*
+}
diff --git a/www-servers/caddy/files/confd-2.7.5 b/www-servers/caddy/files/confd-2.7.5
new file mode 100644
index 000000000000..62cca711638a
--- /dev/null
+++ b/www-servers/caddy/files/confd-2.7.5
@@ -0,0 +1,5 @@
+# command_user="http:http"
+# logfile="/var/log/caddy/caddy.log"
+#
+# caddy_config="/etc/caddy/Caddyfile"
+# command_args="run --config ${caddy_config}"
diff --git a/www-servers/caddy/files/initd-2.7.5 b/www-servers/caddy/files/initd-2.7.5
new file mode 100644
index 000000000000..408405c42a28
--- /dev/null
+++ b/www-servers/caddy/files/initd-2.7.5
@@ -0,0 +1,53 @@
+#!/sbin/openrc-run
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="checkconfig"
+extra_started_commands="reload"
+
+description="Caddy web server"
+pidfile=${pidfile:-"/run/${RC_SVCNAME}.pid"}
+command="/usr/bin/caddy"
+command_user="${command_user:-"http:http"}"
+caddy_config="${caddy_config:-"/etc/caddy/Caddyfile"}"
+command_args="${command_args:-"run --config ${caddy_config}"}"
+command_background="true"
+logfile="${logfile:-"/var/log/${RC_SVCNAME}/${RC_SVCNAME}.log"}"
+start_stop_daemon_args="--user ${command_user%:*} --group ${command_user#*:}
+	--stdout ${logfile} --stderr ${logfile}"
+
+: "${supervisor:=supervise-daemon}"
+: "${respawn_delay:=5}"
+: "${respawn_max:=10}"
+: "${respawn_period:=60}"
+
+depend() {
+	need net
+}
+
+checkconfig() {
+    if [ ! -f "${caddy_config}" ] ; then
+        ewarn "${caddy_config} does not exist."
+        return 1
+    fi
+    "${command}" validate --config "${caddy_config}" >> "${logfile}" 2>&1
+}
+
+start() {
+    checkconfig || { eerror "Invalid configuration file !" && return 1; }
+	checkpath --directory --mode 755 --owner root "${pidfile%/*}"
+	checkpath --directory --mode 755 --owner "${command_user}" "${logfile%/*}"
+	default_start
+}
+
+reload() {
+    if ! service_started "${SVCNAME}" ; then
+        eerror "${SVCNAME} isn't running"
+        return 1
+    fi
+    checkconfig || { eerror "Invalid configuration file !" && return 1; }
+
+    ebegin "Reloading ${SVCNAME}"
+    "${command}" reload --force --config "${caddy_config}" > /dev/null 2>&1
+    eend $?
+}
diff --git a/www-servers/caddy/files/logrotated b/www-servers/caddy/files/logrotated
new file mode 100644
index 000000000000..3cb55ca2c6c2
--- /dev/null
+++ b/www-servers/caddy/files/logrotated
@@ -0,0 +1,3 @@
+/var/log/caddy/*.log {
+	copytruncate
+}
diff --git a/www-servers/caddy/metadata.xml b/www-servers/caddy/metadata.xml
new file mode 100644
index 000000000000..5614827b4a5b
--- /dev/null
+++ b/www-servers/caddy/metadata.xml
@@ -0,0 +1,136 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <use>
+    <flag name="dynamicdns">
+      Adds module which allows querying an endpoint to get dynamic public IP and updating records with DNS providers
+      https://caddyserver.com/docs/modules/dynamic_dns
+    </flag>
+    <flag name="dns-alidns">
+      Adds module which allows to manage Aliyun DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.alidns
+    </flag>
+    <flag name="dns-azure">
+      Adds module which allows to manage Azure hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.azure
+    </flag>
+    <flag name="dns-cloudflare">
+      Adds module which allows to manage Cloudflare hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.cloudflare
+    </flag>
+    <flag name="dns-cloudns">
+      Adds module which allows to manage ClouDNS hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.cloudns
+    </flag>
+    <flag name="dns-digitalocean">
+      Adds module which allows to manage DigitalOcean hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.digitalocean
+    </flag>
+    <flag name="dns-duckdns">
+      Adds module which allows to manage Duck DNS hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.duckdns
+    </flag>
+    <flag name="dns-dynv6">
+      Adds module which allows to manage Dynv6 hosted DNS zones using Caddy
+    </flag>
+    <flag name="dns-gandi">
+      Adds module which allows to manage Gandi hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.gandi
+    </flag>
+    <flag name="dns-godaddy">
+      Adds module which allows to manage Godaddy hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.godaddy
+    </flag>
+    <flag name="dns-googleclouddns">
+      Adds module which allows to manage Google Cloud hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.googleclouddns
+    </flag>
+    <flag name="dns-he">
+      Adds module which allows to manage Hurricane Electric hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.he
+    </flag>
+    <flag name="dns-hetzner">
+      Adds module which allows to manage Hetzner hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.hetzner
+    </flag>
+    <flag name="dns-huaweicloud">
+      Adds module which allows to manage Huawei Cloud hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.huaweicloud
+    </flag>
+    <flag name="dns-linode">
+      Adds module which allows to manage Linode hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.linode
+    </flag>
+    <flag name="dns-mailinabox">
+      Adds module which allows to manage Mail-in-a-Box hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.mailinabox
+    </flag>
+    <flag name="dns-namecheap">
+      Adds module which allows to manage Namecheap hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.namecheap
+    </flag>
+    <flag name="dns-netcup">
+      Adds module which allows to manage netcup hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.netcup
+    </flag>
+    <flag name="dns-netlify">
+      Adds module which allows to manage Netlify hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.netlify
+    </flag>
+    <flag name="dns-ovh">
+      Adds module which allows to manage OVHcloud hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.ovh
+    </flag>
+    <flag name="dns-porkbun">
+      Adds module which allows to manage porkbun hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.porkbun
+    </flag>
+    <flag name="dns-powerdns">
+      Adds module which allows to manage DNS zones of <pkg>net-dns/pdns</pkg> using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.powerdns
+    </flag>
+    <flag name="dns-rfc2136">
+      Adds module which allows to manage DNS zones using RFC2136 Dynamic Updates within Caddy
+      https://caddyserver.com/docs/modules/dns.providers.rfc2136
+    </flag>
+    <flag name="dns-route53">
+      Adds module which allows to manage AWS route53 hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.route53
+    </flag>
+    <flag name="dns-vultr">
+      Adds module which allows to manage Vultr hosted DNS zones using Caddy
+      https://caddyserver.com/docs/modules/dns.providers.vultr
+    </flag>
+    <flag name="events-handlers-exec">
+      Adds module which lets user exec command on Caddy events
+      https://caddyserver.com/docs/modules/events.handlers.exec
+      https://caddyserver.com/docs/caddyfile/options#event-options
+    </flag>
+    <flag name="security">
+      Authentication, Authorization, and Accounting. LDAP, OAuth, SAML, MFA, 2FA, JWT etc..
+      https://caddyserver.com/docs/modules/security
+    </flag>
+    <flag name="webdav">
+      Adds module which implements an HTTP handler for responding to WebDAV clients
+      https://caddyserver.com/docs/modules/http.handlers.webdav
+    </flag>
+  </use>
+  <upstream>
+    <bugs-to>https://github.com/caddyserver/caddy/issues</bugs-to>
+    <doc>https://caddyserver.com/docs/</doc>
+    <remote-id type="cpe">cpe:/a:caddyserver:caddy</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/civetweb/Manifest b/www-servers/civetweb/Manifest
new file mode 100644
index 000000000000..cd6fef3fc1f6
--- /dev/null
+++ b/www-servers/civetweb/Manifest
@@ -0,0 +1 @@
+DIST civetweb-1.16.tar.gz 12094780 BLAKE2B 7c2e094f6e4730459082c8557925f51775beb0b07fa01291f7a46bf3ea69d7f879566e71a8c6d5b9ad1b3b28d910d99e587eccc703e8b2d3d5797f589c24074a SHA512 a0b943dfc76d7fd47f5a7d2c834fd38ddd4cf01a11730cf2f7cfaf32fea9698f59672f3a0f86ac80e0abc315d94d2367a500d37013f305c87d45e84cf39ca816
diff --git a/www-servers/civetweb/civetweb-1.16.ebuild b/www-servers/civetweb/civetweb-1.16.ebuild
new file mode 100644
index 000000000000..a7ac2423e000
--- /dev/null
+++ b/www-servers/civetweb/civetweb-1.16.ebuild
@@ -0,0 +1,34 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake
+
+HOMEPAGE="https://github.com/civetweb/civetweb/"
+DESCRIPTION="Embedded C/C++ web server"
+SRC_URI="https://github.com/civetweb/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="amd64 ~arm ~arm64 ~riscv x86"
+IUSE="cxx +server ssl"
+
+DEPEND="ssl? ( dev-libs/openssl:0= )"
+RDEPEND="${DEPEND}"
+
+src_configure() {
+	local mycmakeargs=(
+		-DBUILD_TESTING=OFF
+		-DBUILD_SHARED_LIBS=ON
+		-DCIVETWEB_BUILD_TESTING=OFF
+		-DCIVETWEB_ENABLE_LUA=OFF
+		-DCIVETWEB_ENABLE_DUKTAPE=OFF
+		-DCIVETWEB_ENABLE_WEBSOCKETS=ON
+		-DCIVETWEB_ENABLE_CXX="$(usex cxx)"
+		-DCIVETWEB_ENABLE_SERVER_EXECUTABLE="$(usex server)"
+		-DCIVETWEB_ENABLE_SSL="$(usex ssl)"
+	)
+
+	cmake_src_configure
+}
diff --git a/www-servers/civetweb/metadata.xml b/www-servers/civetweb/metadata.xml
new file mode 100644
index 000000000000..efd8d6b60aae
--- /dev/null
+++ b/www-servers/civetweb/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:civetweb_project:civetweb</remote-id>
+  </upstream>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+  </maintainer>
+  <use>
+    <flag name="server">Build standalone server</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/fnord/Manifest b/www-servers/fnord/Manifest
new file mode 100644
index 000000000000..f8b38037ac59
--- /dev/null
+++ b/www-servers/fnord/Manifest
@@ -0,0 +1 @@
+DIST fnord-1.11.tar.bz2 28845 BLAKE2B 1f9ce7ca3476f03af0528f9ea6701be25babbd8a38398df3f87d1b1a18a28182a54bdfe814165ca6422f427bcdabd013f9eed2c1f178f0403829b38d618c2d08 SHA512 12a3751a2f98acb3ba2d468972bb785b656fa01bfb0828bc9ba5488dc7a2a66e9f226a6cc49ceda57aa7875d8d90954a9e79806c9506a7906cfff346cd400154
diff --git a/www-servers/fnord/files/fnord-1.10-gentoo.diff b/www-servers/fnord/files/fnord-1.10-gentoo.diff
new file mode 100644
index 000000000000..3e2f1f5fc7c4
--- /dev/null
+++ b/www-servers/fnord/files/fnord-1.10-gentoo.diff
@@ -0,0 +1,99 @@
+diff -Naur fnord-1.10.orig/fnord-conf fnord-1.10/fnord-conf
+--- fnord-1.10.orig/fnord-conf	2010-10-22 17:31:41.000000000 +0200
++++ fnord-1.10/fnord-conf	2010-10-22 19:57:28.000000000 +0200
+@@ -17,7 +17,7 @@
+ mkdir -p $dir
+ echo "#!/bin/sh" > $dir/run
+ echo "cd $webroot" >> $dir/run
+-echo "exec envuidgid $acct tcpserver -RHl localhost ${myip:-0} 80 fnord 2>&1" >> $dir/run
++echo "exec envuidgid $acct tcpserver -RHl localhost ${myip:-0} 80 /usr/bin/fnord 2>&1" >> $dir/run
+ chmod 755 $dir/run
+ 
+ # tell old daemontools that it should spawn a log process, too
+diff -Naur fnord-1.10.orig/httpd.c fnord-1.10/httpd.c
+--- fnord-1.10.orig/httpd.c	2010-10-22 17:31:41.000000000 +0200
++++ fnord-1.10/httpd.c	2010-10-22 19:57:28.000000000 +0200
+@@ -25,7 +25,9 @@
+ #include "scan.h"
+ 
+ /* uncomment the following line to enable support for CGI */
+-// #define CGI
++#ifndef CGI
++# define CGI
++#endif
+ 
+ #ifdef CGI
+ /* uncomment the following line to enable support for "index.cgi"
+@@ -39,7 +41,9 @@
+ 
+ /* uncomment the following line to enable support for autogenerated
+  * directory-listings for directories without index */
+-/* #define DIR_LIST */
++#ifndef DIR_LIST
++# define DIR_LIST
++#endif
+ 
+ #ifdef DIR_LIST
+ /* uncomment the following line to enable support for system symlink
+diff -Naur fnord-1.10.orig/Makefile fnord-1.10/Makefile
+--- fnord-1.10.orig/Makefile	2010-10-22 17:31:41.000000000 +0200
++++ fnord-1.10/Makefile	2010-10-22 19:58:56.000000000 +0200
+@@ -1,28 +1,19 @@
+-CC=gcc
+-CXX=g++
+-
+-#LIBOWFAT=../libowfat/
+-DIET=diet -Os
+-
+-CFLAGS=-Os -fomit-frame-pointer
+-#CFLAGS=-g
++CC:=gcc
++CXX:=g++
+ 
+ all: fnord fnord-cgi fnord-idx
+ 
+ fnord: httpd
+ 	cp -p $^ $@
+-	-strip -R .note -R .comment $@
+ 
+ httpd: httpd.o libowfat.a
+-	$(DIET) $(CC) -o $@ $^ $(CFLAGS)
++	$(DIET) $(CC) $(LDFLAGS) -o $@ $^ $(CFLAGS)
+ 
+ fnord-cgi: httpd-cgi.o libowfat.a
+-	$(DIET) $(CC) -o $@ $^ $(CFLAGS)
+-	-strip -R .note -R .comment $@
++	$(DIET) $(CC) $(LDFLAGS) -o $@ $^ $(CFLAGS)
+ 
+ fnord-idx: httpd-idx.o libowfat.a
+-	$(DIET) $(CC) -o $@ $^ $(CFLAGS)
+-	-strip -R .note -R .comment $@
++	$(DIET) $(CC) $(LDFLAGS) -o $@ $^ $(CFLAGS)
+ 
+ libowfat.a: httpd.o buffer_1.o buffer_puts.o buffer_flush.o buffer_put.o \
+ buffer_putulong.o buffer_2.o buffer_putspace.o buffer_stubborn.o \
+@@ -32,19 +23,19 @@
+ 	-ranlib $@
+ 
+ httpd.o: httpd.c
+-	$(DIET) $(CC) -pipe $(CFLAGS) -c $^ -DFNORD=\"fnord/$(shell head -n 1 CHANGES|sed 's/://')\"
++	$(DIET) $(CC) $(CFLAGS) -c $^ -DFNORD=\"fnord/$(shell head -n 1 CHANGES|sed 's/://')\"
+ 
+ httpd-cgi.o: httpd.c
+-	$(DIET) $(CC) -pipe $(CFLAGS) -c httpd.c -o $@ -DCGI -DFNORD=\"fnord/$(shell head -n 1 CHANGES|sed 's/://')\"
++	$(DIET) $(CC) $(CFLAGS) -c httpd.c -o $@ -DCGI -DFNORD=\"fnord/$(shell head -n 1 CHANGES|sed 's/://')\"
+ 
+ httpd-idx.o: httpd.c
+-	$(DIET) $(CC) -pipe $(CFLAGS) -c httpd.c -o $@ -DDIR_LIST -DFNORD=\"fnord/$(shell head -n 1 CHANGES|sed 's/://')\"
++	$(DIET) $(CC) $(CFLAGS) -c httpd.c -o $@ -DDIR_LIST -DFNORD=\"fnord/$(shell head -n 1 CHANGES|sed 's/://')\"
+ 
+ %.o: %.c
+-	$(DIET) $(CC) -pipe $(CFLAGS) -c $^
++	$(DIET) $(CC) $(CFLAGS) -c $^
+ 
+ %.o: %.cpp
+-	$(DIET) $(CXX) -pipe $(CFLAGS) -c $^
++	$(DIET) $(CXX) $(CFLAGS) -c $^
+ 
+ .PHONY: rename clean install server
+ server: fnord
diff --git a/www-servers/fnord/files/fnord-1.11-clang-16-build-fix.patch b/www-servers/fnord/files/fnord-1.11-clang-16-build-fix.patch
new file mode 100644
index 000000000000..5d841fb8879b
--- /dev/null
+++ b/www-servers/fnord/files/fnord-1.11-clang-16-build-fix.patch
@@ -0,0 +1,81 @@
+Bug: https://bugs.gentoo.org/887331
+--- a/buffer_1.c
++++ b/buffer_1.c
+@@ -2,6 +2,6 @@
+ #include "buffer.h"
+ 
+ char buffer_1_space[BUFFER_INSIZE];
+-static buffer it = BUFFER_INIT(write,1,buffer_1_space,sizeof buffer_1_space);
++static buffer it = BUFFER_INIT((void *)write,1,buffer_1_space,sizeof buffer_1_space);
+ buffer *buffer_1 = &it;
+ 
+--- a/buffer_2.c
++++ b/buffer_2.c
+@@ -2,6 +2,6 @@
+ #include "buffer.h"
+ 
+ char buffer_2_space[BUFFER_INSIZE];
+-static buffer it = BUFFER_INIT(write,2,buffer_2_space,sizeof buffer_2_space);
++static buffer it = BUFFER_INIT((void *)write,2,buffer_2_space,sizeof buffer_2_space);
+ buffer *buffer_2 = &it;
+ 
+--- a/byte.h
++++ b/byte.h
+@@ -1,7 +1,9 @@
+ #ifndef BYTE_H
+ #define BYTE_H
+ 
+-#include <sys/cdefs.h>
++#ifdef __cplusplus
++extern "C" {
++#endif
+ 
+ #ifndef __pure__
+ #define __pure__
+@@ -36,3 +38,6 @@ void byte_zero(void* out, unsigned len);
+ #define byte_equal(s,n,t) (!byte_diff((s),(n),(t)))
+ 
+ #endif
++#ifdef __cplusplus
++}
++#endif
+--- a/scan.h
++++ b/scan.h
+@@ -1,7 +1,9 @@
+ #ifndef SCAN_H
+ #define SCAN_H
+ 
+-#include <sys/cdefs.h>
++#ifdef __cplusplus
++extern "C" {
++#endif
+ #ifndef __pure__
+ #define __pure__
+ #endif
+@@ -59,3 +61,6 @@ extern unsigned int scan_charsetnskip(const char *in,const char *charset,unsigne
+ extern unsigned int scan_noncharsetnskip(const char *in,const char *charset,unsigned int limit) __pure__;
+ 
+ #endif
++#ifdef __cplusplus
++}
++#endif
+--- a/str.h
++++ b/str.h
+@@ -1,7 +1,9 @@
+ #ifndef STR_H
+ #define STR_H
+ 
+-#include <sys/cdefs.h>
++#ifdef __cplusplus
++extern "C" {
++#endif
+ #ifndef __pure__
+ #define __pure__
+ #endif
+@@ -41,3 +43,6 @@ extern int str_start(const char *a,const char *b) __pure__;
+ #define str_equal(s,t) (!str_diff((s),(t)))
+ 
+ #endif
++#ifdef __cplusplus
++}
++#endif
diff --git a/www-servers/fnord/fnord-1.11-r3.ebuild b/www-servers/fnord/fnord-1.11-r3.ebuild
new file mode 100644
index 000000000000..9dde61d26a3f
--- /dev/null
+++ b/www-servers/fnord/fnord-1.11-r3.ebuild
@@ -0,0 +1,43 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit flag-o-matic toolchain-funcs
+
+DESCRIPTION="Yet another small httpd"
+HOMEPAGE="https://www.fefe.de/fnord/"
+SRC_URI="https://www.fefe.de/fnord/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~hppa ~ppc ~riscv ~sparc x86"
+IUSE="auth"
+
+RDEPEND="
+	acct-group/nofiles
+	acct-user/fnord
+	acct-user/fnordlog
+	sys-apps/ucspi-tcp
+	virtual/daemontools
+"
+
+DOCS=( TODO README README.auth SPEED CHANGES )
+
+PATCHES=(
+	"${FILESDIR}/${PN}"-1.10-gentoo.diff
+	"${FILESDIR}/${PN}"-1.11-clang-16-build-fix.patch
+)
+
+src_compile() {
+	# Fix for bug #45716
+	use sparc && replace-sparc64-flags
+	use auth && append-flags -DAUTH
+
+	emake DIET="" CC=$(tc-getCC) CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}"
+}
+
+src_install() {
+	dobin fnord-conf fnord
+	einstalldocs
+}
diff --git a/www-servers/fnord/metadata.xml b/www-servers/fnord/metadata.xml
new file mode 100644
index 000000000000..4592441ac503
--- /dev/null
+++ b/www-servers/fnord/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <use>
+    <flag name="auth">Enable HTTP authentication support</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/gatling/Manifest b/www-servers/gatling/Manifest
new file mode 100644
index 000000000000..f422906b7320
--- /dev/null
+++ b/www-servers/gatling/Manifest
@@ -0,0 +1 @@
+DIST gatling-0.16.tar.xz 126844 BLAKE2B 33dd2e93833b216ffadae4dbd5650af87b23ed5d62caf181d8005acb4dce889b86d1afb711676377ba2b7c4fe08b8f2350a32965cf6292a268281b28c4310c27 SHA512 9446ea0ae862509b1a892e5bdef14d3a2320c3c3e846362b4679c0834aa906ab5b16ef54e4a7c8e7ee839d30317436dd411e891e3105035a9ee31b0facc0b8c1
diff --git a/www-servers/gatling/files/gatling-0.13-compile.patch b/www-servers/gatling/files/gatling-0.13-compile.patch
new file mode 100644
index 000000000000..a87a9541becb
--- /dev/null
+++ b/www-servers/gatling/files/gatling-0.13-compile.patch
@@ -0,0 +1,11 @@
+--- a/GNUmakefile
++++ b/GNUmakefile
+@@ -64,7 +64,7 @@
+ acc: acc.c
+ 	$(CC) -o $@ $< $(CFLAGS) $(LDFLAGS) -lowfat
+ 
+-CC:=$(DIET) $(CC)
++override CC:=$(DIET) $(CC)
+ 
+ pthreadbench: pthreadbench.o
+ 	$(CC) $< -o $@ -I. $(CFLAGS) $(LDFLAGS) $(LDLIBS) -lpthread
diff --git a/www-servers/gatling/files/gatling-0.15-ar.patch b/www-servers/gatling/files/gatling-0.15-ar.patch
new file mode 100644
index 000000000000..84b13293e426
--- /dev/null
+++ b/www-servers/gatling/files/gatling-0.15-ar.patch
@@ -0,0 +1,30 @@
+From 64933921d28aa96cbece18e43723117661a8056d Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 28 Nov 2020 20:33:21 +0100
+Subject: [PATCH] GNUmakefile: Respect variable AR
+
+GNU make comes with AR predefined:
+$ make -f <(echo $'.PHONY: all\nall:\n\t@echo "AR is \\"$(AR)\\"."')
+AR is "ar".
+
+Original bug report at https://bugs.gentoo.org/756850
+---
+ GNUmakefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/GNUmakefile b/GNUmakefile
+index 6af7b35..e6b32fe 100644
+--- a/GNUmakefile
++++ b/GNUmakefile
+@@ -195,7 +195,7 @@ dummy.c:
+ 	touch $@
+ 
+ libsocketkludge.a: libsocket libiconv dummy.o
+-	ar q $@ dummy.o
++	$(AR) q $@ dummy.o
+ 	-ranlib $@
+ 
+ LDLIBS+=`cat libsocket libiconv libcrypt`
+-- 
+2.27.0
+
diff --git a/www-servers/gatling/files/gatling-0.16-r4-0001-try-alloca-socket-fix-Wimplicit-int.patch b/www-servers/gatling/files/gatling-0.16-r4-0001-try-alloca-socket-fix-Wimplicit-int.patch
new file mode 100644
index 000000000000..4b22b7a5c13d
--- /dev/null
+++ b/www-servers/gatling/files/gatling-0.16-r4-0001-try-alloca-socket-fix-Wimplicit-int.patch
@@ -0,0 +1,41 @@
+From d1a28da112988112a37feb9050733717bfc176df Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Arsen=20Arsenovi=C4=87?= <arsen@aarsen.me>
+Date: Sun, 18 Sep 2022 19:48:16 +0200
+Subject: [PATCH] try{alloca,socket}: fix -Wimplicit-int
+
+This warning becomes fatal with Clang 16.
+---
+https://bugs.gentoo.org/871495
+ tryalloca.c | 2 +-
+ trysocket.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tryalloca.c b/tryalloca.c
+index c8927ab..b6e4f71 100644
+--- a/tryalloca.c
++++ b/tryalloca.c
+@@ -5,7 +5,7 @@
+ #include <malloc.h>
+ #endif
+ 
+-main() {
++int main() {
+   char* c=alloca(23);
+   return c!=NULL;
+ }
+diff --git a/trysocket.c b/trysocket.c
+index a01f395..381b794 100644
+--- a/trysocket.c
++++ b/trysocket.c
+@@ -6,7 +6,7 @@
+ #include <netinet/in.h>
+ #endif
+ 
+-main() {
++int main() {
+   int fd=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP);
+   return fd!=-1;
+ }
+-- 
+2.35.1
+
diff --git a/www-servers/gatling/files/gatling.confd b/www-servers/gatling/files/gatling.confd
new file mode 100644
index 000000000000..afbaecf80780
--- /dev/null
+++ b/www-servers/gatling/files/gatling.confd
@@ -0,0 +1,49 @@
+# /etc/conf.d/gatling
+
+# UID to run gatling server on
+GATLING_UID="gatling"
+
+# Bind to IP address
+IP="127.0.0.1"
+
+# Root directory
+ROOTDIR="/var/www"
+
+# Bind to Port
+PORT="80"
+
+# HTTP timeout
+HTTP_TIMEOUT="23"
+
+# Gatling pid file
+PID="/var/run/gatling.pid"
+
+# Virtual domain hosting
+VHOST="NO"
+
+# Directory indexing
+DIR_INDEXING="NO"
+
+# Secure Socket Connections SSL
+SSL="NO"
+
+# Prefetch value (see man page for details)
+PREFETCH="2M"
+
+# FTP access 
+FTP="YES"
+
+# FTP timeout
+FTP_TIMEOUT="60"
+
+# FTP User Authorization
+FTP_AUTH="YES"
+
+# FTP file uploads
+FTP_UP="NO"
+
+# Enable ftp file downloads
+FTP_FILE_FETCH="YES"
+
+# Transparent proxy mode
+TRANS_PROXY="YES"
diff --git a/www-servers/gatling/files/gatling.initd-3 b/www-servers/gatling/files/gatling.initd-3
new file mode 100644
index 000000000000..33c5e5a3095f
--- /dev/null
+++ b/www-servers/gatling/files/gatling.initd-3
@@ -0,0 +1,63 @@
+#!/sbin/openrc-run
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="Gatling high performance web server init script"
+extra_started_commands="reload"
+
+depend() { 
+	need net
+}
+
+checkconfig() {
+	# Verify UID is valid for running process.
+	if [ ! "$(id ${GATLING_UID} 2>/dev/null)" ]; then
+		ewarn "User ${GATLING_UID} not found!"
+		return 1
+	fi
+
+	# Set gatling run opts
+	if yesno ${VHOST};then VHOST=-v;else VHOST=-V;fi
+	if yesno ${SSL};then SSL=-e;else SSL=-E;fi
+	if yesno ${DIR_INDEXING};then DIR_INDEXING=-d;else DIR_INDEXING=-D;fi
+	if yesno ${FTP}; then FTP=-f;else FTP=-F;fi
+	if yesno ${FTP_AUTH}; then FTP_AUTH=-l;else unset FTP_AUTH;fi
+	if yesno ${FTP_UP};then unset FTP_UP;else FTP_UP=-U;fi
+        if yesno ${TRANS_PROXY};then TRANS_PROXY=-t;else unset TRANS_PROXY;fi
+}
+
+start() {
+	checkconfig || return 1
+
+	ebegin "Starting gatling"
+	start-stop-daemon --start --quiet --background --make-pidfile --pidfile ${PID} \
+--name gatling --exec /usr/bin/gatling -- -T ${HTTP_TIMEOUT} -i ${IP} -p ${PORT} -P ${PREFETCH} \
+${VHOST} -c ${ROOTDIR} ${DIR_INDEXING} ${TRANS_PROXY} -u ${GATLING_UID} ${FTP} -T ${FTP_TIMEOUT} \
+${FTP_AUTH} ${FTP_UPLOADS} 
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping gatling"
+	start-stop-daemon --quiet --stop --pidfile ${PID} 
+	eend $?
+}
+
+reload() {
+        if ! service_started "${SVCNAME}" ; then
+                eerror "${SVCNAME} isn't running"
+                return 1
+        fi
+
+	checkconfig || return 1
+
+	ebegin "Sending gatling the HUP signal"
+	start-stop-daemon --quiet --signal HUP --pidfile ${PID}
+
+	ebegin "Restarting gatling server"
+        start-stop-daemon --start --quiet --background --make-pidfile --pidfile ${PID} \
+--name gatling --exec /usr/bin/gatling -- -T ${HTTP_TIMEOUT} -i ${IP} -p ${PORT} -P ${PREFETCH} \
+${VHOST} -c ${ROOTDIR} ${DIR_INDEXING} ${TRANS_PROXY} -u ${GATLING_UID} ${FTP} -T ${FTP_TIMEOUT} \
+${FTP_AUTH} ${FTP_UPLOADS}
+        eend $?
+}
diff --git a/www-servers/gatling/gatling-0.16-r6.ebuild b/www-servers/gatling/gatling-0.16-r6.ebuild
new file mode 100644
index 000000000000..a7014fbb4171
--- /dev/null
+++ b/www-servers/gatling/gatling-0.16-r6.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit flag-o-matic toolchain-funcs
+
+DESCRIPTION="High performance web server"
+HOMEPAGE="https://www.fefe.de/gatling/"
+SRC_URI="https://www.fefe.de/gatling/${P}.tar.xz"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+IUSE="ssl diet"
+REQUIRED_USE="ssl? ( !diet )"
+
+DEPEND=">=dev-libs/libowfat-0.32-r2[diet=]
+	virtual/zlib:=
+	virtual/libcrypt:=
+	diet? ( dev-libs/dietlibc )
+	ssl? (
+		dev-libs/openssl:0=
+	)"
+RDEPEND="${DEPEND}
+	acct-group/gatling
+	acct-user/gatling
+	"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.13-compile.patch"
+	"${FILESDIR}/${PN}-0.15-ar.patch"
+	"${FILESDIR}/${PN}-0.16-r4-0001-try-alloca-socket-fix-Wimplicit-int.patch"
+)
+
+src_prepare() {
+	default
+	rm Makefile  # leaves us with GNUmakefile
+}
+
+src_compile() {
+	# -Werror=lto-type-mismatch
+	# https://bugs.gentoo.org/864133
+	#
+	# Last released in 2016, sources are in cvs so I cannot check for activity.
+	filter-lto
+
+	local DIET=
+	use diet && DIET='/usr/bin/diet'
+
+	local targets='gatling'
+	use ssl && targets+=' tlsgatling'
+
+	emake DIET="${DIET}" CC="$(tc-getCC)" \
+			CFLAGS="${CFLAGS} -I${ESYSROOT}/usr/include/libowfat" \
+			LDFLAGS="${LDFLAGS}" prefix=/usr ${targets}
+}
+
+src_install() {
+	doman gatling.1
+
+	newconfd "${FILESDIR}/gatling.confd" gatling
+	newinitd "${FILESDIR}/gatling.initd-3" gatling
+	dodoc README.{ftp,http}
+
+	dobin gatling
+	use ssl && {
+		dodoc README.tls
+		dobin tlsgatling
+	}
+}
diff --git a/www-servers/gatling/metadata.xml b/www-servers/gatling/metadata.xml
new file mode 100644
index 000000000000..612a74553092
--- /dev/null
+++ b/www-servers/gatling/metadata.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>patrick@gentoo.org</email>
+    <name>Patrick Lauer</name>
+  </maintainer>
+  <maintainer type="person">
+    <email>sping@gentoo.org</email>
+    <name>Sebastian Pipping</name>
+  </maintainer>
+  <use>
+    <flag name="diet">Compile against <pkg>dev-libs/dietlibc</pkg>
+    </flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/gunicorn/Manifest b/www-servers/gunicorn/Manifest
new file mode 100644
index 000000000000..14d53cbb6993
--- /dev/null
+++ b/www-servers/gunicorn/Manifest
@@ -0,0 +1,2 @@
+DIST gunicorn-25.3.0.gh.tar.gz 690098 BLAKE2B 6408f87d5bcd37bac7b5223892d2c3c6e3efe20061d6e9b193d3706a7fac6a8f068ad334f0f614d7dbd60bc0732ac26d53dd8d0ac6f58906e10468f7f505d59a SHA512 24c3d3a77fcfc2deec67601e36ae112eedb5ce5ba3eef56d07eb75e3f084186bdfef48de7d5d2daaea46bd776a59a1129f89a0940c4ed447370922e9faf08cfb
+DIST gunicorn-26.0.0.gh.tar.gz 749564 BLAKE2B 01e7ff9c5fe41825e8158d7d8372cd2cb5983d24d365adb4f850bf7940d711c3409525e9713f4818e2e511573b9d7d209ccde2398fa7d9b0bb596be48bd8af36 SHA512 a2bdce4858b32d55cd7adeb4dd8cc4da20b2781d2ef792c5e845c5a8ed6d7ce402f2de8807a2f54a80310a46cd7d3abd5e73211b393174f94f08e90f595f9d9a
diff --git a/www-servers/gunicorn/gunicorn-25.3.0.ebuild b/www-servers/gunicorn/gunicorn-25.3.0.ebuild
new file mode 100644
index 000000000000..74332824b763
--- /dev/null
+++ b/www-servers/gunicorn/gunicorn-25.3.0.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="A WSGI HTTP Server for UNIX"
+HOMEPAGE="
+	https://gunicorn.org/
+	https://github.com/benoitc/gunicorn/
+	https://pypi.org/project/gunicorn/
+"
+SRC_URI="
+	https://github.com/benoitc/gunicorn/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT PSF-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos"
+
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	dev-python/setproctitle[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		>=dev-python/h2-4.1.0[${PYTHON_USEDEP}]
+		dev-python/httpx[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-asyncio )
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_IGNORE=(
+		# removed deps
+		tests/workers/test_geventlet.py
+		tests/workers/test_ggevent.py
+	)
+
+	epytest -o addopts=
+}
diff --git a/www-servers/gunicorn/gunicorn-26.0.0.ebuild b/www-servers/gunicorn/gunicorn-26.0.0.ebuild
new file mode 100644
index 000000000000..92b022aaa5a0
--- /dev/null
+++ b/www-servers/gunicorn/gunicorn-26.0.0.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="A WSGI HTTP Server for UNIX"
+HOMEPAGE="
+	https://gunicorn.org/
+	https://github.com/benoitc/gunicorn/
+	https://pypi.org/project/gunicorn/
+"
+SRC_URI="
+	https://github.com/benoitc/gunicorn/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT PSF-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	dev-python/setproctitle[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		>=dev-python/h2-4.1.0[${PYTHON_USEDEP}]
+		dev-python/httpx[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-asyncio )
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_IGNORE=(
+		# removed deps
+		tests/workers/test_ggevent.py
+	)
+
+	epytest -o addopts=
+}
diff --git a/www-servers/gunicorn/metadata.xml b/www-servers/gunicorn/metadata.xml
new file mode 100644
index 000000000000..055d738009cc
--- /dev/null
+++ b/www-servers/gunicorn/metadata.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>python@gentoo.org</email>
+    <name>Python</name>
+  </maintainer>
+  <stabilize-allarches />
+  <longdescription lang="en">
+		Gunicorn 'Green Unicorn' is a Python WSGI HTTP Server for UNIX. It's a
+		pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn
+		server is broadly compatible with various web frameworks, simply
+		implemented, light on server resources, and fairly speedy.
+	</longdescription>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:gunicorn:gunicorn</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/h2o/Manifest b/www-servers/h2o/Manifest
new file mode 100644
index 000000000000..0e6f9afc2687
--- /dev/null
+++ b/www-servers/h2o/Manifest
@@ -0,0 +1,2 @@
+DIST h2o-2.3.0_pre20250130.tar.gz 30811885 BLAKE2B e40c59c9fc010412e613bd8059108f88b554131afd64a832c6e2db3ee0a9aa01b14451abee680d91b430a47550f32897dde367b86ee48397029d4b7890258e0e SHA512 3d855ed1571e11fb6b0ed3b0f85cd26a015448347423eb0b994f8803b23c73bf7b773b0d84b6a2b70f08c314496488ad02f358a2269478e86da18fc983c26ae1
+DIST h2o-2.3.0_pre20260415.tar.gz 30867198 BLAKE2B 89c4458c2b3ebebd97b8218bd8786cdd8051a1300090fc6a25cf69c0885004458e76ae6600efd76b993db8eb6716ddddf85668c77788f72e923ae38f00e62d05 SHA512 7dfd7bd381d731d3bc92d75a044bb601ae0d528608f7523a0600d2c472fd01e22c566c4d0e6b1379cb9a81657dba1830edb412f2e5714d32611cd341c590a91a
diff --git a/www-servers/h2o/files/h2o-2.3-mruby.patch b/www-servers/h2o/files/h2o-2.3-mruby.patch
new file mode 100644
index 000000000000..a0e9f12b935b
--- /dev/null
+++ b/www-servers/h2o/files/h2o-2.3-mruby.patch
@@ -0,0 +1,70 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -239,6 +239,19 @@ IF (NOT WSLAY_FOUND)
+     SET(WSLAY_LIBRARIES -lwslay)
+ ENDIF (NOT WSLAY_FOUND)
+ 
++IF (PKG_CONFIG_FOUND)
++    PKG_CHECK_MODULES(ONIG onigmo)
++    IF (NOT ONIG_FOUND)
++        PKG_CHECK_MODULES(ONIG oniguruma)
++    ENDIF (NOT ONIG_FOUND)
++    IF (ONIG_FOUND)
++        LINK_DIRECTORIES(${ONIG_LIBRARY_DIRS})
++    ENDIF (ONIG_FOUND)
++ENDIF (PKG_CONFIG_FOUND)
++IF (NOT ONIG_FOUND AND WITH_MRUBY)
++    MESSAGE(FATAL_ERROR "Onigmo/Oniguruma not found")
++ENDIF (NOT ONIG_FOUND AND WITH_MRUBY)
++
+ IF (ZLIB_FOUND)
+     INCLUDE_DIRECTORIES(${ZLIB_INCLUDE_DIRS})
+     LINK_DIRECTORIES(${ZLIB_LIBRARY_DIRS})
+@@ -761,7 +774,7 @@ IF (WITH_MRUBY)
+     ADD_CUSTOM_TARGET(mruby
+         # deps/mruby/tasks/toolchains/clang.rake looks for CC, CXX and LD.
+         # There are no C++ files in deps/mruby, use the C compiler for linking.
+-        MRUBY_TOOLCHAIN=${MRUBY_TOOLCHAIN} CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER} LD=${CMAKE_C_COMPILER} MRUBY_CONFIG=${CMAKE_CURRENT_SOURCE_DIR}/misc/mruby_config.rb MRUBY_BUILD_DIR=${CMAKE_CURRENT_BINARY_DIR}/mruby MRUBY_ADDITIONAL_CONFIG=${MRUBY_ADDITIONAL_CONFIG} INSTALL_DIR=${CMAKE_CURRENT_BINARY_DIR}/mruby-bin ruby minirake
++        MRUBY_TOOLCHAIN=${MRUBY_TOOLCHAIN} CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER} LD=${CMAKE_C_COMPILER} MRUBY_CONFIG=${CMAKE_CURRENT_SOURCE_DIR}/misc/mruby_config.rb MRUBY_BUILD_DIR=${CMAKE_CURRENT_BINARY_DIR}/mruby MRUBY_ADDITIONAL_CONFIG=${MRUBY_ADDITIONAL_CONFIG} INSTALL_DIR=${CMAKE_CURRENT_BINARY_DIR}/mruby-bin ruby minirake -v
+         WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/deps/mruby
+         BYPRODUCTS "${CMAKE_CURRENT_BINARY_DIR}/mruby/host/lib/libmruby.a"
+                    "${CMAKE_CURRENT_BINARY_DIR}/mruby/host/mrbgems/mruby-onig-regexp/onigmo-6.2.0/.libs/libonigmo.a"
+@@ -795,7 +808,7 @@ IF (WITH_MRUBY)
+     # note: the paths need to be determined before libmruby.flags.mak is generated
+     TARGET_LINK_LIBRARIES(h2o
+         "${CMAKE_CURRENT_BINARY_DIR}/mruby/host/lib/libmruby.a"
+-        "${CMAKE_CURRENT_BINARY_DIR}/mruby/host/mrbgems/mruby-onig-regexp/onigmo-6.2.0/.libs/libonigmo.a"
++        ${ONIG_LIBRARIES}
+         "m")
+     ADD_DEPENDENCIES(h2o mruby)
+ ENDIF (WITH_MRUBY)
+--- a/deps/mruby-onig-regexp/mrbgem.rake
++++ b/deps/mruby-onig-regexp/mrbgem.rake
+@@ -108,10 +108,8 @@ MRuby::Gem::Specification.new('mruby-onig-regexp') do |spec|
+ 
+   if spec.respond_to? :search_package and spec.search_package 'onigmo'
+     spec.cc.defines += ['HAVE_ONIGMO_H']
+-    spec.linker.libraries << 'onigmo'
+   elsif spec.respond_to? :search_package and spec.search_package 'oniguruma'
+     spec.cc.defines += ['HAVE_ONIGURUMA_H']
+-    spec.linker.libraries << 'onig'
+   elsif build.cc.respond_to? :search_header_path and build.cc.search_header_path 'onigmo.h'
+     spec.cc.defines += ['HAVE_ONIGMO_H']
+     spec.linker.libraries << 'onigmo'
+--- a/misc/mruby_config.rb
++++ b/misc/mruby_config.rb
+@@ -17,13 +17,7 @@ MRuby::Build.new do |conf|
+   # use mrbgems
+   Dir.glob("../mruby-*/mrbgem.rake") do |x|
+     g = File.basename File.dirname x
+-    if g == 'mruby-onig-regexp'
+-      conf.gem "../deps/#{g}" do |c|
+-        c.bundle_onigmo
+-      end
+-    else
+-      conf.gem "../deps/#{g}"
+-    end
++    conf.gem "../deps/#{g}"
+   end
+ 
+   # include all the core GEMs
diff --git a/www-servers/h2o/files/h2o.conf b/www-servers/h2o/files/h2o.conf
new file mode 100644
index 000000000000..23f2d76d51ee
--- /dev/null
+++ b/www-servers/h2o/files/h2o.conf
@@ -0,0 +1,17 @@
+user: h2o
+pid-file: /run/h2o.pid
+access-log: /var/log/h2o/access.log
+error-log: /var/log/h2o/error.log
+
+hosts:
+  "localhost":
+    listen:
+      port: 80
+    listen:
+      port: 443
+      ssl:
+        certificate-file: /etc/ssl/h2o/server.crt
+        key-file: /etc/ssl/h2o/server.key
+    paths:
+      "/":
+        file.dir: /var/www/localhost/htdocs
diff --git a/www-servers/h2o/files/h2o.initd b/www-servers/h2o/files/h2o.initd
new file mode 100644
index 000000000000..61944ccc5552
--- /dev/null
+++ b/www-servers/h2o/files/h2o.initd
@@ -0,0 +1,37 @@
+#!/sbin/openrc-run
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="checkconfig"
+extra_started_commands="reload"
+
+description_checkconfig="Check the configuration file"
+description_reload="Reload the configuration file"
+
+: ${h2o_config:="/etc/${RC_SVCNAME}/${RC_SVCNAME}.conf"}
+
+start_stop_daemon_args="--group ${RC_SVCNAME}"
+command="/usr/bin/${RC_SVCNAME}"
+command_args="-m daemon -c \"${h2o_config}\""
+pidfile="$(grep pid-file "${h2o_config}" | cut -d' ' -f2)"
+name="H2O"
+
+depend() {
+	need net
+	use dns
+}
+
+checkconfig() {
+	"${command}" -m test -c "${h2o_config}" || return 1
+}
+
+start_pre() {
+	checkconfig || return 1
+}
+
+reload() {
+	checkconfig || return 1
+	ebegin "Reloading ${name:-${RC_SVCNAME}}"
+	start-stop-daemon --signal HUP --pidfile "${pidfile}"
+	eend ${?}
+}
diff --git a/www-servers/h2o/files/h2o.logrotate b/www-servers/h2o/files/h2o.logrotate
new file mode 100644
index 000000000000..166b6e7f17b7
--- /dev/null
+++ b/www-servers/h2o/files/h2o.logrotate
@@ -0,0 +1,11 @@
+# h2o logrotate script for Gentoo
+
+/var/log/h2o/*.log {
+	missingok
+	notifempty
+	sharedscripts
+	delaycompress
+	postrotate
+		/bin/kill -HUP $(grep pid-file "/etc/h2o/h2o.conf" | cut -d' ' -f2 | cat) 2>/dev/null || true
+	endscript
+}
diff --git a/www-servers/h2o/files/h2o.service b/www-servers/h2o/files/h2o.service
new file mode 100644
index 000000000000..0ea3f45fec44
--- /dev/null
+++ b/www-servers/h2o/files/h2o.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=H2O - the optimized HTTP/1, HTTP/2 server
+After=network.target remote-fs.target nss-lookup.target
+
+[Service]
+ExecStartPre=/usr/bin/h2o -m test -c /etc/h2o/h2o.conf
+ExecStart=/usr/bin/h2o -m master -c /etc/h2o/h2o.conf
+ExecReload=/bin/kill -HUP ${MAINPID}
+ExecStop=/bin/kill -TERM ${MAINPID}
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/www-servers/h2o/h2o-2.3.0_pre20250130.ebuild b/www-servers/h2o/h2o-2.3.0_pre20250130.ebuild
new file mode 100644
index 000000000000..e0db717df84c
--- /dev/null
+++ b/www-servers/h2o/h2o-2.3.0_pre20250130.ebuild
@@ -0,0 +1,115 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+SSL_DEPS_SKIP=1
+USE_RUBY="ruby31 ruby32 ruby33"
+
+inherit cmake flag-o-matic ruby-single ssl-cert systemd toolchain-funcs vcs-snapshot
+
+EGIT_COMMIT="26b116e9536be8cf07036185e3edf9d721c9bac2"
+
+DESCRIPTION="H2O - the optimized HTTP/1, HTTP/2 server"
+HOMEPAGE="https://h2o.examp1e.net/"
+SRC_URI="https://github.com/${PN}/${PN}/archive/${EGIT_COMMIT}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE="libh2o +mruby"
+
+RDEPEND="acct-group/h2o
+	acct-user/h2o
+	dev-lang/perl
+	dev-libs/openssl:0=
+	!sci-libs/libh2o
+	sys-libs/libcap
+	virtual/zlib:=
+	libh2o? (
+		app-arch/brotli
+		dev-libs/libuv
+	)"
+DEPEND="${RDEPEND}
+	mruby? (
+		${RUBY_DEPS}
+		|| (
+			dev-libs/onigmo
+			dev-libs/oniguruma
+		)
+	)"
+BDEPEND="virtual/pkgconfig
+	mruby? ( app-alternatives/yacc )"
+
+PATCHES=( "${FILESDIR}"/${PN}-2.3-mruby.patch )
+
+src_prepare() {
+	cmake_src_prepare
+
+	local ruby="ruby"
+	if use mruby; then
+		for ruby in ${RUBY_TARGETS_PREFERENCE}; do
+			if has_version dev-lang/ruby:${ruby:4:1}.${ruby:5}; then
+				break
+			fi
+			ruby=
+		done
+		[[ -z ${ruby} ]] && die "no suitable ruby version found"
+	fi
+
+	sed -i \
+		-e "/INSTALL/s:\(/doc/${PN}\) :\1/html :" \
+		-e "/INSTALL/s:\(/doc\)/${PN}:\1/${PF}:" \
+		-e "s: ruby: ${ruby}:" \
+		CMakeLists.txt
+
+	sed -i "s:pkg-config:$(tc-getPKG_CONFIG):g" deps/mruby/lib/mruby/gem.rb
+	tc-export CC
+	export LD="$(tc-getCC)"
+}
+
+src_configure() {
+	if use libh2o; then
+		# -Werror=strict-aliasing
+		# https://bugs.gentoo.org/967654
+		# https://github.com/h2o/h2o/issues/3541
+		#
+		# Fixed upstream in git, post 2.3.0-beta2
+		append-flags -fno-strict-aliasing
+		filter-lto
+	fi
+
+	local mycmakeargs=(
+		-DCMAKE_INSTALL_SYSCONFDIR="${EPREFIX}"/etc/${PN}
+		-DWITH_CCACHE=OFF
+		-DWITH_MRUBY=$(usex mruby)
+		-DWITHOUT_LIBS=$(usex !libh2o)
+		-DBUILD_SHARED_LIBS=$(usex libh2o)
+	)
+	cmake_src_configure
+}
+
+src_install() {
+	cmake_src_install
+
+	keepdir /var/www/localhost/htdocs
+
+	insinto /etc/${PN}
+	doins "${FILESDIR}"/${PN}.conf
+
+	newinitd "${FILESDIR}"/${PN}.initd ${PN}
+	systemd_dounit "${FILESDIR}"/${PN}.service
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/${PN}.logrotate ${PN}
+
+	keepdir /var/log/${PN}
+	fowners ${PN}:${PN} /var/log/${PN}
+	fperms 0750 /var/log/${PN}
+}
+
+pkg_postinst() {
+	if [[ ! -f "${EROOT}"/etc/ssl/${PN}/server.key ]]; then
+		install_cert /etc/ssl/${PN}/server
+		chown ${PN}:${PN} "${EROOT}"/etc/ssl/${PN}/server.*
+	fi
+}
diff --git a/www-servers/h2o/h2o-2.3.0_pre20260415.ebuild b/www-servers/h2o/h2o-2.3.0_pre20260415.ebuild
new file mode 100644
index 000000000000..c9c1e0d43938
--- /dev/null
+++ b/www-servers/h2o/h2o-2.3.0_pre20260415.ebuild
@@ -0,0 +1,105 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+SSL_DEPS_SKIP=1
+USE_RUBY="ruby32 ruby33"
+
+inherit cmake ruby-single ssl-cert systemd toolchain-funcs vcs-snapshot
+
+EGIT_COMMIT="4aa96860e99cc2a2e2777433949bb05aed678ebe"
+
+DESCRIPTION="H2O - the optimized HTTP/1, HTTP/2 server"
+HOMEPAGE="https://h2o.examp1e.net/"
+SRC_URI="https://github.com/${PN}/${PN}/archive/${EGIT_COMMIT}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="libh2o +mruby"
+
+RDEPEND="acct-group/h2o
+	acct-user/h2o
+	dev-lang/perl
+	dev-libs/openssl:0=
+	!sci-libs/libh2o
+	sys-libs/libcap
+	virtual/zlib:=
+	libh2o? (
+		app-arch/brotli
+		dev-libs/libuv
+	)"
+DEPEND="${RDEPEND}
+	mruby? (
+		${RUBY_DEPS}
+		|| (
+			dev-libs/onigmo
+			dev-libs/oniguruma
+		)
+	)"
+BDEPEND="virtual/pkgconfig
+	mruby? ( app-alternatives/yacc )"
+
+PATCHES=( "${FILESDIR}"/${PN}-2.3-mruby.patch )
+
+src_prepare() {
+	cmake_src_prepare
+
+	local ruby="ruby"
+	if use mruby; then
+		for ruby in ${RUBY_TARGETS_PREFERENCE}; do
+			if has_version dev-lang/ruby:${ruby:4:1}.${ruby:5}; then
+				break
+			fi
+			ruby=
+		done
+		[[ -z ${ruby} ]] && die "no suitable ruby version found"
+	fi
+
+	sed -i \
+		-e "/INSTALL/s:\(/doc/${PN}\) :\1/html :" \
+		-e "/INSTALL/s:\(/doc\)/${PN}:\1/${PF}:" \
+		-e "s: ruby: ${ruby}:" \
+		CMakeLists.txt
+
+	sed -i "s:pkg-config:$(tc-getPKG_CONFIG):g" deps/mruby/lib/mruby/gem.rb
+	tc-export CC
+	export LD="$(tc-getCC)"
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_INSTALL_SYSCONFDIR="${EPREFIX}"/etc/${PN}
+		-DWITH_CCACHE=OFF
+		-DWITH_MRUBY=$(usex mruby)
+		-DWITHOUT_LIBS=$(usex !libh2o)
+		-DBUILD_SHARED_LIBS=$(usex libh2o)
+	)
+	cmake_src_configure
+}
+
+src_install() {
+	cmake_src_install
+
+	keepdir /var/www/localhost/htdocs
+
+	insinto /etc/${PN}
+	doins "${FILESDIR}"/${PN}.conf
+
+	newinitd "${FILESDIR}"/${PN}.initd ${PN}
+	systemd_dounit "${FILESDIR}"/${PN}.service
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/${PN}.logrotate ${PN}
+
+	keepdir /var/log/${PN}
+	fowners ${PN}:${PN} /var/log/${PN}
+	fperms 0750 /var/log/${PN}
+}
+
+pkg_postinst() {
+	if [[ ! -f "${EROOT}"/etc/ssl/${PN}/server.key ]]; then
+		install_cert /etc/ssl/${PN}/server
+		chown ${PN}:${PN} "${EROOT}"/etc/ssl/${PN}/server.*
+	fi
+}
diff --git a/www-servers/h2o/h2o-9999.ebuild b/www-servers/h2o/h2o-9999.ebuild
new file mode 100644
index 000000000000..c78115c9db30
--- /dev/null
+++ b/www-servers/h2o/h2o-9999.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+SSL_DEPS_SKIP=1
+USE_RUBY="ruby31 ruby32 ruby33"
+
+inherit cmake git-r3 ruby-single ssl-cert systemd toolchain-funcs
+
+DESCRIPTION="H2O - the optimized HTTP/1, HTTP/2 server"
+HOMEPAGE="https://h2o.examp1e.net/"
+EGIT_REPO_URI="https://github.com/${PN}/${PN}.git"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS=""
+IUSE="libh2o +mruby"
+
+RDEPEND="acct-group/h2o
+	acct-user/h2o
+	dev-lang/perl
+	dev-libs/openssl:0=
+	!sci-libs/libh2o
+	sys-libs/libcap
+	virtual/zlib:=
+	libh2o? (
+		app-arch/brotli
+		dev-libs/libuv
+	)"
+DEPEND="${RDEPEND}
+	mruby? (
+		${RUBY_DEPS}
+		|| (
+			dev-libs/onigmo
+			dev-libs/oniguruma
+		)
+	)"
+BDEPEND="virtual/pkgconfig
+	mruby? ( app-alternatives/yacc )"
+
+PATCHES=( "${FILESDIR}"/${PN}-2.3-mruby.patch )
+
+src_prepare() {
+	cmake_src_prepare
+
+	local ruby="ruby"
+	if use mruby; then
+		for ruby in ${RUBY_TARGETS_PREFERENCE}; do
+			if has_version dev-lang/ruby:${ruby:4:1}.${ruby:5}; then
+				break
+			fi
+			ruby=
+		done
+		[[ -z ${ruby} ]] && die "no suitable ruby version found"
+	fi
+
+	sed -i \
+		-e "/INSTALL/s:\(/doc/${PN}\) :\1/html :" \
+		-e "/INSTALL/s:\(/doc\)/${PN}:\1/${PF}:" \
+		-e "s: ruby: ${ruby}:" \
+		CMakeLists.txt
+
+	sed -i "s:pkg-config:$(tc-getPKG_CONFIG):g" deps/mruby/lib/mruby/gem.rb
+	tc-export CC
+	export LD="$(tc-getCC)"
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_INSTALL_SYSCONFDIR="${EPREFIX}"/etc/${PN}
+		-DWITH_CCACHE=OFF
+		-DWITH_MRUBY=$(usex mruby)
+		-DWITHOUT_LIBS=$(usex !libh2o)
+		-DBUILD_SHARED_LIBS=$(usex libh2o)
+	)
+	cmake_src_configure
+}
+
+src_install() {
+	cmake_src_install
+
+	keepdir /var/www/localhost/htdocs
+
+	insinto /etc/${PN}
+	doins "${FILESDIR}"/${PN}.conf
+
+	newinitd "${FILESDIR}"/${PN}.initd ${PN}
+	systemd_dounit "${FILESDIR}"/${PN}.service
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/${PN}.logrotate ${PN}
+
+	keepdir /var/log/${PN}
+	fowners ${PN}:${PN} /var/log/${PN}
+	fperms 0750 /var/log/${PN}
+}
+
+pkg_postinst() {
+	if [[ ! -f "${EROOT}"/etc/ssl/${PN}/server.key ]]; then
+		install_cert /etc/ssl/${PN}/server
+		chown ${PN}:${PN} "${EROOT}"/etc/ssl/${PN}/server.*
+	fi
+}
diff --git a/www-servers/h2o/metadata.xml b/www-servers/h2o/metadata.xml
new file mode 100644
index 000000000000..148bd366cac0
--- /dev/null
+++ b/www-servers/h2o/metadata.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>hattya@gentoo.org</email>
+    <name>Akinori Hattori</name>
+  </maintainer>
+  <longdescription lang="en">
+		H2O is a new generation HTTP server. Not only is it very fast,
+		it also provides much quicker response to end-users
+		when compared to older generations of HTTP servers.
+	</longdescription>
+  <use>
+    <flag name="libh2o">Build and install libh2o</flag>
+    <flag name="mruby">Enable support for mruby</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/kore/Manifest b/www-servers/kore/Manifest
new file mode 100644
index 000000000000..f5b62e48a5b4
--- /dev/null
+++ b/www-servers/kore/Manifest
@@ -0,0 +1 @@
+DIST kore-4.3.0_rc4.gh.tar.gz 1090477 BLAKE2B 34965ca7790e3163345ab6d367b7decc93fbf06504d3742ffa73773dc9c3d4e4e074a0dfe171d684f7528ff2edbf8d8b7679d0f71ef6717414755411f3275718 SHA512 2f0b57d2502fc2adb62dbcd74bd5463a446c9ee80786b952a5dbb4293d696ca0977e3b6e8ce44d8cf85a6bdf3153d6ba49a2618a58125bb7630a8b66b85875cc
diff --git a/www-servers/kore/files/kore-4.2.3-kodev-makefile.patch b/www-servers/kore/files/kore-4.2.3-kodev-makefile.patch
new file mode 100644
index 000000000000..e1e0fe1fd75e
--- /dev/null
+++ b/www-servers/kore/files/kore-4.2.3-kodev-makefile.patch
@@ -0,0 +1,22 @@
+--- a/kodev/Makefile
++++ b/kodev/Makefile
+@@ -9,16 +9,16 @@ INSTALL_DIR=$(PREFIX)/bin
+ 
+ S_SRC=	../src/cli.c
+ 
+-CFLAGS+=-Wall -Werror -Wstrict-prototypes -Wmissing-prototypes
++CFLAGS+=-Wall -Wstrict-prototypes -Wmissing-prototypes
+ CFLAGS+=-Wmissing-declarations -Wshadow -Wpointer-arith -Wcast-qual
+ CFLAGS+=-Wsign-compare -Iincludes -std=c99 -pedantic
+ CFLAGS+=-DPREFIX='"$(PREFIX)"'
+-LDFLAGS=-lcrypto
++LDFLAGS+=-lcrypto
+ 
+ ifneq ("$(NOOPT)", "")
+ 	CFLAGS+=-O0
+ else
+-	CFLAGS+=-O2
++	CFLAGS+=
+ endif
+ 
+ ifneq ("$(MINIMAL)", "")
diff --git a/www-servers/kore/files/kore-4.2.3-makefile.patch b/www-servers/kore/files/kore-4.2.3-makefile.patch
new file mode 100644
index 000000000000..e8a94f8aecab
--- /dev/null
+++ b/www-servers/kore/files/kore-4.2.3-makefile.patch
@@ -0,0 +1,34 @@
+--- a/Makefile
++++ b/Makefile
+@@ -31,11 +31,11 @@ S_SRC+= src/tls_$(TLS_BACKEND).c
+ FEATURES=
+ FEATURES_INC=
+ 
+-CFLAGS+=-Wall -Werror -Wstrict-prototypes -Wmissing-prototypes
++CFLAGS+=-Wall -Wstrict-prototypes -Wmissing-prototypes
+ CFLAGS+=-Wmissing-declarations -Wshadow -Wpointer-arith -Wcast-qual
+ CFLAGS+=-Wsign-compare -Iinclude/kore -I$(OBJDIR) -std=c99 -pedantic
+ CFLAGS+=-Wtype-limits -fno-common
+-CFLAGS+=-DPREFIX='"$(PREFIX)"' -fstack-protector-all
++CFLAGS+=-DPREFIX='"$(PREFIX)"'
+ 
+ LDFLAGS+=-rdynamic
+ 
+@@ -69,7 +69,7 @@ endif
+ ifneq ("$(NOOPT)", "")
+ 	CFLAGS+=-O0
+ else
+-	CFLAGS+=-O2
++	CFLAGS+=
+ endif
+ 
+ ifneq ("$(NOSENDFILE)", "")
+@@ -155,7 +155,7 @@ ifeq ("$(OSNAME)", "darwin")
+ 	endif
+ 	S_SRC+=src/bsd.c
+ else ifeq ("$(OSNAME)", "linux")
+-	CFLAGS+=-D_GNU_SOURCE=1 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
++	CFLAGS+=-D_GNU_SOURCE=1
+ 	LDFLAGS+=-ldl
+ 	S_SRC+=src/linux.c src/seccomp.c
+ else
diff --git a/www-servers/kore/kore-4.3.0_rc4.ebuild b/www-servers/kore/kore-4.3.0_rc4.ebuild
new file mode 100644
index 000000000000..c8b932ac8b32
--- /dev/null
+++ b/www-servers/kore/kore-4.3.0_rc4.ebuild
@@ -0,0 +1,78 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+APP_PV="${PV/_/-}"
+
+inherit toolchain-funcs
+
+DESCRIPTION="Web application platform for writing scalable, concurrent web based processes"
+HOMEPAGE="https://kore.io/
+	https://github.com/jorisvink/kore/"
+
+if [[ "${PV}" == *9999* ]] ; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://git.kore.io/kore"
+else
+	SRC_URI="https://github.com/jorisvink/${PN}/archive/refs/tags/${APP_PV}.tar.gz
+		-> ${P}.gh.tar.gz"
+	S="${WORKDIR}/${PN}-${APP_PV}"
+
+	KEYWORDS="~amd64 ~x86"
+fi
+
+LICENSE="ISC"
+SLOT="0"
+IUSE="+acme +curl debug +http +json +openssl postgres +threads"
+REQUIRED_USE="acme? ( curl openssl )"
+
+RDEPEND="
+	curl? ( net-misc/curl:= )
+	json? ( dev-libs/yajl:= )
+	openssl? ( dev-libs/openssl:= )
+	postgres? ( dev-db/postgresql:= )
+"
+DEPEND="
+	${RDEPEND}
+"
+
+PATCHES=(
+	"${FILESDIR}/kore-4.2.3-makefile.patch"
+	"${FILESDIR}/kore-4.2.3-kodev-makefile.patch"
+)
+
+DOCS=( README.md )
+
+src_prepare() {
+	default
+
+	sed -i ./kodev/Makefile tools/kore-serve/conf/build.conf \
+		-e 's|-Werror||g' \
+		|| die
+}
+
+src_compile() {
+	tc-export CC
+
+	# See https://github.com/jorisvink/kore#building-kore
+	env ACME=$(usex acme 1 '')                      \
+		CURL=$(usex curl 1 '')                      \
+		DEBUG=$(usex debug 1 '')                    \
+		JSONRPC=$(usex json 1 '')                   \
+		NOHTTP=$(usex http '' 1)                    \
+		PGSQL=$(usex postgres 1 '')                 \
+		TASKS=$(usex threads 1 '')                  \
+		TLS_BACKEND=$(usex openssl openssl none)    \
+		CFLAGS="${CFLAGS} ${LDFLAGS}"               \
+		LDFLAGS="${LDFLAGS}"                        \
+		PREFIX=/usr                                 \
+		emake
+}
+
+src_install() {
+	emake DESTDIR="${D}" PREFIX=/usr install
+
+	einstalldocs
+}
diff --git a/www-servers/kore/metadata.xml b/www-servers/kore/metadata.xml
new file mode 100644
index 000000000000..d8834ffbb690
--- /dev/null
+++ b/www-servers/kore/metadata.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>xgqt@gentoo.org</email>
+    <name>Maciej Barć</name>
+  </maintainer>
+  <longdescription>
+    Kore is a web application platform for writing scalable, concurrent web
+    based processes. It is built with a "secure by default" approach. It is
+    fully privilege separated while using strong security features at the
+    operating system level such as seccomp, pledge, unveil and more. Today Kore
+    is used in a variety of applications ranging from high assurance
+    cryptographic devices, machine-learning stacks and even in the aerospace
+    industry.
+  </longdescription>
+  <use>
+    <flag name="acme">Add support for ACME</flag>
+    <flag name="http">Add support for HTTP</flag>
+    <flag name="json">Add support for JSONRPC</flag>
+    <flag name="openssl">Use the openssl TLS backend</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/lighttpd/Manifest b/www-servers/lighttpd/Manifest
new file mode 100644
index 000000000000..d3ee62384b9e
--- /dev/null
+++ b/www-servers/lighttpd/Manifest
@@ -0,0 +1,2 @@
+DIST lighttpd-1.4.82.tar.xz 883352 BLAKE2B ea929d672fe76eb001e246d4833659845d1cfdbb8b7120c4f059e278262d9c9d164667e59af3978ae36ae678c5034bd9a5e41f58035587fea8b5fd634aa356d2 SHA512 a8ced6e61b6768d31fb643c1f75af906ee975000286a9a522415571878c7979fd9e5e39f36871e8f34f6ca5d3702fa4b20a0c1203b57ba446dae2dbb6efa71b4
+DIST lighttpd-1.4.82.tar.xz.asc 833 BLAKE2B 9baf7fedc4a977ea95cd26adea707901d44c3383467e00cd83d3ddad2192277ab3397c405bde24fe2d5e5b19377b6121816d35b9d0ad02dab26e3f6309451736 SHA512 ea199ad9456d52f387365f97327d7bab4fefdae64933623d1e4a8f377afdaadf6fd3bb8f8fb3dca8dd12e61461cbe80e7fc2b973f358fe130332048e5251f356
diff --git a/www-servers/lighttpd/files/conf/lighttpd.conf-r3 b/www-servers/lighttpd/files/conf/lighttpd.conf-r3
new file mode 100644
index 000000000000..0ba2b6e69ee3
--- /dev/null
+++ b/www-servers/lighttpd/files/conf/lighttpd.conf-r3
@@ -0,0 +1,307 @@
+###############################################################################
+# Default lighttpd.conf for Gentoo.
+###############################################################################
+
+# {{{ variables
+var.basedir  = "/var/www/localhost"
+var.logdir   = "/var/log/lighttpd"
+var.statedir = "/var/lib/lighttpd"
+# }}}
+
+# {{{ modules
+# At the very least, mod_access and mod_accesslog should be enabled.
+# All other modules should only be loaded if necessary.
+# NOTE: the order of modules is important.
+server.modules = (
+#    "mod_rewrite",
+#    "mod_redirect",
+#    "mod_alias",
+    "mod_access",
+#    "mod_magnet",
+#    "mod_auth",
+#    "mod_status",
+#    "mod_setenv",
+#    "mod_proxy",
+#    "mod_simple_vhost",
+#    "mod_evhost",
+#    "mod_userdir",
+#    "mod_deflate",
+#    "mod_ssi",
+#    "mod_expire",
+#    "mod_rrdtool",
+#    "mod_webdav",
+    "mod_accesslog"
+)
+# }}}
+
+# {{{ includes
+# Map file extensions to mime types for Content-Type using mime.conf
+# shipped with lighttpd code, based on Fedora /etc/mime.types mapping.
+# Option: comment out on embedded systems to save some memory and use
+# lighttpd built-in defaults, which include a subset of common web mime types.
+# Option: use lighttpd doc/scripts/create-mime.conf.pl to generate mapping
+# from Gentoo /etc/mime.types at lighttpd startup.
+include "/etc/lighttpd/mime.conf"
+# }}}
+
+# {{{ server settings
+server.username      = "lighttpd"
+server.groupname     = "lighttpd"
+
+server.document-root = var.basedir + "/htdocs"
+server.pid-file      = "/run/lighttpd.pid"
+
+server.errorlog      = var.logdir  + "/error.log"
+# log errors to syslog instead
+#   server.errorlog-use-syslog = "enable"
+
+server.indexfiles    = ("index.php", "index.html",
+						"index.htm", "default.htm")
+
+# server.tag           = "lighttpd"
+
+# event handler
+# see performance.txt
+#
+# for >= linux-2.6
+#   server.event-handler = "epoll"   # default on Linux
+# for FreeBSD
+#   server.event-handler = "kqueue"  # default on FreeBSD
+
+# chroot to directory (defaults to no chroot)
+# server.chroot      = "/"
+
+# bind to port (defaults to 80)
+# server.port          = 81
+
+# bind to name (defaults to all interfaces)
+# server.bind          = "grisu.home.kneschke.de"
+
+# error-handler for status 404
+# server.error-handler-404 = "/error-handler.html"
+# server.error-handler-404 = "/error-handler.php"
+
+# Format: <errorfile-prefix><status-code>.html
+# -> ..../status-404.html for 'File not found'
+# server.errorfile-prefix    = var.basedir + "/error/status-"
+
+# support for caching stat() calls
+# server.stat-cache-engine = "inotify"
+
+# If lighttpd was build with IPv6 support, and you would like to listen on IPv6,
+# uncomment the following:
+# server.use-ipv6 = "enable"
+
+# }}}
+
+# {{{ mod_staticfile
+
+# which extensions should not be handled via static-file transfer
+# (extensions that are usually handled by mod_cgi, mod_fastcgi, etc).
+static-file.exclude-extensions = (".php", ".pl", ".cgi", ".fcgi")
+# }}}
+
+# {{{ mod_accesslog
+accesslog.filename   = var.logdir + "/access.log"
+# }}}
+
+# {{{ mod_dirlisting
+# enable directory listings
+#   dir-listing.activate      = "enable"
+#
+# don't list hidden files/directories
+#   dir-listing.hide-dotfiles = "enable"
+#
+# use a different css for directory listings
+#   dir-listing.external-css  = "/path/to/dir-listing.css"
+#
+# list of regular expressions.  files that match any of the
+# specified regular expressions will be excluded from directory
+# listings.
+#   dir-listing.exclude = ("^\.", "~$")
+# }}}
+
+# {{{ mod_access
+# see access.txt
+
+url.access-deny = ("~", ".inc")
+# }}}
+
+# {{{ mod_userdir
+# see userdir.txt
+#
+# userdir.path = "public_html"
+# userdir.exclude-user = ("root")
+# }}}
+
+# {{{ mod_ssi
+# see ssi.txt
+#
+# ssi.extension = (".shtml")
+# }}}
+
+# {{{ mod_ssl
+# see ssl.txt
+#
+# ssl.engine    = "enable"
+# ssl.pemfile   = "server.pem"
+# }}}
+
+# {{{ mod_status
+# see status.txt
+#
+# status.status-url  = "/server-status"
+# status.config-url  = "/server-config"
+# }}}
+
+# {{{ mod_simple_vhost
+# see simple-vhost.txt
+#
+#  If you want name-based virtual hosting add the next three settings and load
+#  mod_simple_vhost
+#
+# document-root =
+#   virtual-server-root + virtual-server-default-host + virtual-server-docroot
+# or
+#   virtual-server-root + http-host + virtual-server-docroot
+#
+# simple-vhost.server-root   = "/home/weigon/wwwroot/servers/"
+# simple-vhost.default-host  = "grisu.home.kneschke.de"
+# simple-vhost.document-root = "/pages/"
+# }}}
+
+# {{{ mod_deflate
+# see compress.txt
+#
+# deflate.cache-dir   = var.statedir + "/cache/compress"
+# deflate.mimetypes   = ("text/plain", "text/html")
+# }}}
+
+# {{{ mod_proxy
+# see proxy.txt
+#
+# proxy.server               = ( ".php" =>
+#                               ( "localhost" =>
+#                                 (
+#                                   "host" => "192.168.0.101",
+#                                   "port" => 80
+#                                 )
+#                               )
+#                             )
+# }}}
+
+# {{{ mod_auth
+# see authentication.txt
+#
+# auth.backend               = "plain"
+# auth.backend.plain.userfile = "lighttpd.user"
+# auth.backend.plain.groupfile = "lighttpd.group"
+
+# auth.backend.ldap.hostname = "localhost"
+# auth.backend.ldap.base-dn  = "dc=my-domain,dc=com"
+# auth.backend.ldap.filter   = "(uid=$)"
+
+# auth.require               = ( "/server-status" =>
+#                               (
+#                                 "method"  => "digest",
+#                                 "realm"   => "download archiv",
+#                                 "require" => "user=jan"
+#                               ),
+#                               "/server-info" =>
+#                               (
+#                                 "method"  => "digest",
+#                                 "realm"   => "download archiv",
+#                                 "require" => "valid-user"
+#                               )
+#                             )
+# }}}
+
+# {{{ mod_rewrite
+# see rewrite.txt
+#
+# url.rewrite = (
+#	"^/$"		=>		"/server-status"
+# )
+# }}}
+
+# {{{ mod_redirect
+# see redirect.txt
+#
+# url.redirect = (
+#	"^/wishlist/(.+)"		=>		"http://www.123.org/$1"
+# )
+# }}}
+
+# {{{ mod_evhost
+# define a pattern for the host url finding
+# %% => % sign
+# %0 => domain name + tld
+# %1 => tld
+# %2 => domain name without tld
+# %3 => subdomain 1 name
+# %4 => subdomain 2 name
+#
+# evhost.path-pattern        = "/home/storage/dev/www/%3/htdocs/"
+# }}}
+
+# {{{ mod_expire
+# expire.url = (
+#	"/buggy/"		=>		"access 2 hours",
+#	"/asdhas/"		=>		"access plus 1 seconds 2 minutes"
+# )
+# }}}
+
+# {{{ mod_rrdtool
+# see rrdtool.txt
+#
+# rrdtool.binary  = "/usr/bin/rrdtool"
+# rrdtool.db-name = var.statedir + "/lighttpd.rrd"
+# }}}
+
+# {{{ mod_setenv
+# see setenv.txt
+#
+# setenv.add-request-header  = ( "TRAV_ENV" => "mysql://user@host/db" )
+# setenv.add-response-header = ( "X-Secret-Message" => "42" )
+# }}}
+
+# {{{ mod_webdav
+# see webdav.txt
+#
+# $HTTP["url"] =~ "^/dav($|/)" {
+#     webdav.activate = "enable"
+#     webdav.is-readonly = "enable"
+# }
+# }}}
+
+# {{{ extra rules
+#
+# set Content-Encoding and reset Content-Type for browsers that
+# support decompressing on-thy-fly (requires mod_setenv)
+# $HTTP["url"] =~ "\.gz$" {
+#     setenv.add-response-header = ("Content-Encoding" => "x-gzip")
+#     mimetype.assign = (".gz" => "text/plain")
+# }
+
+# $HTTP["url"] =~ "\.bz2$" {
+#     setenv.add-response-header = ("Content-Encoding" => "x-bzip2")
+#     mimetype.assign = (".bz2" => "text/plain")
+# }
+#
+# }}}
+
+# {{{ debug
+# debug.log-request-header   = "enable"
+# debug.log-response-header  = "enable"
+# debug.log-request-handling = "enable"
+# debug.log-file-not-found   = "enable"
+# }}}
+
+# {{{ cgi includes
+# uncomment for cgi support
+#   include "mod_cgi.conf"
+# uncomment for php/fastcgi support
+#   include "mod_fastcgi.conf"
+# }}}
+
+# vim: set ft=conf foldmethod=marker et :
diff --git a/www-servers/lighttpd/files/conf/mime-types.conf b/www-servers/lighttpd/files/conf/mime-types.conf
new file mode 100644
index 000000000000..40e26c1ae9cd
--- /dev/null
+++ b/www-servers/lighttpd/files/conf/mime-types.conf
@@ -0,0 +1,168 @@
+###############################################################################
+# Default mime-types.conf for Gentoo.
+# include'd from lighttpd.conf.
+###############################################################################
+
+mimetype.assign = (
+  ".pdf" => "application/pdf",
+  ".epub" => "application/epub+zip",
+  ".spl" => "application/futuresplash",
+  ".jar" => "application/java-archive",
+  ".class" => "application/java-vm",
+  ".jsonld" => "application/ld+json",
+  ".json" => "application/json",
+  ".mdb" => "application/msaccess",
+  ".doc" => "application/msword",
+  ".ogg" => "application/ogg",
+  ".pgp" => "application/pgp-encrypted",
+  ".sig" => "application/pgp-signature",
+  ".ps" => "application/postscript",
+  ".eps" => "application/postscript",
+  ".rar" => "applicaion/rar",
+  ".rdf" => "application/rdf+xml",
+  ".rss" => "application/rss+xml",
+  ".rtf" => "application/rtf",
+  ".azw" => "application/vnd.amazon.ebook",
+  ".cbz" => "application/vnd.comicbook+zip",
+  ".cbr" => "application/vnd.comicbook-rar",
+  ".exe" => "application/vnd.microsoft.portable-executable",
+  ".xls" => "application/vnd.ms-excel",
+  ".ppt" => "application/vnd.ms-powerpoint",
+  ".docm" => "application/vnd.ms-word.document.macroEnabled.12",
+  ".odt" => "application/vnd.oasis.opendocument.text",
+  ".ods" => "application/vnd.oasis.opendocument.spreadsheet",
+  ".odp" => "application/vnd.oasis.opendocument.presentation",
+  ".odg" => "application/vnd.oasis.opendocument.graphics",
+  ".odc" => "application/vnd.oasis.opendocument.chart",
+  ".odf" => "application/vnd.oasis.opendocument.formula",
+  ".odi" => "application/vnd.oasis.opendocument.image",
+  ".pptx" => "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".xlsx" => "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".docx" => "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".vsd" => "application/vnd.visio",
+  ".wasm" => "application/wasm",
+  ".xhtml" => "application/xhtml+xml",
+  ".zip" => "application/zip",
+  ".zstd" => "application/zstd",
+  ".7z" => "application/x-7z-compressed",
+  ".dmg" => "application/x-apple-diskimage",
+  ".torrent" => "application/x-bittorrent",
+  ".bz2" => "application/x-bzip",
+  ".tbz" => "application/x-bzip-compressed-tar",
+  ".tar.bz2" => "application/x-bzip-compressed-tar",
+  ".pgn" => "application/x-chess-pgn",
+  ".deb" => "application/x-debian-package",
+  ".dvi" => "application/x-dvi",
+  ".mm" => "application/x-freemind",
+  ".gz" => "application/x-gzip",
+  ".iso" => "application/x-iso9660-image",
+  ".jnlp" => "application/x-java-jnlp-file",
+  ".pac" => "application/x-ns-proxy-autoconfig",
+  ".rpm" => "application/x-redhat-package-manager",
+  ".swf" => "application/x-shockwave-flash",
+  ".tar.gz" => "application/x-tgz",
+  ".tgz" => "application/x-tgz",
+  ".tar" => "application/x-tar",
+  ".xz" => "application/x-xz",
+  ".aac" => "audio/aac",
+  ".adts" => "audio/aac",
+  ".ac3" => "audio/ac3",
+  ".snd" => "audio/basic",
+  ".mid" => "audio/midi",
+  ".midi" => "audio/midi",
+  ".m4a" => "audio/mp4",
+  ".mp1" => "audio/mpeg",
+  ".mp2" => "audio/mpeg",
+  ".mp3" => "audio/mpeg",
+  ".oga" => "audio/ogg",
+  ".opus" => "audio/ogg",
+  ".spx" => "audio/ogg",
+  ".sid" => "audio/prs.sid",
+  ".mlp" => "audio/vnd.dolby.mlp",
+  ".dts" => "audio/vnd.dts",
+  ".dtshd" => "audio/vnd.dts.hd",
+  ".flac" => "audio/x-flac",
+  ".mka" => "audio/x-matroska",
+  ".m3u" => "audio/x-mpegurl",
+  ".mod" => "audio/x-mod",
+  ".wma" => "audio/x-ms-wma",
+  ".wax" => "audio/x-ms-wax",
+  ".wav" => "audio/x-wav",
+  ".otf" => "font/otf",
+  ".ttf" => "font/ttf",
+  ".woff" => "font/woff",
+  ".woff2" => "font/woff2",
+  ".bmp" => "image/bmp",
+  ".gif" => "image/gif",
+  ".heic" => "image/heic",
+  ".heics" => "image/heic-sequence",
+  ".heif" => "image/heif",
+  ".heifs" => "image/heif-sequence",
+  ".jpg" => "image/jpeg",
+  ".jpeg" => "image/jpeg",
+  ".png" => "image/png",
+  ".tif" => "image/tiff",
+  ".tiff" => "image/tiff",
+  ".svg" => "image/svg+xml",
+  ".svgz" => "image/svg+xml",
+  ".webp" => "image/webp",
+  ".psd" => "image/vnd.adobe.photoshop",
+  ".apng" => "image/vnd.mozilla.apng",
+  ".ico" => "image/x-icon",
+  ".xbm" => "image/x-xbitmap",
+  ".xpm" => "image/x-xpixmap",
+  ".xwd" => "image/x-xwindowdump",
+  ".ics" => "text/calendar",
+  ".css" => "text/css",
+  ".csv" => "text/csv",
+  ".html" => "text/html",
+  ".htm" => "text/html",
+  ".js" => "text/javascript",
+  ".asc" => "text/plain",
+  ".c" => "text/plain",
+  ".h" => "text/plain",
+  ".cc" => "text/plain",
+  ".cpp" => "text/plain",
+  ".hh" => "text/plain",
+  ".hpp" => "text/plain",
+  ".conf" => "text/plain",
+  ".log" => "text/plain",
+  ".text" => "text/plain",
+  ".txt" => "text/plain",
+  ".diff" => "text/plain",
+  ".patch" => "text/plain",
+  ".ebuild" => "text/plain",
+  ".eclass" => "text/plain",
+  ".vcard" => "text/vcard",
+  ".vcf" => "text/vcard",
+  ".dtd" => "text/xml",
+  ".xml" => "text/xml",
+  ".vcs" => "text/x-vcalendar",
+  ".x3db" => "model/x3d+binary",
+  ".x3dbz" => "model/x3d+binary",
+  ".x3dv" => "model/x3d+vrml",
+  ".x3dvz" => "model/x3d+vrml",
+  ".x3d" => "model/x3d+xml",
+  ".x3dz" => "model/x3d+xml",
+  ".ts" => "video/mp2t",
+  ".m4v" => "video/mp4",
+  ".mp4" => "video/mp4",
+  ".mpeg" => "video/mpeg",
+  ".mpg" => "video/mpeg",
+  ".ogv" => "video/ogg",
+  ".mov" => "video/quicktime",
+  ".qt" => "video/quicktime",
+  ".webm" => "video/webm",
+  ".m4u" => "video/vnd.mpegurl",
+  ".bik" => "video/vnd.radgamettools.bink",
+  ".bk2" => "video/vnd.radgamettools.bink",
+  ".smk" => "video/vnd.radgamettools.smacker",
+  ".flv" => "video/x-flv",
+  ".mkv" => "video/x-matroska",
+  ".mk3d" => "video/x-matroska-3d",
+  ".mng" => "video/x-mng",
+  ".avi" => "video/x-msvideo",
+  ".asf" => "video/x-ms-asf",
+  ".asx" => "video/x-ms-asf",
+  ".wmv" => "video/x-ms-wmv"
+)
diff --git a/www-servers/lighttpd/files/conf/mod_cgi.conf b/www-servers/lighttpd/files/conf/mod_cgi.conf
new file mode 100644
index 000000000000..5958d2d115b7
--- /dev/null
+++ b/www-servers/lighttpd/files/conf/mod_cgi.conf
@@ -0,0 +1,24 @@
+###############################################################################
+# mod_cgi.conf
+# include'd by lighttpd.conf.
+###############################################################################
+
+server.modules += ("mod_cgi")
+
+# this requires mod_alias
+alias.url = (
+  "/cgi-bin/" => var.basedir + "/cgi-bin/"
+)
+
+# Note that you'll also want to enable the
+# cgi-bin alias via mod_alias (above).
+
+$HTTP["url"] =~ "^/cgi-bin/" {
+  # disable directory listings
+  dir-listing.activate = "disable"
+  # only allow cgi's in this directory
+  cgi.assign = (
+    ".pl" => "/usr/bin/perl",
+    ".cgi" => "/usr/bin/perl"
+  )
+}
diff --git a/www-servers/lighttpd/files/conf/mod_fastcgi.conf b/www-servers/lighttpd/files/conf/mod_fastcgi.conf
new file mode 100644
index 000000000000..515e7c52aafd
--- /dev/null
+++ b/www-servers/lighttpd/files/conf/mod_fastcgi.conf
@@ -0,0 +1,15 @@
+###############################################################################
+# mod_fastcgi.conf
+# include'd by lighttpd.conf.
+###############################################################################
+
+server.modules += ("mod_fastcgi")
+
+fastcgi.server = (
+  ".php" => (
+    "localhost" => (
+      "socket" => "/run/lighttpd/lighttpd-fastcgi-php-" + PID + ".socket",
+      "bin-path" => "/usr/bin/php-cgi"
+    )
+  )
+)
diff --git a/www-servers/lighttpd/files/lighttpd.confd b/www-servers/lighttpd/files/lighttpd.confd
new file mode 100644
index 000000000000..c7733de7e75e
--- /dev/null
+++ b/www-servers/lighttpd/files/lighttpd.confd
@@ -0,0 +1,8 @@
+# /etc/conf.d/lighttpd
+
+# Location of a shell used by the 'include_shell' directive
+# in the lighttpd's configuration file
+#export SHELL="/bin/bash"
+
+# Location of the lighttpd configuration file
+LIGHTTPD_CONF="/etc/lighttpd/lighttpd.conf"
diff --git a/www-servers/lighttpd/files/lighttpd.initd-r2 b/www-servers/lighttpd/files/lighttpd.initd-r2
new file mode 100644
index 000000000000..24539e3e80c7
--- /dev/null
+++ b/www-servers/lighttpd/files/lighttpd.initd-r2
@@ -0,0 +1,76 @@
+#!/sbin/openrc-run
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+extra_started_commands="reload graceful"
+
+LIGHTTPD_PID="$($(which lighttpd) -pf ${LIGHTTPD_CONF} | grep server.pid-file | cut -d '=' -f 2 | tr -d \\\" | tr -d [:space:])"
+
+depend() {
+	need net
+	use mysql logger spawn-fcgi ldap slapd netmount dns
+	after famd
+	after sshd
+}
+
+checkconfig() {
+	if [ ! -f "${LIGHTTPD_CONF}" ] ; then
+		ewarn "${LIGHTTPD_CONF} does not exist."
+		return 1
+	fi
+
+	if [ -z "${LIGHTTPD_PID}" ] ; then
+		eerror "server.pid-file variable in ${LIGHTTPD_CONF}"
+		eerror "is not set. Please set this variable properly"
+		eerror "and try again"
+		return 1
+	fi
+	/usr/sbin/lighttpd -tt -f ${LIGHTTPD_CONF} >/dev/null
+}
+
+start() {
+	checkconfig || return 1
+	# Glean lighttpd's credentials from the configuration file
+	# Fixes bug 454366
+	LIGHTTPD_USER="$(awk '/^server.username/{s=$3};{sub("\"","",s)};END{print s}' ${LIGHTTPD_CONF})"
+	LIGHTTPD_GROUP="$(awk '/^server.groupname/{s=$3};{sub("\"","",s)};END{print s}' ${LIGHTTPD_CONF})"
+	checkpath -d -q -m 0750 -o "${LIGHTTPD_USER}":"${LIGHTTPD_GROUP}" /run/lighttpd/
+
+	ebegin "Starting lighttpd"
+	start-stop-daemon --start --quiet --exec /usr/sbin/lighttpd \
+		--pidfile "${LIGHTTPD_PID}" -- -f "${LIGHTTPD_CONF}"
+	eend $?
+}
+
+stop() {
+	local rv=0
+	ebegin "Stopping lighttpd"
+	start-stop-daemon --stop --quiet --pidfile "${LIGHTTPD_PID}"
+	eend $?
+}
+
+reload() {
+	if ! service_started "${SVCNAME}" ; then
+		eerror "${SVCNAME} isn't running"
+		return 1
+	fi
+	checkconfig || return 1
+
+	ebegin "Re-opening lighttpd log files"
+	start-stop-daemon --quiet --pidfile "${LIGHTTPD_PID}" \
+		--signal HUP
+	eend $?
+}
+
+graceful() {
+	if ! service_started "${SVCNAME}" ; then
+		eerror "${SVCNAME} isn't running"
+		return 1
+	fi
+	checkconfig || return 1
+
+	ebegin "Gracefully restarting lighttpd"
+	start-stop-daemon --quiet --pidfile "${LIGHTTPD_PID}" \
+		--signal USR1
+	eend $?
+}
diff --git a/www-servers/lighttpd/files/lighttpd.logrotate-r1 b/www-servers/lighttpd/files/lighttpd.logrotate-r1
new file mode 100644
index 000000000000..a364680035b2
--- /dev/null
+++ b/www-servers/lighttpd/files/lighttpd.logrotate-r1
@@ -0,0 +1,15 @@
+# lighttpd logrotate script for Gentoo
+
+/var/log/lighttpd/*.log {
+        daily
+        missingok
+		copytruncate
+        rotate 7
+        compress
+        notifempty
+        sharedscripts
+        postrotate
+		test -e /run/openrc/softlevel && /etc/init.d/lighttpd reload 1>/dev/null || true
+		test -e /run/systemd/system && systemctl reload lighttpd.service || true
+        endscript
+}
diff --git a/www-servers/lighttpd/files/lighttpd.service-r3 b/www-servers/lighttpd/files/lighttpd.service-r3
new file mode 100644
index 000000000000..288d08e00729
--- /dev/null
+++ b/www-servers/lighttpd/files/lighttpd.service-r3
@@ -0,0 +1,84 @@
+[Unit]
+Description=Lighttpd Daemon
+After=syslog.target network-online.target
+Documentation=man:lighttpd https://wiki.lighttpd.net
+
+# optional: systemd socket activation for lighttpd
+# Requires lighttpd.conf: server.systemd-socket-activation = "enable"
+# Requires installation, configuration, enabling of systemd lighttpd*.socket
+# https://git.lighttpd.net/lighttpd/lighttpd1.4/src/branch/master/doc/systemd/
+#Requires=lighttpd-http-ipv4.socket lighttpd-http-ipv6.socket lighttpd-https-ipv4.socket lighttpd-https-ipv6.socket
+
+[Install]
+WantedBy=multi-user.target
+
+[Service]
+Type=simple
+PIDFile=/run/lighttpd.pid
+ExecStartPre=/usr/sbin/lighttpd -tt -f /etc/lighttpd/lighttpd.conf
+ExecStart=/usr/sbin/lighttpd -D -f /etc/lighttpd/lighttpd.conf
+ExecReload=/usr/sbin/lighttpd -tt -f /etc/lighttpd/lighttpd.conf
+ExecReload=/bin/kill -USR1 $MAINPID
+Restart=on-failure
+
+# increase num files soft limit; 1024 harkens back to select() limit
+# (lighttpd.conf must still be configured with `server.max-fds`; default 4096)
+LimitNOFILE=32768:524288
+
+#
+# system capabilities hardening
+#
+
+# (comment all out if running lighttpd as root to manage system, e.g. via LuCI)
+
+# Recommended configuration: have systemd start lighttpd as unprivileged user.
+# Note: starting lighttpd as unprivileged user requires TLS certificates to be
+#   readable by the unprivileged user and will fail for existing configurations
+#   where that is not currently the case.  For that scenario and for similar
+#   compatibility reasons, this is not yet enabled by default.
+#User=lighttpd
+#Group=lighttpd
+
+# Allow unprivileged lighttpd to bind,listen to ports < 1024 (i.e. 80 and 443).
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+# Recommended configuration: strictly limit capabilities
+# Limit capabilities, including for children and privileged processes, e.g. root
+# CAP_NET_BIND_SERVICE allows bind() to ports < 1024 (i.e. 80 and 443).
+# CAP_SETGID, CAP_SETUID, and CAP_SYS_CHROOT are self explanatory.
+#CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT
+# If not starting lighttpd as root, minimal capability to bind to ports < 1024:
+#CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+# Using systemd socket activation, even CAP_NET_BIND_SERVICE is not necessary
+# and could be removed from AmbientCapabilities and CapabilityBoundingSet.
+# Requires lighttpd*.socket 'Requires' in [Unit] section at top of this file.
+
+# Note: PrivateTmp=yes
+#   could break backends if named socket from independent daemon is located
+#   in /tmp; must relocate lighttpd.conf socket paths to e.g. /run/lighttpd
+# Note: ProtectHome=read-only
+#   could break CGI scripts or WebDAV writing to home paths
+# Note: RestrictSUIDSGID=yes
+#   could break CGI scripts or WebDAV setting suid/sgid permission bit on files
+
+KeyringMode=private
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateTmp=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=read-only
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=full
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
diff --git a/www-servers/lighttpd/files/lighttpd.tmpfiles.conf b/www-servers/lighttpd/files/lighttpd.tmpfiles.conf
new file mode 100644
index 000000000000..4ba7262b6374
--- /dev/null
+++ b/www-servers/lighttpd/files/lighttpd.tmpfiles.conf
@@ -0,0 +1 @@
+d /run/lighttpd 0750 lighttpd lighttpd -
diff --git a/www-servers/lighttpd/lighttpd-1.4.82.ebuild b/www-servers/lighttpd/lighttpd-1.4.82.ebuild
new file mode 100644
index 000000000000..f4fbc755ce2d
--- /dev/null
+++ b/www-servers/lighttpd/lighttpd-1.4.82.ebuild
@@ -0,0 +1,222 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/lighttpd.asc
+inherit lua-single meson readme.gentoo-r1 systemd tmpfiles verify-sig
+
+DESCRIPTION="Lightweight high-performance web server"
+HOMEPAGE="https://www.lighttpd.net https://github.com/lighttpd"
+if [[ ${PV} == *9999* ]] ; then
+	EGIT_REPO_URI="https://git.lighttpd.net/lighttpd/lighttpd1.4.git"
+	inherit git-r3
+else
+	SRC_URI="
+		https://download.lighttpd.net/lighttpd/releases-1.4.x/${P}.tar.xz
+		verify-sig? ( https://download.lighttpd.net/lighttpd/releases-$(ver_cut 1-2).x/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+fi
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+IUSE="+brotli dbi gnutls kerberos ldap libdeflate +lua maxminddb mbedtls +nettle nss +pcre php sasl selinux ssl unwind webdav xattr +zlib zstd"
+
+REQUIRED_USE="
+	lua? ( ${LUA_REQUIRED_USE} )
+"
+
+# Match the bundled xxhash version for the minimum version
+COMMON_DEPEND="
+	acct-group/lighttpd
+	acct-user/lighttpd
+	>=dev-libs/xxhash-0.8.2
+	virtual/libcrypt:=
+	brotli? ( app-arch/brotli:= )
+	dbi? (
+		dev-db/libdbi
+	)
+	gnutls? ( net-libs/gnutls )
+	kerberos? ( virtual/krb5 )
+	ldap? ( >=net-nds/openldap-2.1.26:= )
+	libdeflate? ( app-arch/libdeflate )
+	lua? ( ${LUA_DEPS} )
+	maxminddb? ( dev-libs/libmaxminddb )
+	mbedtls? ( net-libs/mbedtls:0= )
+	nettle? ( dev-libs/nettle:= )
+	nss? ( dev-libs/nss )
+	pcre? ( dev-libs/libpcre2 )
+	php? ( dev-lang/php:*[cgi] )
+	sasl? ( dev-libs/cyrus-sasl )
+	ssl? ( >=dev-libs/openssl-0.9.7:= )
+	unwind? ( sys-libs/libunwind:= )
+	webdav? (
+		dev-libs/libxml2:=
+		dev-db/sqlite
+	)
+	xattr? ( kernel_linux? ( sys-apps/attr ) )
+	zlib? ( >=virtual/zlib-1.1:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${COMMON_DEPEND}
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+RDEPEND="
+	${COMMON_DEPEND}
+	selinux? ( sec-policy/selinux-apache )
+"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-lighttpd-20250325 )
+"
+
+# update certain parts of lighttpd.conf based on conditionals
+update_config() {
+	local config="${ED}/etc/lighttpd/lighttpd.conf"
+
+	# Enable php/mod_fastcgi settings
+	if use php; then
+		sed -i -e 's|#.*\(include.*fastcgi.*$\)|\1|' ${config} || die
+	fi
+
+	# Automatically listen on IPv6 if built with USE=ipv6 (which we now always do)
+	# bug #234987
+	sed -i -e 's|# server.use-ipv6|server.use-ipv6|' ${config} || die
+}
+
+pkg_setup() {
+	if use lua; then
+		lua-single_pkg_setup
+	fi
+
+	if ! use pcre ; then
+		ewarn "It is highly recommended that you build ${PN}"
+		ewarn "with perl regular expressions support via USE=pcre."
+		ewarn "Otherwise you lose support for some core options such"
+		ewarn "as conditionals and modules such as mod_re{write,direct}."
+	fi
+
+	DOC_CONTENTS="IPv6 migration guide:\n
+		https://wiki.lighttpd.net/IPv6-Config
+	"
+}
+
+src_configure() {
+	# (One specific library might be preferred on embedded systems via
+	#  MYMESONARGS with e.g. -DFORCE_blah_CRYPTO)
+	local emesonargs=(
+		-Dmoduledir="$(get_libdir)"/${PN}
+
+		${c_args}
+
+		$(meson_feature brotli with_brotli)
+
+		# TODO: revisit (was off in autotools ebuild)
+		-Dwith_bzip=disabled
+
+		$(meson_feature dbi with_dbi)
+
+		# Obsolete
+		-Dwith_fam=disabled
+
+		$(meson_use gnutls with_gnutls)
+		$(meson_feature kerberos with_krb5)
+		$(meson_feature ldap with_ldap)
+
+		$(meson_feature libdeflate with_libdeflate)
+
+		$(meson_feature unwind with_libunwind)
+
+		$(meson_use lua with_lua)
+		-Dlua_version=${ELUA}
+
+		$(meson_feature maxminddb with_maxminddb)
+		$(meson_use mbedtls with_mbedtls)
+
+		$(meson_use nettle with_nettle)
+		$(meson_use nss with_nss)
+
+		# Obsolete
+		-Dwith_pcre=disabled
+
+		$(meson_use pcre with_pcre2)
+
+		$(meson_feature sasl with_sasl)
+		$(meson_use ssl with_openssl)
+
+		-Dwith_xxhash=enabled
+		$(meson_feature webdav with_webdav_props)
+
+		# Unpackaged in Gentoo
+		-Dwith_boringssl=false
+		-Dwith_wolfssl=false
+
+		$(meson_use xattr with_xattr)
+		$(meson_feature zlib with_zlib)
+		$(meson_feature zstd with_zstd)
+	)
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	# Init script stuff
+	newinitd "${FILESDIR}"/lighttpd.initd-r2 lighttpd
+	newconfd "${FILESDIR}"/lighttpd.confd lighttpd
+
+	# Configs
+	insinto /etc/lighttpd
+	newins "${FILESDIR}"/conf/lighttpd.conf-r3 lighttpd.conf
+	doins "${FILESDIR}"/conf/mod_cgi.conf
+	doins "${FILESDIR}"/conf/mod_fastcgi.conf
+	doins doc/config/conf.d/mime.conf
+
+	# Update lighttpd.conf directives based on conditionals
+	update_config
+
+	# Docs
+	dodoc AUTHORS README NEWS doc/scripts/*.sh
+	newdoc doc/config/lighttpd.conf lighttpd.conf.distrib
+	readme.gentoo_create_doc
+
+	docinto txt
+	dodoc doc/outdated/*.txt
+
+	doman doc/*.8
+
+	# Logrotate
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/lighttpd.logrotate-r1 lighttpd
+
+	keepdir /var/l{ib,og}/lighttpd /var/www/localhost/htdocs
+	fowners lighttpd:lighttpd /var/l{ib,og}/lighttpd
+	fperms 0750 /var/l{ib,og}/lighttpd
+
+	systemd_newunit "${FILESDIR}"/${PN}.service-r3 ${PN}.service
+	newtmpfiles "${FILESDIR}"/${PN}.tmpfiles.conf ${PN}.conf
+}
+
+pkg_postinst() {
+	tmpfiles_process ${PN}.conf
+
+	readme.gentoo_print_elog
+
+	if [[ -f ${EROOT}/etc/lighttpd.conf ]] ; then
+		elog
+		elog "Gentoo has a customized configuration,"
+		elog "which is now located in ${EROOT}/etc/lighttpd. Please migrate your"
+		elog "existing configuration."
+	fi
+
+	if use brotli || use zstd || use zlib ; then
+		elog
+		elog "Remember to clean your cache directory when using"
+		elog "output compression!"
+		elog "https://wiki.lighttpd.net/Docs_ModDeflate"
+	fi
+}
diff --git a/www-servers/lighttpd/lighttpd-9999.ebuild b/www-servers/lighttpd/lighttpd-9999.ebuild
new file mode 100644
index 000000000000..b6d8dff821b6
--- /dev/null
+++ b/www-servers/lighttpd/lighttpd-9999.ebuild
@@ -0,0 +1,222 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/lighttpd.asc
+inherit lua-single meson readme.gentoo-r1 systemd tmpfiles verify-sig
+
+DESCRIPTION="Lightweight high-performance web server"
+HOMEPAGE="https://www.lighttpd.net https://github.com/lighttpd"
+if [[ ${PV} == *9999* ]] ; then
+	EGIT_REPO_URI="https://git.lighttpd.net/lighttpd/lighttpd1.4.git"
+	inherit git-r3
+else
+	SRC_URI="
+		https://download.lighttpd.net/lighttpd/releases-1.4.x/${P}.tar.xz
+		verify-sig? ( https://download.lighttpd.net/lighttpd/releases-$(ver_cut 1-2).x/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+IUSE="+brotli dbi gnutls kerberos ldap libdeflate +lua maxminddb mbedtls +nettle nss +pcre php sasl selinux ssl unwind webdav xattr +zlib zstd"
+
+REQUIRED_USE="
+	lua? ( ${LUA_REQUIRED_USE} )
+"
+
+# Match the bundled xxhash version for the minimum version
+COMMON_DEPEND="
+	acct-group/lighttpd
+	acct-user/lighttpd
+	>=dev-libs/xxhash-0.8.2
+	virtual/libcrypt:=
+	brotli? ( app-arch/brotli:= )
+	dbi? (
+		dev-db/libdbi
+	)
+	gnutls? ( net-libs/gnutls )
+	kerberos? ( virtual/krb5 )
+	ldap? ( >=net-nds/openldap-2.1.26:= )
+	libdeflate? ( app-arch/libdeflate )
+	lua? ( ${LUA_DEPS} )
+	maxminddb? ( dev-libs/libmaxminddb )
+	mbedtls? ( net-libs/mbedtls:0= )
+	nettle? ( dev-libs/nettle:= )
+	nss? ( dev-libs/nss )
+	pcre? ( dev-libs/libpcre2 )
+	php? ( dev-lang/php:*[cgi] )
+	sasl? ( dev-libs/cyrus-sasl )
+	ssl? ( >=dev-libs/openssl-0.9.7:= )
+	unwind? ( sys-libs/libunwind:= )
+	webdav? (
+		dev-libs/libxml2:=
+		dev-db/sqlite
+	)
+	xattr? ( kernel_linux? ( sys-apps/attr ) )
+	zlib? ( >=virtual/zlib-1.1:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${COMMON_DEPEND}
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+RDEPEND="
+	${COMMON_DEPEND}
+	selinux? ( sec-policy/selinux-apache )
+"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-lighttpd-20250325 )
+"
+
+# update certain parts of lighttpd.conf based on conditionals
+update_config() {
+	local config="${ED}/etc/lighttpd/lighttpd.conf"
+
+	# Enable php/mod_fastcgi settings
+	if use php; then
+		sed -i -e 's|#.*\(include.*fastcgi.*$\)|\1|' ${config} || die
+	fi
+
+	# Automatically listen on IPv6 if built with USE=ipv6 (which we now always do)
+	# bug #234987
+	sed -i -e 's|# server.use-ipv6|server.use-ipv6|' ${config} || die
+}
+
+pkg_setup() {
+	if use lua; then
+		lua-single_pkg_setup
+	fi
+
+	if ! use pcre ; then
+		ewarn "It is highly recommended that you build ${PN}"
+		ewarn "with perl regular expressions support via USE=pcre."
+		ewarn "Otherwise you lose support for some core options such"
+		ewarn "as conditionals and modules such as mod_re{write,direct}."
+	fi
+
+	DOC_CONTENTS="IPv6 migration guide:\n
+		https://wiki.lighttpd.net/IPv6-Config
+	"
+}
+
+src_configure() {
+	# (One specific library might be preferred on embedded systems via
+	#  MYMESONARGS with e.g. -DFORCE_blah_CRYPTO)
+	local emesonargs=(
+		-Dmoduledir="$(get_libdir)"/${PN}
+
+		${c_args}
+
+		$(meson_feature brotli with_brotli)
+
+		# TODO: revisit (was off in autotools ebuild)
+		-Dwith_bzip=disabled
+
+		$(meson_feature dbi with_dbi)
+
+		# Obsolete
+		-Dwith_fam=disabled
+
+		$(meson_use gnutls with_gnutls)
+		$(meson_feature kerberos with_krb5)
+		$(meson_feature ldap with_ldap)
+
+		$(meson_feature libdeflate with_libdeflate)
+
+		$(meson_feature unwind with_libunwind)
+
+		$(meson_use lua with_lua)
+		-Dlua_version=${ELUA}
+
+		$(meson_feature maxminddb with_maxminddb)
+		$(meson_use mbedtls with_mbedtls)
+
+		$(meson_use nettle with_nettle)
+		$(meson_use nss with_nss)
+
+		# Obsolete
+		-Dwith_pcre=disabled
+
+		$(meson_use pcre with_pcre2)
+
+		$(meson_feature sasl with_sasl)
+		$(meson_use ssl with_openssl)
+
+		-Dwith_xxhash=enabled
+		$(meson_feature webdav with_webdav_props)
+
+		# Unpackaged in Gentoo
+		-Dwith_boringssl=false
+		-Dwith_wolfssl=false
+
+		$(meson_use xattr with_xattr)
+		$(meson_feature zlib with_zlib)
+		$(meson_feature zstd with_zstd)
+	)
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	# Init script stuff
+	newinitd "${FILESDIR}"/lighttpd.initd-r2 lighttpd
+	newconfd "${FILESDIR}"/lighttpd.confd lighttpd
+
+	# Configs
+	insinto /etc/lighttpd
+	newins "${FILESDIR}"/conf/lighttpd.conf-r3 lighttpd.conf
+	doins "${FILESDIR}"/conf/mod_cgi.conf
+	doins "${FILESDIR}"/conf/mod_fastcgi.conf
+	doins doc/config/conf.d/mime.conf
+
+	# Update lighttpd.conf directives based on conditionals
+	update_config
+
+	# Docs
+	dodoc AUTHORS README NEWS doc/scripts/*.sh
+	newdoc doc/config/lighttpd.conf lighttpd.conf.distrib
+	readme.gentoo_create_doc
+
+	docinto txt
+	dodoc doc/outdated/*.txt
+
+	doman doc/*.8
+
+	# Logrotate
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/lighttpd.logrotate-r1 lighttpd
+
+	keepdir /var/l{ib,og}/lighttpd /var/www/localhost/htdocs
+	fowners lighttpd:lighttpd /var/l{ib,og}/lighttpd
+	fperms 0750 /var/l{ib,og}/lighttpd
+
+	systemd_newunit "${FILESDIR}"/${PN}.service-r3 ${PN}.service
+	newtmpfiles "${FILESDIR}"/${PN}.tmpfiles.conf ${PN}.conf
+}
+
+pkg_postinst() {
+	tmpfiles_process ${PN}.conf
+
+	readme.gentoo_print_elog
+
+	if [[ -f ${EROOT}/etc/lighttpd.conf ]] ; then
+		elog
+		elog "Gentoo has a customized configuration,"
+		elog "which is now located in ${EROOT}/etc/lighttpd. Please migrate your"
+		elog "existing configuration."
+	fi
+
+	if use brotli || use zstd || use zlib ; then
+		elog
+		elog "Remember to clean your cache directory when using"
+		elog "output compression!"
+		elog "https://wiki.lighttpd.net/Docs_ModDeflate"
+	fi
+}
diff --git a/www-servers/lighttpd/metadata.xml b/www-servers/lighttpd/metadata.xml
new file mode 100644
index 000000000000..49184e57c638
--- /dev/null
+++ b/www-servers/lighttpd/metadata.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>sam@gentoo.org</email>
+    <name>Sam James</name>
+  </maintainer>
+  <longdescription lang="en">
+		lighttpd (pronounced /lighty/) is a secure, fast, compliant, and very
+		flexible web server that has been optimized for high-performance
+		environments. lighttpd uses memory and CPU efficiently and has lower
+		resource use than other popular web servers. Its advanced feature-set
+		(FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and much more)
+		make lighttpd the perfect web server for all systems, small and large.
+	</longdescription>
+  <use>
+    <flag name="brotli">Enable output compression via <pkg>app-arch/brotli</pkg> (recommended)</flag>
+    <flag name="gnutls">Build module for TLS via <pkg>net-libs/gnutls</pkg>
+    </flag>
+    <flag name="libdeflate">Enable output compression via <pkg>app-arch/libdeflate</pkg>
+    </flag>
+    <flag name="maxminddb">Add support for geolocation using <pkg>dev-libs/libmaxminddb</pkg>
+    </flag>
+    <flag name="mbedtls">Build module for TLS via <pkg>net-libs/mbedtls</pkg>
+    </flag>
+    <flag name="nettle">Use <pkg>dev-libs/nettle</pkg> as crypto library</flag>
+    <flag name="nss">Build module for TLS via Mozilla's Network Security Services</flag>
+    <flag name="webdav">Enable webdav properties</flag>
+    <flag name="zlib">Enable output compression via gzip or deflate algorithms from <pkg>virtual/zlib</pkg>
+    </flag>
+    <flag name="zstd">Enable output compression via Zstandard (<pkg>app-arch/zstd</pkg>) algorithm</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/mongrel2/Manifest b/www-servers/mongrel2/Manifest
new file mode 100644
index 000000000000..3e5b22d9cc5c
--- /dev/null
+++ b/www-servers/mongrel2/Manifest
@@ -0,0 +1 @@
+DIST mongrel2-1.11.0.tar.gz 1060770 BLAKE2B cbf27e148385e0f659015bf0fae3e027996ba2a4b3189658503faf7b3083c9356ea61cd7bb0d5516fecedd30f1cde8fc3ed74f5f1221a50442df1e209770b87c SHA512 60ee5036c2ac826a08bb1300969f5ad7ec2bc67c7f47635a3b458a0bad6d7e2fa37183c2708d512632c86101f537a4eb64eeef0775137705898480da70d61e90
diff --git a/www-servers/mongrel2/files/mongrel2-1.11.0-fno-common.patch b/www-servers/mongrel2/files/mongrel2-1.11.0-fno-common.patch
new file mode 100644
index 000000000000..1c95f6b7c2d5
--- /dev/null
+++ b/www-servers/mongrel2/files/mongrel2-1.11.0-fno-common.patch
@@ -0,0 +1,31 @@
+--- a/src/mongrel2.c
++++ b/src/mongrel2.c
+@@ -55,6 +55,7 @@
+ #include "logrotate.h"
+ #include "register.h"
+ 
++extern char *m2program;
+ extern int RUNNING;
+ extern uint32_t THE_CURRENT_TIME_IS;
+ int RELOAD = 0;
+--- a/src/unixy.h
++++ b/src/unixy.h
+@@ -38,7 +38,7 @@
+ #include <bstring.h>
+ #include <unistd.h>
+ 
+-char *m2program;
++extern char *m2program;
+ 
+ int Unixy_chroot(bstring path);
+ 
+--- a/tools/procer/procer.c
++++ b/tools/procer/procer.c
+@@ -9,6 +9,7 @@
+ #include <sys/wait.h>
+ #include <sys/stat.h>
+ 
++extern char *m2program;
+ extern char **environ;
+ 
+ static int RUNNING = 1;
diff --git a/www-servers/mongrel2/files/mongrel2-1.11.0-polarssl-platform-590512.patch b/www-servers/mongrel2/files/mongrel2-1.11.0-polarssl-platform-590512.patch
new file mode 100644
index 000000000000..c67dc060c8a4
--- /dev/null
+++ b/www-servers/mongrel2/files/mongrel2-1.11.0-polarssl-platform-590512.patch
@@ -0,0 +1,22 @@
+# Fix missing include for newer mbedtls
+--- a/src/io.h
++++ b/src/io.h
+@@ -6,6 +6,7 @@
+ #endif
+ 
+ #include <stdlib.h>
++#include <mbedtls/platform.h>
+ #include <mbedtls/x509.h>
+ #include <mbedtls/ssl.h>
+ #include "server.h"
+--- a/src/server.h
++++ b/src/server.h
+@@ -39,6 +39,7 @@
+ #include "adt/darray.h"
+ #include "host.h"
+ #include "routing.h"
++#include <mbedtls/platform.h>
+ #include <mbedtls/ssl.h>
+ #include <mbedtls/entropy.h>
+ #include <mbedtls/x509.h>
+
diff --git a/www-servers/mongrel2/files/mongrel2-1.11.0-respect-FLAGS.patch b/www-servers/mongrel2/files/mongrel2-1.11.0-respect-FLAGS.patch
new file mode 100644
index 000000000000..17b5da340067
--- /dev/null
+++ b/www-servers/mongrel2/files/mongrel2-1.11.0-respect-FLAGS.patch
@@ -0,0 +1,146 @@
+--- a/examples/kegogi/Makefile
++++ b/examples/kegogi/Makefile
+@@ -1,4 +1,4 @@
+-CFLAGS=-g -I../../src -Isrc -Wall -Wextra
++CFLAGS+=-I../../src -Isrc -Wall -Wextra
+ LIBS=-lzmq -lsqlite3
+ 
+ all: kegogi
+@@ -8,10 +8,10 @@ install: all
+ 
+ kegogi: src/kegogi.o src/fuzzrnd.o src/kegogi_parser.o src/httpclient.o src/param.o src/kegogi_lexer.o src/kegogi_tokens.o
+ 	mkdir -p build
+-	$(CC) ${CFLAGS} -o build/kegogi src/kegogi.o src/kegogi_parser.o src/kegogi_lexer.o src/fuzzrnd.o src/httpclient.o src/param.o src/kegogi_tokens.o ${LIBS} ../../build/libm2.a
++	$(CC) $(CPPFLAGS) ${CFLAGS} $(LDFLAGS) -o build/kegogi src/kegogi.o src/kegogi_parser.o src/kegogi_lexer.o src/fuzzrnd.o src/httpclient.o src/param.o src/kegogi_tokens.o ${LIBS} ../../build/libm2.a
+ 
+ src/kegogi_lexer.o: src/kegogi_lexer.c
+-	$(CC) $(CFLAGS) -c src/kegogi_lexer.c -o src/kegogi_lexer.o
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -c src/kegogi_lexer.c -o src/kegogi_lexer.o
+ 
+ src/kegogi_lexer.c: src/kegogi_lexer.rl src/kegogi_parser.h
+ 	ragel src/kegogi_lexer.rl -C -o src/kegogi_lexer.c
+--- a/tests/filters/Makefile
++++ b/tests/filters/Makefile
+@@ -1,12 +1,12 @@
+ PREFIX?=/usr/local
+-CFLAGS=-I../../src -I../../src/mbedtls/include $(OPTFLAGS) -fPIC -shared -nostartfiles -L../../build
+-LDFLAGS=$(OPTLIBS)
++CFLAGS+=-I../../src -I../../src/mbedtls/include -fPIC -shared -nostartfiles -L../../build
++LDFLAGS+=$(OPTLIBS)
+ 
+ all: test_filter.so test_filter_a.so test_filter_b.so test_filter_c.so
+ 
+ 
+ %.so : %.c ../../build/libm2.a
+-	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< ../../build/libm2.a
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $< ../../build/libm2.a
+ 
+ clean:
+ 	rm -f *.so
+--- a/tools/config_modules/Makefile
++++ b/tools/config_modules/Makefile
+@@ -1,6 +1,6 @@
+ PREFIX?=/usr/local
+-CFLAGS=-I../../src -I../../src/mbedtls/include $(OPTFLAGS) -fPIC -shared -nostartfiles -L../../build
+-LDFLAGS=$(OPTLIBS)
++CFLAGS+=-I../../src -I../../src/mbedtls/include -fPIC -shared -nostartfiles -L../../build
++LDFLAGS+=$(OPTLIBS)
+ 
+ MONGO_SRC = mongo-c-driver/src/bson.c \
+             mongo-c-driver/src/encoding.c \
+@@ -22,11 +22,11 @@ fetch_mongo_c_driver:
+ mongodb.so: CFLAGS += $(MONGO_CFLAGS)
+ mongodb.so: fetch_mongo_c_driver
+ mongodb.so: mongodb.c
+-	$(CC) $(CFLAGS) -c $(MONGO_SRC)
+-	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< bson.o encoding.o gridfs.o md5.o mongo.o env_posix.o numbers.o ../../build/libm2.a
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -c $(MONGO_SRC)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $< bson.o encoding.o gridfs.o md5.o mongo.o env_posix.o numbers.o ../../build/libm2.a
+ 
+ %.so : %.c
+-	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< ../../build/libm2.a
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $< ../../build/libm2.a
+ 
+ clean:
+ 	rm -f *.o *.so
+--- a/tools/filters/Makefile
++++ b/tools/filters/Makefile
+@@ -1,12 +1,12 @@
+ PREFIX?=/usr/local
+-CFLAGS=-I../../src -I../../src/mbedtls/include $(OPTFLAGS) -g -fPIC -shared -nostartfiles -L../../build
+-LDFLAGS=$(OPTLIBS)
++CFLAGS+=-I../../src -I../../src/mbedtls/include -fPIC -shared -nostartfiles -L../../build
++LDFLAGS+=$(OPTLIBS)
+ 
+ all: null.so rewrite.so sendfile.so
+ 
+ 
+ %.so : %.c
+-	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< ../../build/libm2.a
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $< ../../build/libm2.a
+ 
+ clean:
+ 	rm -f *.so
+--- a/tools/m2sh/Makefile
++++ b/tools/m2sh/Makefile
+@@ -1,4 +1,4 @@
+-CFLAGS=-DNDEBUG -DNO_LINENOS -pthread -g -I../../src -Isrc -Wall $(OPTFLAGS)
++CFLAGS+=-DNDEBUG -DNO_LINENOS -pthread -g -I../../src -Isrc -Wall
+ LIBS=-lzmq -lsqlite3 ../../build/libm2.a $(OPTLIBS)
+ 
+ PREFIX?=/usr/local
+@@ -11,7 +11,7 @@ LIB_OBJ=$(filter-out src/m2sh.o,${OBJECTS})
+ 
+ all: ../lemon/lemon tests build/m2sh
+ 
+-dev: CFLAGS=-g -Wall -Wextra -Isrc -I../../src $(OPTFLAGS)
++dev: CFLAGS+=-Wall -Wextra -Isrc -I../../src $(OPTFLAGS)
+ dev: all
+ 
+ install: build/m2sh
+@@ -19,15 +19,15 @@ install: build/m2sh
+ 
+ build/libm2sh.a: ${LIB_OBJ}
+ 	mkdir -p build
+-	ar rcs $@ ${LIB_OBJ}
+-	ranlib $@
++	$(AR) rcs $@ ${LIB_OBJ}
++	$(RANLIB) $@
+ 
+ build/m2sh: ../lemon/lemon ../../build/libm2.a ${OBJECTS}
+ 	mkdir -p build
+-	$(CC) $(CFLAGS) -o build/m2sh ${OBJECTS} ../../build/libm2.a $(LIBS)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o build/m2sh ${OBJECTS} ../../build/libm2.a $(LIBS)
+ 
+ ../lemon/lemon: ../lemon/lemon.c
+-	$(CC) -O2 ../lemon/lemon.c -o ../lemon/lemon
++	$(CC) $(CPPFLAGS) $(LDFLAGS) ../lemon/lemon.c -o ../lemon/lemon
+ 
+ tests: build/libm2sh.a ${TESTS}
+ 	sh ./tests/runtests.sh
+@@ -39,7 +39,7 @@ tests: build/libm2sh.a ${TESTS}
+ 	ragel -G2 $<
+ 
+ $(TESTS): %: %.c build/libm2sh.a
+-	$(CC) $(CFLAGS) -o $@ $< build/libm2sh.a ../../build/libm2.a $(LIBS)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $< build/libm2sh.a ../../build/libm2.a $(LIBS)
+ 
+ ../../build/libm2.a:
+ 	cd ../.. && make clean all
+--- a/tools/procer/Makefile
++++ b/tools/procer/Makefile
+@@ -1,4 +1,4 @@
+-CFLAGS=-DNDEBUG -pthread -g -I../../src -Wall $(OPTFLAGS)
++CFLAGS+=-DNDEBUG -pthread -g -I../../src -Wall
+ PREFIX?=/usr/local
+ LIBS?=-lzmq 
+ SOURCES=$(wildcard *.c)
+@@ -8,7 +8,7 @@ all: procer
+ 
+ 
+ procer: ../../build/libm2.a ${OBJECTS}
+-	$(CC) $(OPTFLAGS) $(OPTLIBS) -o $@ ${OBJECTS} ../../build/libm2.a ${LIBS}
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ ${OBJECTS} ../../build/libm2.a ${LIBS}
+ 
+ clean:
+ 	rm -f *.o procer
diff --git a/www-servers/mongrel2/files/systemtls.mak b/www-servers/mongrel2/files/systemtls.mak
new file mode 100644
index 000000000000..a536094b3f57
--- /dev/null
+++ b/www-servers/mongrel2/files/systemtls.mak
@@ -0,0 +1,136 @@
+CFLAGS?=-g -O2
+CFLAGS += -Wall -Wextra -I./src -DNDEBUG -D_FILE_OFFSET_BITS=64 -pthread
+LIBS+=-lzmq -ldl -lsqlite3 -lmbedtls -lmbedx509 -lmbedcrypto
+PREFIX?=/usr/local
+
+get_objs = $(addsuffix .o,$(basename $(wildcard $(1))))
+
+ASM=$(wildcard src/**/*.S src/*.S)
+RAGEL_TARGETS=src/state.c src/http11/http11_parser.c
+SOURCES=$(wildcard src/**/*.c src/*.c) $(RAGEL_TARGETS)
+OBJECTS=$(patsubst %.c,%.o,${SOURCES}) $(patsubst %.S,%.o,${ASM})
+OBJECTS_NOEXT=$(filter-out ${OBJECTS_EXTERNAL},${OBJECTS})
+LIB_SRC=$(filter-out src/mongrel2.c,${SOURCES})
+LIB_OBJ=$(filter-out src/mongrel2.o,${OBJECTS})
+TEST_SRC=$(wildcard tests/*_tests.c)
+TESTS=$(patsubst %.c,%,${TEST_SRC})
+MAKEOPTS=OPTFLAGS="${NOEXTCFLAGS} ${OPTFLAGS}" LIBS="${LIBS}" DESTDIR="${DESTDIR}" PREFIX="${PREFIX}"
+
+all: builddirs bin/mongrel2 tests m2sh procer
+
+${OBJECTS_NOEXT}: CFLAGS += ${NOEXTCFLAGS}
+${OBJECTS}:
+
+# 
+# CFLAGS_DEFS: The $(CC) flags required to obtain C pre-processor #defines, per:
+# 
+#   http://nadeausoftware.com/articles/2011/12/c_c_tip_how_list_compiler_predefined_macros
+# 
+# It may be appropriate to copy some of these platform-specific CFLAGS_DEFS assignments into the
+# appropriate platform target at the end of this file, eg:
+# 
+#   solaris: CFLAGS_DEF=...
+#   solaris: all
+
+#CFLAGS_DEFS=-dM -E		# Portland Group PGCC
+#CFLAGS_DEFS=-xdumpmacros -E	# Oracle Solaris Studio
+#CFLAGS_DEFS=-qshowmacros -E	# IBM XL C
+CFLAGS_DEFS=-dM -E -x c 	# clang, gcc, HP C, Intel icc
+
+.PHONY: builddirs
+builddirs:
+	@mkdir -p build
+	@mkdir -p bin
+
+bin/mongrel2: build/libm2.a src/mongrel2.o
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) src/mongrel2.o -o $@ $< $(LIBS)
+
+build/libm2.a: CFLAGS += -fPIC
+build/libm2.a: ${LIB_OBJ}
+	$(AR) rcs $@ ${LIB_OBJ}
+	$(RANLIB) $@
+
+clean:
+	rm -rf build bin lib ${OBJECTS} ${TESTS} tests/config.sqlite
+	rm -f tests/perf.log 
+	rm -f tests/test.pid 
+	rm -f tests/tests.log 
+	rm -f tests/empty.sqlite 
+	rm -f tools/lemon/lemon
+	rm -f tools/m2sh/tests/tests.log 
+	rm -rf release-scripts/output
+	find . \( -name "*.gcno" -o -name "*.gcda" \) -exec rm {} \;
+	${MAKE} -C tools/m2sh OPTLIB=${OPTLIB} clean
+	${MAKE} -C tools/filters OPTLIB=${OPTLIB} clean
+	${MAKE} -C tests/filters OPTLIB=${OPTLIB} clean
+	${MAKE} -C tools/config_modules OPTLIB=${OPTLIB} clean
+	${MAKE} -C tools/procer OPTLIB=${OPTLIB} clean
+
+pristine: clean
+	sudo rm -rf examples/python/build examples/python/dist examples/python/m2py.egg-info
+	sudo find . -name "*.pyc" -exec rm {} \;
+	${MAKE} -C docs/manual clean
+	cd docs/ && ${MAKE} clean
+	${MAKE} -C examples/kegogi clean
+	rm -f logs/*
+	rm -f run/*
+	${MAKE} -C tools/m2sh pristine
+	${MAKE} -C tools/procer pristine
+	git submodule deinit -f src/mbedtls
+
+.PHONY: tests
+tests: tests/config.sqlite ${TESTS} test_filters filters config_modules
+	sh ./tests/runtests.sh
+
+tests/config.sqlite: src/config/config.sql src/config/example.sql src/config/mimetypes.sql
+	sqlite3 $@ < src/config/config.sql
+	sqlite3 $@ < src/config/example.sql
+	sqlite3 $@ < src/config/mimetypes.sql
+
+$(TESTS): %: %.c build/libm2.a
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $< build/libm2.a $(LIBS)
+
+src/state.c: src/state.rl src/state_machine.rl
+src/http11/http11_parser.c: src/http11/http11_parser.rl
+src/http11/httpclient_parser.c: src/http11/httpclient_parser.rl
+
+check:
+	@echo Files with potentially dangerous functions.
+	@egrep '[^_.>a-zA-Z0-9](str(n?cpy|n?cat|xfrm|n?dup|str|pbrk|tok|_)|stpn?cpy|a?sn?printf|byte_)' $(filter-out src/bstr/bsafe.c,${SOURCES})
+
+m2sh: build/libm2.a
+	${MAKE} ${MAKEOPTS} -C tools/m2sh all
+
+procer: build/libm2.a
+	${MAKE} ${MAKEOPTS} -C tools/procer all
+
+test_filters: build/libm2.a
+	${MAKE} ${MAKEOPTS} -C tests/filters all
+
+filters: build/libm2.a
+	${MAKE} ${MAKEOPTS} -C tools/filters all
+
+config_modules: build/libm2.a
+	${MAKE} ${MAKEOPTS} -C tools/config_modules all
+
+# Try to install first before creating target directory and trying again
+install: all
+	install bin/mongrel2 $(DESTDIR)/$(PREFIX)/bin/ \
+	    || ( install -d $(DESTDIR)/$(PREFIX)/bin/ \
+	        && install bin/mongrel2 $(DESTDIR)/$(PREFIX)/bin/ )
+	${MAKE} ${MAKEOPTS} -C tools/m2sh install
+	${MAKE} ${MAKEOPTS} -C tools/config_modules install
+	${MAKE} ${MAKEOPTS} -C tools/filters install
+	${MAKE} ${MAKEOPTS} -C tools/procer install
+
+examples/python/mongrel2/sql/config.sql: src/config/config.sql src/config/mimetypes.sql
+	cat src/config/config.sql src/config/mimetypes.sql > $@
+
+ragel:
+	ragel -G2 src/state.rl
+	ragel -G2 src/http11/http11_parser.rl
+	ragel -G2 src/handler_parser.rl
+	ragel -G2 src/http11/httpclient_parser.rl
+
+%.o: %.S
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -c $< -o $@
diff --git a/www-servers/mongrel2/metadata.xml b/www-servers/mongrel2/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/www-servers/mongrel2/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/mongrel2/mongrel2-1.11.0-r3.ebuild b/www-servers/mongrel2/mongrel2-1.11.0-r3.ebuild
new file mode 100644
index 000000000000..7a3fa27cb5d4
--- /dev/null
+++ b/www-servers/mongrel2/mongrel2-1.11.0-r3.ebuild
@@ -0,0 +1,41 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit toolchain-funcs
+
+DESCRIPTION="A language agnostic web server focused on web applications"
+HOMEPAGE="http://mongrel2.org"
+SRC_URI="https://github.com/${PN}/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+DEPEND="
+	dev-db/sqlite:3
+	>=net-libs/mbedtls-2.1:0=[havege(-)]
+	net-libs/zeromq"
+RDEPEND="${DEPEND}"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-polarssl-platform-590512.patch
+	"${FILESDIR}"/${P}-fno-common.patch
+	"${FILESDIR}"/${PN}-1.11.0-respect-FLAGS.patch
+)
+
+src_prepare() {
+	cp "${FILESDIR}"/systemtls.mak Makefile || die
+	default
+}
+
+src_configure() {
+	tc-export AR CC RANLIB
+	default
+}
+
+src_install() {
+	emake PREFIX="${EPREFIX}"/usr DESTDIR="${D}" install
+	dodoc README examples/configs/mongrel2.conf
+}
diff --git a/www-servers/moonbridge/Manifest b/www-servers/moonbridge/Manifest
new file mode 100644
index 000000000000..6896aebb59fe
--- /dev/null
+++ b/www-servers/moonbridge/Manifest
@@ -0,0 +1 @@
+DIST moonbridge-v1.1.3.tar.gz 53146 BLAKE2B 5996fa05b16d96b17fc00c4aaefdadeaf82904008ab851b4dc755eaea8ad5fa0f5cf220e84fcb1294eadb151529816d837f6550cbd5b0ba50f9d800176acaf79 SHA512 25bedaa8b2eadea6936c237f295cb6bf28b911c2f280f6e755dbdfc38a5f379aabfce30b05aab58defe104aeda7031280eb68deed2cd89767d9760cbff494cfd
diff --git a/www-servers/moonbridge/files/moonbridge-1.0.1-fcntl.patch b/www-servers/moonbridge/files/moonbridge-1.0.1-fcntl.patch
new file mode 100644
index 000000000000..2a1d15b09238
--- /dev/null
+++ b/www-servers/moonbridge/files/moonbridge-1.0.1-fcntl.patch
@@ -0,0 +1,14 @@
+#It is explicitely required to include fcntl.h in musl.
+#Else we get F_SETFD, FD_CLOEXEC undefined errors.
+#
+#Closes: https://bugs.gentoo.org/828671
+--- a/moonbridge.c
++++ b/moonbridge.c
+@@ -36,6 +36,7 @@
+ #include <getopt.h>
+ #include <sys/file.h>
+ #include <syslog.h>
++#include <fcntl.h>
+ #if defined(__FreeBSD__) || __has_include(<libutil.h>)
+ #include <libutil.h>
+ #endif
diff --git a/www-servers/moonbridge/files/moonbridge-1.1.2-gentoo.patch b/www-servers/moonbridge/files/moonbridge-1.1.2-gentoo.patch
new file mode 100644
index 000000000000..bef63d638cf0
--- /dev/null
+++ b/www-servers/moonbridge/files/moonbridge-1.1.2-gentoo.patch
@@ -0,0 +1,19 @@
+--- a/Makefile	2024-01-22 21:51:54.311826889 +0100
++++ b/Makefile	2024-01-22 21:56:48.849198857 +0100
+@@ -53,13 +53,13 @@
+ all:: moonbridge moonbridge_io.so
+ 
+ moonbridge: moonbridge.c moonbridge_io.h moonbridge_io.o
+-	cc -Wall -Wno-unused-result -O2 -Wl,-E -I $(LUA_INCLUDE) -L $(LUA_LIBDIR) -o moonbridge $(MOONBR_LUA_PATH_DEFINE) $(MOONBR_LUA_CPATH_DEFINE) moonbridge.c -lm -l$(LUA_LIBRARY) $(UTIL_FLAGS) moonbridge_io.o
++	$(CC) -Wall -Wno-unused-result $(CFLAGS) -Wl,-E -I $(LUA_INCLUDE) -L $(LUA_LIBDIR) -o moonbridge $(MOONBR_LUA_PATH_DEFINE) $(MOONBR_LUA_CPATH_DEFINE) moonbridge.c $(LUA_LIBRARY) $(UTIL_FLAGS) moonbridge_io.o $(LDFLAGS)
+ 
+ moonbridge_io.o: moonbridge_io.c moonbridge_io.h
+-	cc -c -Wall -O2 -fPIC -I $(LUA_INCLUDE) -o moonbridge_io.o moonbridge_io.c
++	$(CC) -c -Wall $(CFLAGS) -fPIC -I $(LUA_INCLUDE) -o moonbridge_io.o moonbridge_io.c
+ 
+ moonbridge_io.so: moonbridge_io.o
+-	cc -shared -o moonbridge_io.so moonbridge_io.o $(UTIL_FLAGS)
++	$(CC) -shared -o moonbridge_io.so moonbridge_io.o $(UTIL_FLAGS) $(LUA_LIBRARY)
+ 
+ freebsd_with_tls::
+ 	#TODO
diff --git a/www-servers/moonbridge/metadata.xml b/www-servers/moonbridge/metadata.xml
new file mode 100644
index 000000000000..a0399be92e98
--- /dev/null
+++ b/www-servers/moonbridge/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>tupone@gentoo.org</email>
+    <name>Alfredo Tupone</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/moonbridge/moonbridge-1.1.3-r1.ebuild b/www-servers/moonbridge/moonbridge-1.1.3-r1.ebuild
new file mode 100644
index 000000000000..20c094e617cc
--- /dev/null
+++ b/www-servers/moonbridge/moonbridge-1.1.3-r1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 2021-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+
+inherit lua-single toolchain-funcs multiprocessing
+
+MYP=${PN}-v${PV}
+
+DESCRIPTION="Network Server for Lua Applications"
+HOMEPAGE="https://www.public-software-group.org/moonbridge"
+SRC_URI="https://www.public-software-group.org/pub/projects/${PN}/v${PV}/${MYP}.tar.gz
+	https://dev.gentoo.org/~tupone/distfiles/${MYP}.tar.gz"
+S="${WORKDIR}"/${MYP}
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+REQUIRED_USE="${LUA_REQUIRED_USE}"
+DEPEND="
+	${LUA_DEPS}
+	dev-libs/libbsd"
+RDEPEND="${DEPEND}"
+BDEPEND="dev-build/pmake
+	sys-apps/lsb-release
+	virtual/pkgconfig"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.1.2-gentoo.patch
+	"${FILESDIR}"/${PN}-1.0.1-fcntl.patch
+)
+
+DOCS=( README reference.txt )
+
+src_compile() {
+	MAKEFLAGS="" pmake -j$(get_makeopts_jobs) \
+		CC=$(tc-getCC) LUA_INCLUDE="$(lua_get_include_dir)" \
+		MOONBR_LUA_PATH=/usr/lib/moonbridge/?.lua \
+		LUA_LIBRARY="$(lua_get_LIBS)" LUA_LIBDIR=/usr/$(get_libdir) \
+		all || die
+}
+
+src_install() {
+	einstalldocs
+	docinto examples
+	dodoc example_*
+	dodoc helloworld.lua
+	dobin ${PN}
+	insinto /usr/lib/${PN}
+	doins moonbridge_http.lua
+	docompress -x /usr/share/doc/${PF}/examples
+}
diff --git a/www-servers/nginx/Manifest b/www-servers/nginx/Manifest
new file mode 100644
index 000000000000..73783af0b6fb
--- /dev/null
+++ b/www-servers/nginx/Manifest
@@ -0,0 +1,39 @@
+DIST modsecurity-nginx-1.0.3.tar.gz 34063 BLAKE2B 859a29eb7f67d53a818578f1008f0d0debbe37c205bb7c6e79594d8b1a6a0d93988880d35f607ef05ef6d73c9aa887baebfd2c54aca894969beeed4bfe576f37 SHA512 20495884c6b3594edf879a19fd7445f2e74a1628789decd146b3c712764b0507e440a84a64aab619461b044f98b8d641913cfad57a6d0002e7061716bdfe84fc
+DIST nginx-1.26.3.tar.gz 1260179 BLAKE2B 4ef731070e986d98fc1984717dec7fb766ed1a02b196c3ae9a69deea7093d17253b46c06f4eb812a19187be49e42c1a485a54ba3e2e639b5084ef2b0e2287212 SHA512 cd780e495796bf7413e54a6730d11d55127b0ca6563acf5c75eb2698f62cddbbf5ba61820c57b2316c0bb789fcfd17f98a27a84b525ed50f304d1b1043ffa05d
+DIST nginx-1.27.5.tar.gz 1279891 BLAKE2B 6d7fd563d201e8ed985810e418f9981fd0adedf7b40bb3cf8278819a88ecaea148df7df69ff0240cfd028df86d92734e9d20449c2178d3e4b82e78bb0cef3e36 SHA512 5130bc2ec08a962b631ceb741ecb3dc0d84423ca50afb713d9c52c13af1e1bf5e2b0be226936d6dfbc7c2a45b44726ba478a571c6032099bc8ece85fe015ccbc
+DIST nginx-1.29.5.tar.gz 1310203 BLAKE2B 15fd97ce91dcc9b2f882adcafbc6e265e02493bbc0ee0b37b30ac619bc7488a153dafccc1b25cdffa86c5279291345350396984fb6e57a438468424357c31b33 SHA512 721b5f8d5484b4508c3fffc5aa8239212266ad8635ea9e5b2c3d5f0349e0846ab9dd3c1e1409435b30989aa83d4b65113a8ab8854fff725c55b9043f17435235
+DIST nginx-1.29.7.tar.gz 1323485 BLAKE2B 24676ec144681fc82da5c8377b534c42be0f8334af9a3561a56c3b49b3c9e17f91a05553459319e9da4d512fffe8bbba6c6f935cf28e2cfb42773b6e456af856 SHA512 00a39c8e79c98b86f814720c9f1bd87d6ec608c436f6b6dfe18c69e7ac12cb6d04f8717976653b782b59ef5b8dbf3c97c6b577b2e2c33423dd13fbe222ec9e86
+DIST nginx-1.30.0.tar.gz 1324188 BLAKE2B 6a0241e636b087f95a34acc3ddb2c281aacd5e465b2ec02195912acb183a451c2e7124674911b0d54bc02a953adb4942a1965eb371869fb0ddc6313a05b2b572 SHA512 9df502279583ea305e2d7a4cbe67c54cbcdb880f1caf010d582eea8839bda3bc6dd5e244bb79e848a70ad0c9fda9927cb8d9d8c5fc1bc49acc2da9e734543d7c
+DIST nginx-1.30.2.tar.gz 1325247 BLAKE2B 0800ae2326753e2b6d551b03aaad8f2c0fecdce5d34c5497175ff173bcade0dfaf5f24ab3074fcdfe44ef60820e8e901f0461f4c0917cd07b5401424a5f8d64c SHA512 dbba779a15595a77f340795c3a06bf5f846f351a14738f36085b3251f053c6b2946f112640754b8470b541ca45319fb599111cffc06e5cf2ac2384e64d16348c
+DIST nginx-1.31.1.tar.gz 1337505 BLAKE2B 855145c876537eac36cdcc1e6e3c83c9e2880769a14c3588a7413ebe2c8b8505c4541835027bd294e40a295611b6a701d4db362a6c2ce4d2ea30c9ae02e620ef SHA512 054f2aa86eff18b0633e80329d8595bf66d937b0bb55a90d4bbb4d64ece90b49429d9a572c31d8d8a4cdd019ffcc2b9fea3c10d2ff87e7005baa47335d9121f1
+DIST nginx-auth-ldap-42d195d7a7575ebab1c369ad3fc5d78dc2c2669c.tar.gz 18457 BLAKE2B 22225ca9e5299b20ab5a93a001cac48e446bd86b3a24ac49e716bc975b128890bdb4b0dbbf5730fbaaeadfd958160093c7a6af798dd0e6de27062f149a760333 SHA512 ec59637fda5acac053e815cb1d04b545fc6b765e5ec63d8c2c9c301abad87afaa2698145acac08e9e14c91e1423ebff7aff0cca2b940b19ccccbf4cf53973269
+DIST nginx-tests-0b5ec15c62ed.tar.gz 282652 BLAKE2B af41397f88f7aa969749c6dd9a77c58d1835bca24fe764dd0af328d621817f5fb89b3f5b5c0fbd1e7db53d51365e9098b020005e27a531649bd8a51a05b3cbb0 SHA512 c376d23c7001c5203428b664c388e97956cdda8365eb7df57db0da5146d0806f5c35cd1352260d6803d55542f46a90da4a604ebf971055caa77dd6106930558e
+DIST nginx-tests-0f72f59c40de9977bd8f3deff5d200e761b8b683.tar.gz 342145 BLAKE2B b89aea07ef6df58e36448dd43c891dbbc850ea378a53c7d945f743e359d2f7dbb626d694bab67459801a476bbacea4cd5a4928cb91ae2766ab6a675f2873e843 SHA512 c88e0384c76eaff380f37bb4210ae3ca5c2557758cdad132eff68e05ed4ef307d987a5d283f0778ee49d3ba76406e5b94e68a9119ca4f7f597188e0fd3c9c0ca
+DIST nginx-tests-2993130953b28ff4d64ea75b5bd35c92c7e510f7.tar.gz 328153 BLAKE2B 1ed978c53adce580be0d77872edcc3f93097d47c447ec4984b775d80437249f896ab3422248218d4316a49d189c6a28c773e9624adef54b7c077739f1f064599 SHA512 30686b78f64f557b6d1a79280cb165c9a818b0e83578d371370099e6f5bb7769bb4842937bfe61a459678e29cf4d680be8ce5a5c63c1b9aa87989be81e6f80df
+DIST nginx-tests-4d1de3f357afeb91865d024b27516d6b67aad86e.tar.gz 349966 BLAKE2B 00c379997252506e7b2c29b8815455ede0b368f89b9e7ea69b090086e565e988542ab34fcef4764ca2d222457a2808e38d38eb3392bc1ddc8b041b388bcc774c SHA512 60a42f953f73bf375ea70105bbe1df9d55eb2230a5d9fd7d5ca1db5b5f6a012c87426b7ab80b6704122cad369c0cfe4f3f3bc148c6763e955bd603db0e33df04
+DIST nginx-tests-cf90a22921652731302e8a4dc2a88049c723377d.tar.gz 340698 BLAKE2B e9674d915d51ca79b8c405f5bb7dd3e148473338b2f25799fb51092858385defbd5bf6da150d20280a338f5d838d90966fa23ced7101224a292aec200a53d1c2 SHA512 aa756ac38249fa9dc1c54588ef826146024b7bcf5fe7a2fe1d82a46d55597653c41146ba3e743f954ed8ec7380698ecec31893b4fd7d3942f332304d6afe4c47
+DIST nginx-vod-module-1.33.tar.gz 471858 BLAKE2B fa5cb9fd185b30c5c53b25a6f103213b3d04dac5d2d81db72f9749a51548e09e3e17dccc636d748aff8d21c6623484c77fdeb10d70854480759665d140d42e0e SHA512 29ef77f1bbdb2410ff317ebdd7434f31b8ec370ae6b617b92e745e87c11bc820b451181d1d2b57156b414348da14ac448b689b32b17ab418144292eda094512d
+DIST nginx_http_sticky_module_ng-1.2.6-10-g08a395c66e42.tar.bz2 124047 BLAKE2B d37ef9a15c91abe3c6258e420d1f99fa452f9d9966a0e13102174973314a3bac5413957a5fe632a9dcb1163b3be5df8116e05cc053ee061e19319ec25f341570 SHA512 6c1bfdcf89884b2855d51ae7da0f6e53a4ca3629e1aaf58433b70c07dcb2af797ba6e87d9b3eb4fe2fb6d4d697e862f2b4c2f8d8b3fdaea201740c97ec936529
+DIST ngx_brotli-1.0.0rc.tar.gz 16207 BLAKE2B 450d0ea693bd98d4a1b615f2cdcaad41ccd28266f6d80beec7fe77fe750ab8c5d1bb55aabe15161b9b6d819d2b4d99a7774f2706f2f6fd084b52a7c7dddbc00c SHA512 05a880d5e48ac83be84498ed41fb4750211b827a9d7541acfd6ef494e5205a6e853d5594bfec3ab4ae668ea3f803e4f4b0ba550c76811971c8e266e42663c56d
+DIST ngx_devel_kit-0.3.1.tar.gz 66542 BLAKE2B 8242d884464d99a131a48f599f9d0c2b546610f73f646e7eb0dcfdb98220810d949189cffa721360ddbe3b7b8adc8b678a848b9d1a56db6c62fd4439ecb63d24 SHA512 de1e3349d8dd08e5982279b2219dc8a8006739f0409b8e0f5c50d93434beff1fbafba43e9c5ac85a5fab90afc5c0a7244a340610339c36f82f2cba7233e72de9
+DIST ngx_http_auth_pam-1.5.2.tar.gz 7016 BLAKE2B 1efc8d2d12aa09a2b2a36f6f6d0132ac21fcd1720a2843ce598450198e2b7fe902e9ded15a78b66e8a897e811faa872e4e391bf211c795e320c1ccd57607c319 SHA512 b82e401533c44298c41bc9a1caaf3f7850e42da151c06a77a927f817810ebf5ce01c49ca81de42c326345765c784bb55e28fbf0f6a5500626f51e58a216b53c4
+DIST ngx_http_cache_purge-2.3.tar.gz 12248 BLAKE2B f83b267f4c19a9d4af5964522695814c164d200ecd4108bf8f6b5c21388eba8af989bdda646dee18a03174211e8c090a04736bbeb44043cb0e19fbccdc66278e SHA512 50a31dbf2216a6fae74a186af56dec4600cf55777e76a10ac0075f609e7737135aab063a64f2590dddcd0369ebebd4a523027f3d9ebcca74f7b4355be1c5dcc0
+DIST ngx_http_cache_purge-2.5.3.tar.gz 17156 BLAKE2B 50aaaa0bb89975cc912845909085b80c6bcc9adf73b619a7a3034ccf19bee64c891dc15310e0e09e1601125ab5809a33a5af18413d8d5717090c631f31174eec SHA512 aebc9b19a3e7dda3b57e6bd6d86a5ab66d25e05cf5c6c99c71234c789700eb9da8e29529b8b2abf3d775ff3c2610e695fc88e647738769f0d3730bcafc3be38b
+DIST ngx_http_dav_ext-3.0.0.tar.gz 14558 BLAKE2B 0d370bfe34600d43a540dd19a386aa52ce135b2eae14e4e108a359d5ff3405939130d1c802062c7523057ec35d38322d3fbed8c13deb58ce7a08ebf9e3f106d4 SHA512 d0193ba90f1ef46c4e470630c4394bdf99d94fd2e3bd8be6cb2ba1655ec59944b1269025f032b79dc2c6dad366e54389ef6a6da2ddeb91d535a4027f2162fbde
+DIST ngx_http_echo-0.63.tar.gz 53421 BLAKE2B 613d4f265b9bcf9b4a44a18749314075e797dca4b350e6c4bc2e7ddd52edadc52660504ee57d0c859ec0a20f6b2e425727e5ec4b30282e67498010fc8d959baa SHA512 c325ac4e3f3f735739e156d8c7ada503b34475c62533b4830231ff1b42c25cb0c841aae06b3448b589c2ab35da8d211436ed194d6fd062cad925af8152c5e789
+DIST ngx_http_fancyindex-0.4.4.tar.gz 26292 BLAKE2B a1ed76cb31cd4f7a349bcbe63d75f8e00331d0ba4ee9b7b1df41dac77fe64ebe6c72a6fd5f6ebc9de53e8d3a8a2ad5185fbaa533d8ff008fcf92f6956f267d80 SHA512 bf8ebb188c10fee5e6ebcb338fe20fdf859bb88d9b2b0e3da6f3e2f1847738d30760d2642d0dfe257092bdf2399b561631556a3a8e2fb33dc9cd0c59d371c173
+DIST ngx_http_geoip2_module-3.4.tar.gz 8877 BLAKE2B cd59ebbd2ca47f6af0b22b8b91768053d2c991f7adf19941625e3570d81dcb73989101795d641e4efce1eed37d454bca73d603b5d0e4511e3bd63100c7acf750 SHA512 18dea21e5ae2647bea1fc448058a1b773c936917245edef8d861d5e23ed92e9a3b1ec4ef43ffb2ece7b5899d787910adcf4fbd39f84d7e8d7c54759e2fee5b72
+DIST ngx_http_headers_more-0.34.tar.gz 28827 BLAKE2B 48badf603b93601b11c837057760f768ef2579062786bb366795617635747b654cecafa3a230eec1a3e442ab768fb068867ceb93385b14b6452b621764acfd3f SHA512 2c0c140feeb29f0154a223dc3020ff956f894d63e0232a7bc0ca33fcb26f8b807bda868159ae30b6cac7456ec25b831c3d299ea18e234202ae5d14c1ff471a4b
+DIST ngx_http_lua-0.10.25.tar.gz 725616 BLAKE2B b7b766adb76d39edf4ed1fcebea4d696c30b53885923c12e06b6417a63ad5c7e7d926bab8c865b5900b92b3b43126b4d30f92ac6ec941e733f197e5295a0f406 SHA512 01943f2b789b4e385592707f2769a5f4da668415ef9bd0c5263face2fb4146a28137fb8ab8b55056240dad034780601b7966913951cc0c77f4b3aa9eab50ae40
+DIST ngx_http_naxsi-4140b2ded624eb36f04c783c460379b9403012d0.tar.gz 166325 BLAKE2B f80353bfc1f3fc009b847de1c1c5d623a84682efc588649cbd156f669336c95f337442ebf350c79321bf59477215f083817929f13550b22dc7f393583aa16ba1 SHA512 6d6565189d9fabdcf318270107455bb4915d2a43284fb2f77b5cf025a4b4843e990c1c1dbc254e0f3879ca7d30ac7bcd7eb8637f491d5b7f05193aa9865be7cc
+DIST ngx_http_naxsi_libinjection-49904c42a6e68dc8f16c022c693e897e4010a06c.tar.gz 2123473 BLAKE2B 69208f09ca9f10f59f53a3e949894ebc6e51b0ed5708e551759fd8fbc002c83f5a0462fd22eaf52cae290992633729f47403b33c41539437e40700fb7763ac2a SHA512 ed643aaed8d70dae028ec3df48be3aa2c03955073039cd14fb6187bf162cfee9131ab3e5900ddc349526b171f4da0e01e13b39a669cb85838c1f254476a3c1b8
+DIST ngx_http_push_stream-8c02220d484d7848bc8e3a6d9b1c616987e86f66.tar.gz 196994 BLAKE2B 90baeb4fb03aeb309bcf1a987420067ca81843ff9b85b8fc26ba703741571e631826e5928a439a3ae79f2f5e369a3acb2cd803789308642ae757d67722ac7f33 SHA512 ad5424d65909d1cf0c2b64d7a4bc3123f4d3e240f1c9d611f6b6fc41167d169f474c723b1c327d42bd295f973a6365ad32e3f095b8c7c7cddc7e54aea138ca31
+DIST ngx_http_slowfs_cache-1.10.tar.gz 11809 BLAKE2B 54ec1bd0d1cc43cdaafc93ebd46b33374c57351c7f022eae0351d6961680abb03d896e7f058e67c43c4fee300253354feccb92d00e62bf91250e251e1860ec03 SHA512 fbc9609a8d6913aeefe535f206b9e53477503f131934ead2ae5a6169e395af2f5fb54778704824d5eeb22a4ef40a11ebbcde580db62a631f70edcc2cfc06b15d
+DIST ngx_http_upload_progress-68b3ab3b64a0cee7f785d161401c8be357bbed12.tar.gz 17379 BLAKE2B 4790657b3f207eca460a26f5c4d1139dcd495e29fffedab8d716105e6dc3039cbeeecf5f6005d364470951e25b472860b46e3e08bc9573a5a7b4a23f53532f8a SHA512 6603e15aa33edca5e647fd04b4f008f1729c78c527be262ef481890f37a6d57e89609cebfb7459fad18b249024fbe3722e09473987401e8d8dfdd7cf50e4df4f
+DIST ngx_http_upstream_check-9aecf15ec379fe98f62355c57b60c0bc83296f04.tar.gz 130073 BLAKE2B 3c93cef79425a46e22ae39adf13d5ebb0e5d36f5d6be8555ec068dd0017918f5355d82fbbe90ba934e58c52e89c2096e24012f75390c7159d1ebacfaaa112308 SHA512 fad2a0d3ac332b6e67c52e3525f6df8a432df3e92bc173190b8107fba7f24476ab9dae4824630299af68c15e856409bd47a3a79fb5b65e03a5133eb90142b8fc
+DIST ngx_http_vhost_traffic_status-0.2.1.tar.gz 179679 BLAKE2B 3f0f950745695997232f4ae07487e58d798a3a4f2cd0ba8d922865a39e010e1282932469fbeee615a115358f1e9e36f67876fa507fbefb7c146d701ea68a864d SHA512 fadd4727ffc56111b443364d90e5b0597f09b25006404b11377586f0ed754f5a85e0b84796360be927bd455f43eb28e18004991f086b611146cd340937a6e5e9
+DIST ngx_memc_module-0.19.tar.gz 34654 BLAKE2B 536384c264d88535179634d459d3a47b1d9b11885fbce46fbe9fa4df3dce365320b5963c56aecde3b0039d4f9954943d95f25c5f4fada6256861257f82ebbb12 SHA512 a64ec8dffcd011db2cd12b501271bf5c408f2f31fd2bf477b8db4e88adc5bb5732c4c2181ed8378cab6a937869d8f747ef52b22fe256c90df8440b91890edbe7
+DIST ngx_metrics-0.1.1.tar.gz 2964 BLAKE2B 95d71ea26c949c345b83e353bd66a20df18cc8b2b93f692615a1b39c1f327393647f80e7a27e6929799a6e7e3469b61e1cd72f7821f7a820da4dd7cd9a96d85c SHA512 d36a8fb0104c83b6b564e03b351aa750cab08650264c74d6f786af357bfb7006b531a93270dd961896ea8dafe27e5db8548ede714c5f52c4742876bc73af4b5e
+DIST ngx_mogilefs_module-1.0.4.tar.gz 11208 BLAKE2B e0729b66554c8890727190a624d4c9aef6499dfc2e301541a9bfc15690caf6d3155c8a4b8f7a1555a7655b47aa0cd1b797aeb8ba82efa92ab80808218a0bdcff SHA512 b8cb7eaf6274f4e2247dbcb39db05072d2b2d4361256a325fafab5533d7ce0c4ae9e2905b954dfcfa4789c9cab5cccf2ac1c3a1f02f6a327ed95b562d7773ed1
+DIST ngx_rtmp-1.2.2.tar.gz 519934 BLAKE2B 8745816b879f506720955d6c7e5e8af036e88b3601a680071ffb255a3ec31d69e132b5cc8b493202fa985eb30b8529428f683b5154a0054c0ee990d3185c7abf SHA512 3f8c803221854c4b1a06aadc6313fbfec74bd7179c0ee51d4365b26ffa8875881a6e1e48f777a9c9efbb9170ab7478a82920d5448a2c2df485503d37bb03ab81
+DIST njs-0.8.10.tar.gz 942446 BLAKE2B cad84d599f223e143f9e21ec01e40d0aa14a97b6ca2c1e9e2a17cd0806699e1ba04bb03b0840c6bcf0198d38fd3a11adf3f442bf7399fe16933e7ec5fec0672b SHA512 71bcd596383ff501514adcf9baa0fd4d5cd0d3b53b2cdeee7e64b094ba12f6ee0f8fe99849dd8ad71afb6212566253ebdca2b83713d026ddfed3fe7902a5e906
diff --git a/www-servers/nginx/files/http_brotli-detect-brotli-r3.patch b/www-servers/nginx/files/http_brotli-detect-brotli-r3.patch
new file mode 100644
index 000000000000..9ccb8c2379fb
--- /dev/null
+++ b/www-servers/nginx/files/http_brotli-detect-brotli-r3.patch
@@ -0,0 +1,28 @@
+--- a/filter/config
++++ b/filter/config
+@@ -42,22 +42,13 @@ fi
+ ngx_module_type=HTTP_FILTER
+ ngx_module_name=ngx_http_brotli_filter_module
+ 
+-brotli="$ngx_addon_dir/deps/brotli/c"
+-if [ ! -f "$brotli/include/brotli/encode.h" ]; then
+-  brotli="/usr/local"
+-fi
+-if [ ! -f "$brotli/include/brotli/encode.h" ]; then
+-  brotli="/usr"
+-fi
++brotli=$(pkg-config --variable=prefix libbrotlienc)
++
+ if [ ! -f "$brotli/include/brotli/encode.h" ]; then
+ cat << END
+ 
+ $0: error: \
+-Brotli library is missing from the $brotli directory.
+-
+-Please make sure that the git submodule has been checked out:
+-
+-    cd $ngx_addon_dir && git submodule update --init && cd $PWD
++Brotli library not found. Don't you have app-arch/brotli installed?
+ 
+ END
+     exit 1
diff --git a/www-servers/nginx/files/http_cache_purge-1.11.6+.patch b/www-servers/nginx/files/http_cache_purge-1.11.6+.patch
new file mode 100644
index 000000000000..c4596bf97ad1
--- /dev/null
+++ b/www-servers/nginx/files/http_cache_purge-1.11.6+.patch
@@ -0,0 +1,22 @@
+Fix compatibility with nginx-1.11.6+
+
+https://github.com/FRiCKLE/ngx_cache_purge/pull/51
+
+---
+ ngx_cache_purge_module.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/ngx_cache_purge_module.c
++++ b/ngx_cache_purge_module.c
+@@ -492,7 +492,11 @@ typedef struct {
+     ngx_str_t                      body_source;
+ #  endif /* nginx_version < 1007008 */
+ 
++#  if (nginx_version >= 1011006)
++    ngx_http_complex_value_t      *method;
++#  else
+     ngx_str_t                      method;
++#  endif /* nginx_version >= 1011006 */
+     ngx_str_t                      location;
+     ngx_str_t                      url;
+ 
diff --git a/www-servers/nginx/files/http_security-nginx-1.26.2.patch b/www-servers/nginx/files/http_security-nginx-1.26.2.patch
new file mode 100644
index 000000000000..26e3ea6046f0
--- /dev/null
+++ b/www-servers/nginx/files/http_security-nginx-1.26.2.patch
@@ -0,0 +1,26 @@
+From 7d37ace7431ea9704faa98f29876bcd72ef4b1ff Mon Sep 17 00:00:00 2001
+From: Ervin Hegedus <airween@gmail.com>
+Date: Tue, 23 Apr 2024 21:42:02 +0200
+Subject: [PATCH] fix: Added missing header for conftest
+
+---
+ config | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/config b/config
+index c6e7467..3bf06a8 100644
+--- a/config
++++ b/config
+@@ -10,7 +10,8 @@
+ 
+ ngx_feature_name=
+ ngx_feature_run=no
+-ngx_feature_incs="#include <modsecurity/modsecurity.h>"
++ngx_feature_incs="#include <modsecurity/modsecurity.h>
++#include <stdio.h>"
+ ngx_feature_libs="-lmodsecurity"
+ ngx_feature_test='printf("hello");'
+ ngx_modsecurity_opt_I=
+-- 
+2.26.2
+
diff --git a/www-servers/nginx/files/http_sticky-nginx-1.23.0.patch b/www-servers/nginx/files/http_sticky-nginx-1.23.0.patch
new file mode 100644
index 000000000000..da6126eacabb
--- /dev/null
+++ b/www-servers/nginx/files/http_sticky-nginx-1.23.0.patch
@@ -0,0 +1,25 @@
+From 105c946c0c1af93099502417784888acf60da540 Mon Sep 17 00:00:00 2001
+From: Younes El-karama <yelkarama@gmail.com>
+Date: Sat, 2 Jul 2022 04:56:12 +0000
+Subject: [PATCH] make it compatible with nginx 1.23
+
+---
+ ngx_http_sticky_module.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ngx_http_sticky_module.c b/ngx_http_sticky_module.c
+index c9a0a04..37b5bc3 100644
+--- a/ngx_http_sticky_module.c
++++ b/ngx_http_sticky_module.c
+@@ -204,7 +204,7 @@ static ngx_int_t ngx_http_init_sticky_peer(ngx_http_request_t *r, ngx_http_upstr
+ 	iphp->request = r;
+ 
+ 	/* check weather a cookie is present or not and save it */
+-	if (ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &iphp->sticky_conf->cookie_name, &route) != NGX_DECLINED) {
++	if (ngx_http_parse_multi_header_lines(r, r->headers_in.cookie, &iphp->sticky_conf->cookie_name, &route) != NULL) {
+ 		/* a route cookie has been found. Let's give it a try */
+ 		ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "[sticky/init_sticky_peer] got cookie route=%V, let's try to find a matching peer", &route);
+ 
+-- 
+2.36.1
+
diff --git a/www-servers/nginx/files/http_uploadprogress-nginx-1.23.0.patch b/www-servers/nginx/files/http_uploadprogress-nginx-1.23.0.patch
new file mode 100644
index 000000000000..3635aa45b53d
--- /dev/null
+++ b/www-servers/nginx/files/http_uploadprogress-nginx-1.23.0.patch
@@ -0,0 +1,74 @@
+diff -pNura http-uploadprogress.orig/ngx_http_uploadprogress_module.c http-uploadprogress/ngx_http_uploadprogress_module.c
+--- http-uploadprogress.orig/ngx_http_uploadprogress_module.c	2020-10-03 02:05:45.000000000 +0700
++++ http-uploadprogress/ngx_http_uploadprogress_module.c	2022-06-24 16:24:16.196626939 +0700
+@@ -550,12 +550,12 @@ ngx_http_reportuploads_handler(ngx_http_
+     ngx_chain_t                      out;
+     ngx_int_t                        rc, found=0, done=0, err_status=0;
+     off_t                            rest=0, length=0;
+-    ngx_uint_t                       len, i;
++    ngx_uint_t                       len;
+     ngx_slab_pool_t                 *shpool;
+     ngx_http_uploadprogress_conf_t  *upcf;
+     ngx_http_uploadprogress_ctx_t   *ctx;
+     ngx_http_uploadprogress_node_t  *up;
+-    ngx_table_elt_t                 *expires, *cc, **ccp;
++    ngx_table_elt_t                 *expires, *cc;
+     ngx_http_uploadprogress_state_t  state;
+     ngx_http_uploadprogress_template_t  *t;
+ 
+@@ -628,6 +628,7 @@ ngx_http_reportuploads_handler(ngx_http_
+         }
+ 
+         r->headers_out.expires = expires;
++        expires->next = NULL;
+ 
+         expires->hash = 1;
+         expires->key.len = sizeof("Expires") - 1;
+@@ -637,37 +638,30 @@ ngx_http_reportuploads_handler(ngx_http_
+     len = sizeof("Mon, 28 Sep 1970 06:00:00 GMT");
+     expires->value.len = len - 1;
+ 
+-    ccp = r->headers_out.cache_control.elts;
+-    if (ccp == NULL) {
++    cc = r->headers_out.cache_control;
+ 
+-        if (ngx_array_init(&r->headers_out.cache_control, r->pool,
+-                           1, sizeof(ngx_table_elt_t *))
+-            != NGX_OK) {
+-            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+-        }
+-
+-        ccp = ngx_array_push(&r->headers_out.cache_control);
+-        if (ccp == NULL) {
+-            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+-        }
++    if (cc == NULL) {
+ 
+         cc = ngx_list_push(&r->headers_out.headers);
+         if (cc == NULL) {
++            expires->hash = 0;
+             return NGX_HTTP_INTERNAL_SERVER_ERROR;
+         }
+ 
++        r->headers_out.cache_control = cc;
++        cc->next = NULL;
++
+         cc->hash = 1;
+         cc->key.len = sizeof("Cache-Control") - 1;
+         cc->key.data = (u_char *) "Cache-Control";
+ 
+-        *ccp = cc;
+-
+     } else {
+-        for (i = 1; i < r->headers_out.cache_control.nelts; i++) {
+-            ccp[i]->hash = 0;
++        for (cc = cc->next; cc; cc = cc->next) {
++            cc->hash = 0;
+         }
+ 
+-        cc = ccp[0];
++        cc = r->headers_out.cache_control;
++        cc->next = NULL;
+     }
+ 
+     expires->value.data = (u_char *) "Thu, 01 Jan 1970 00:00:01 GMT";
diff --git a/www-servers/nginx/files/http_upstream_check-nginx-1.11.5+.patch b/www-servers/nginx/files/http_upstream_check-nginx-1.11.5+.patch
new file mode 100644
index 000000000000..a894bde8ec34
--- /dev/null
+++ b/www-servers/nginx/files/http_upstream_check-nginx-1.11.5+.patch
@@ -0,0 +1,246 @@
+Upstream: https://github.com/yaoweibin/nginx_upstream_check_module/pull/119
+
+diff --git src/http/modules/ngx_http_upstream_hash_module.c src/http/modules/ngx_http_upstream_hash_module.c
+index 6c28c64..a187887 100644
+--- src/http/modules/ngx_http_upstream_hash_module.c
++++ src/http/modules/ngx_http_upstream_hash_module.c
+@@ -9,6 +9,9 @@
+ #include <ngx_core.h>
+ #include <ngx_http.h>
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++#include "ngx_http_upstream_check_module.h"
++#endif
+ 
+ typedef struct {
+     uint32_t                            hash;
+@@ -235,6 +238,16 @@ ngx_http_upstream_get_hash_peer(ngx_peer_connection_t *pc, void *data)
+             goto next;
+         }
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, pc->log, 0,
++            "get hash peer, check_index: %ui",
++             peer->check_index);
++        if (ngx_http_upstream_check_peer_down(peer->check_index)) {
++            goto next;
++        }
++#endif
++
++
+         if (peer->max_fails
+             && peer->fails >= peer->max_fails
+             && now - peer->checked <= peer->fail_timeout)
+@@ -538,6 +551,15 @@ ngx_http_upstream_get_chash_peer(ngx_peer_connection_t *pc, void *data)
+                 continue;
+             }
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, pc->log, 0,
++                "get consistent_hash peer, check_index: %ui",
++                 peer->check_index);
++            if (ngx_http_upstream_check_peer_down(peer->check_index)) {
++                continue;
++            }
++#endif
++
+             if (peer->server.len != server->len
+                 || ngx_strncmp(peer->server.data, server->data, server->len)
+                    != 0)
+diff --git src/http/modules/ngx_http_upstream_ip_hash_module.c src/http/modules/ngx_http_upstream_ip_hash_module.c
+index 296108f..135ce5d 100644
+--- src/http/modules/ngx_http_upstream_ip_hash_module.c
++++ src/http/modules/ngx_http_upstream_ip_hash_module.c
+@@ -9,6 +9,9 @@
+ #include <ngx_core.h>
+ #include <ngx_http.h>
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++#include "ngx_http_upstream_check_module.h"
++#endif
+ 
+ typedef struct {
+     /* the round robin data must be first */
+@@ -205,6 +208,15 @@ ngx_http_upstream_get_ip_hash_peer(ngx_peer_connection_t *pc, void *data)
+             goto next;
+         }
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, pc->log, 0,
++            "get ip_hash peer, check_index: %ui",
++             peer->check_index);
++        if (ngx_http_upstream_check_peer_down(peer->check_index)) {
++            goto next;
++        }
++#endif
++
+         if (peer->max_fails
+             && peer->fails >= peer->max_fails
+             && now - peer->checked <= peer->fail_timeout)
+diff --git src/http/modules/ngx_http_upstream_least_conn_module.c src/http/modules/ngx_http_upstream_least_conn_module.c
+index ebe0627..94f1883 100644
+--- src/http/modules/ngx_http_upstream_least_conn_module.c
++++ src/http/modules/ngx_http_upstream_least_conn_module.c
+@@ -9,6 +9,10 @@
+ #include <ngx_core.h>
+ #include <ngx_http.h>
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++#include "ngx_http_upstream_check_module.h"
++#endif
++
+ 
+ static ngx_int_t ngx_http_upstream_init_least_conn_peer(ngx_http_request_t *r,
+     ngx_http_upstream_srv_conf_t *us);
+@@ -147,6 +151,16 @@ ngx_http_upstream_get_least_conn_peer(ngx_peer_connection_t *pc, void *data)
+             continue;
+         }
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, pc->log, 0,
++                "get least_conn peer, check_index: %ui",
++                peer->check_index);
++
++        if (ngx_http_upstream_check_peer_down(peer->check_index)) {
++            continue;
++        }
++#endif
++
+         if (peer->max_fails
+             && peer->fails >= peer->max_fails
+             && now - peer->checked <= peer->fail_timeout)
+@@ -202,6 +216,16 @@ ngx_http_upstream_get_least_conn_peer(ngx_peer_connection_t *pc, void *data)
+                 continue;
+             }
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, pc->log, 0,
++                    "get least_conn peer, check_index: %ui",
++                    peer->check_index);
++
++            if (ngx_http_upstream_check_peer_down(peer->check_index)) {
++                continue;
++            }
++#endif
++
+             if (peer->conns * best->weight != best->conns * peer->weight) {
+                 continue;
+             }
+diff --git src/http/ngx_http_upstream_round_robin.c src/http/ngx_http_upstream_round_robin.c
+index 0137bf6..99f0923 100644
+--- src/http/ngx_http_upstream_round_robin.c
++++ src/http/ngx_http_upstream_round_robin.c
+@@ -9,6 +9,9 @@
+ #include <ngx_core.h>
+ #include <ngx_http.h>
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++#include "ngx_http_upstream_check_module.h"
++#endif
+ 
+ #define ngx_http_upstream_tries(p) ((p)->number                               \
+                                     + ((p)->next ? (p)->next->number : 0))
+@@ -97,7 +100,14 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
+                 peer[n].fail_timeout = server[i].fail_timeout;
+                 peer[n].down = server[i].down;
+                 peer[n].server = server[i].name;
+-
++#if (NGX_HTTP_UPSTREAM_CHECK)
++                if (!server[i].down) {
++                    peer[n].check_index =
++                        ngx_http_upstream_check_add_peer(cf, us, &server[i].addrs[j]);
++                } else {
++                    peer[n].check_index = (ngx_uint_t) NGX_ERROR;
++                }
++#endif
+                 *peerp = &peer[n];
+                 peerp = &peer[n].next;
+                 n++;
+@@ -161,7 +171,15 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
+                 peer[n].fail_timeout = server[i].fail_timeout;
+                 peer[n].down = server[i].down;
+                 peer[n].server = server[i].name;
+-
++#if (NGX_HTTP_UPSTREAM_CHECK)
++                if (!server[i].down) {
++                    peer[n].check_index =
++                        ngx_http_upstream_check_add_peer(cf, us, &server[i].addrs[j]);
++                }
++                else {
++                    peer[n].check_index = (ngx_uint_t) NGX_ERROR;
++                }
++#endif
+                 *peerp = &peer[n];
+                 peerp = &peer[n].next;
+                 n++;
+@@ -228,6 +246,9 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
+         peer[i].max_conns = 0;
+         peer[i].max_fails = 1;
+         peer[i].fail_timeout = 10;
++#if (NGX_HTTP_UPSTREAM_CHECK)
++        peer[i].check_index = (ngx_uint_t) NGX_ERROR;
++#endif
+         *peerp = &peer[i];
+         peerp = &peer[i].next;
+     }
+@@ -344,6 +365,9 @@ ngx_http_upstream_create_round_robin_peer(ngx_http_request_t *r,
+         peer[0].max_conns = 0;
+         peer[0].max_fails = 1;
+         peer[0].fail_timeout = 10;
++#if (NGX_HTTP_UPSTREAM_CHECK)
++        peer[0].check_index = (ngx_uint_t) NGX_ERROR;
++#endif
+         peers->peer = peer;
+ 
+     } else {
+@@ -378,6 +402,9 @@ ngx_http_upstream_create_round_robin_peer(ngx_http_request_t *r,
+             peer[i].max_conns = 0;
+             peer[i].max_fails = 1;
+             peer[i].fail_timeout = 10;
++#if (NGX_HTTP_UPSTREAM_CHECK)
++            peer[i].check_index = (ngx_uint_t) NGX_ERROR;
++#endif
+             *peerp = &peer[i];
+             peerp = &peer[i].next;
+         }
+@@ -443,6 +470,12 @@ ngx_http_upstream_get_round_robin_peer(ngx_peer_connection_t *pc, void *data)
+             goto failed;
+         }
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++        if (ngx_http_upstream_check_peer_down(peer->check_index)) {
++            goto failed;
++        }
++#endif
++
+         rrp->current = peer;
+ 
+     } else {
+@@ -537,6 +570,12 @@ ngx_http_upstream_get_peer(ngx_http_upstream_rr_peer_data_t *rrp)
+             continue;
+         }
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++        if (ngx_http_upstream_check_peer_down(peer->check_index)) {
++            continue;
++        }
++#endif
++
+         if (peer->max_fails
+             && peer->fails >= peer->max_fails
+             && now - peer->checked <= peer->fail_timeout)
+diff --git src/http/ngx_http_upstream_round_robin.h src/http/ngx_http_upstream_round_robin.h
+index 45f258d..dee91d0 100644
+--- src/http/ngx_http_upstream_round_robin.h
++++ src/http/ngx_http_upstream_round_robin.h
+@@ -38,6 +38,10 @@ struct ngx_http_upstream_rr_peer_s {
+     ngx_msec_t                      slow_start;
+     ngx_msec_t                      start_time;
+ 
++#if (NGX_HTTP_UPSTREAM_CHECK)
++    ngx_uint_t                      check_index;
++#endif
++
+     ngx_uint_t                      down;
+ 
+ #if (NGX_HTTP_SSL || NGX_COMPAT)
diff --git a/www-servers/nginx/files/nginx-1.23.2-mod_auth_ldap-fix.patch b/www-servers/nginx/files/nginx-1.23.2-mod_auth_ldap-fix.patch
new file mode 100644
index 000000000000..b3b4cf4b33c4
--- /dev/null
+++ b/www-servers/nginx/files/nginx-1.23.2-mod_auth_ldap-fix.patch
@@ -0,0 +1,21 @@
+From f0a5f61d9aad59c23e2c877094a8f17c43bee5b5 Mon Sep 17 00:00:00 2001
+From: freultwah <631910+freultwah@users.noreply.github.com>
+Date: Tue, 23 Aug 2022 18:09:45 +0300
+Subject: [PATCH] Make the module not crash with nginx >1.23.*
+
+---
+ ngx_http_auth_ldap_module.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/ngx_http_auth_ldap_module.c b/ngx_http_auth_ldap_module.c
+index 2f4e592..83b481c 100644
+--- a/ngx_http_auth_ldap_module.c
++++ b/ngx_http_auth_ldap_module.c
+@@ -1779,6 +1779,7 @@ ngx_http_auth_ldap_set_realm(ngx_http_request_t *r, ngx_str_t *realm)
+     }
+ 
+     r->headers_out.www_authenticate->hash = 1;
++    r->headers_out.www_authenticate->next = NULL;
+     r->headers_out.www_authenticate->key.len = sizeof("WWW-Authenticate") - 1;
+     r->headers_out.www_authenticate->key.data = (u_char *) "WWW-Authenticate";
+     r->headers_out.www_authenticate->value = *realm;
diff --git a/www-servers/nginx/files/nginx-1.4.1-fix-perl-install-path.patch b/www-servers/nginx/files/nginx-1.4.1-fix-perl-install-path.patch
new file mode 100644
index 000000000000..601a79ba8a0f
--- /dev/null
+++ b/www-servers/nginx/files/nginx-1.4.1-fix-perl-install-path.patch
@@ -0,0 +1,13 @@
+diff --git a/auto/lib/perl/make b/auto/lib/perl/make
+index 260bd95..857ece6 100644
+--- a/auto/lib/perl/make
++++ b/auto/lib/perl/make
+@@ -35,6 +35,8 @@ $NGX_OBJS/src/http/modules/perl/Makefile: \\
+ 			NGX_DEPS="\$(CORE_DEPS) \$(HTTP_DEPS)" \\
+ 		$NGX_PERL Makefile.PL \\
+ 			LIB=$NGX_PERL_MODULES \\
++			PREFIX=$NGX_PREFIX \\
++			INSTALLDIRS=vendor \\
+ 			INSTALLSITEMAN3DIR=$NGX_PERL_MODULES_MAN
+ 
+ END
diff --git a/www-servers/nginx/files/nginx-httpoxy-mitigation-r1.patch b/www-servers/nginx/files/nginx-httpoxy-mitigation-r1.patch
new file mode 100644
index 000000000000..4a6372ad05f1
--- /dev/null
+++ b/www-servers/nginx/files/nginx-httpoxy-mitigation-r1.patch
@@ -0,0 +1,54 @@
+httpoxy mitigation
+
+See https://httpoxy.org/ and https://www.nginx.com/blog/?p=41962 for details.
+---
+ conf/fastcgi.conf   | 3 +++
+ conf/fastcgi_params | 3 +++
+ conf/scgi_params    | 3 +++
+ conf/uwsgi_params   | 3 +++
+ 4 files changed, 12 insertions(+)
+
+diff --git a/conf/fastcgi.conf b/conf/fastcgi.conf
+index 091738c..9f7e192 100644
+--- a/conf/fastcgi.conf
++++ b/conf/fastcgi.conf
+@@ -24,3 +24,6 @@ fastcgi_param  SERVER_NAME        $server_name;
+ 
+ # PHP only, required if PHP was built with --enable-force-cgi-redirect
+ fastcgi_param  REDIRECT_STATUS    200;
++
++# httpoxy mitigation (https://httpoxy.org/ https://www.nginx.com/blog/?p=41962)
++fastcgi_param  HTTP_PROXY         "";
+diff --git a/conf/fastcgi_params b/conf/fastcgi_params
+index 28decb9..3be3a95 100644
+--- a/conf/fastcgi_params
++++ b/conf/fastcgi_params
+@@ -23,3 +23,6 @@ fastcgi_param  SERVER_NAME        $server_name;
+ 
+ # PHP only, required if PHP was built with --enable-force-cgi-redirect
+ fastcgi_param  REDIRECT_STATUS    200;
++
++# httpoxy mitigation (https://httpoxy.org/ https://www.nginx.com/blog/?p=41962)
++fastcgi_param  HTTP_PROXY         "";
+diff --git a/conf/scgi_params b/conf/scgi_params
+index 6d4ce4f..a9da34f 100644
+--- a/conf/scgi_params
++++ b/conf/scgi_params
+@@ -15,3 +15,6 @@ scgi_param  REMOTE_ADDR        $remote_addr;
+ scgi_param  REMOTE_PORT        $remote_port;
+ scgi_param  SERVER_PORT        $server_port;
+ scgi_param  SERVER_NAME        $server_name;
++
++# httpoxy mitigation (https://httpoxy.org/ https://www.nginx.com/blog/?p=41962)
++scgi_param  HTTP_PROXY         "";
+diff --git a/conf/uwsgi_params b/conf/uwsgi_params
+index 09c732c..9d67d3d 100644
+--- a/conf/uwsgi_params
++++ b/conf/uwsgi_params
+@@ -15,3 +15,6 @@ uwsgi_param  REMOTE_ADDR        $remote_addr;
+ uwsgi_param  REMOTE_PORT        $remote_port;
+ uwsgi_param  SERVER_PORT        $server_port;
+ uwsgi_param  SERVER_NAME        $server_name;
++
++# httpoxy mitigation (https://httpoxy.org/ https://www.nginx.com/blog/?p=41962)
++uwsgi_param  HTTP_PROXY         "";
diff --git a/www-servers/nginx/files/nginx-r1.confd b/www-servers/nginx/files/nginx-r1.confd
new file mode 100644
index 000000000000..35c0d102d432
--- /dev/null
+++ b/www-servers/nginx/files/nginx-r1.confd
@@ -0,0 +1,32 @@
+# /etc/conf.d/nginx
+
+# Configuration file
+#NGINX_CONFIGFILE="/etc/nginx/nginx.conf"
+
+# User to run nginx as
+# If you should ever change this, make sure this user has
+# execution permission on any of your log directories
+# (/var/log/nginx per default) but do NOT forget other log directories
+# one of your vhost(s) maybe using or logging after logrotation will
+# be broken).
+#NGINX_USER="nginx"
+
+# Group to run nginx as
+# See the note above regarding NGINX_USER.
+#NGINX_GROUP="nginx"
+
+# You can use this configuration option to pass additional options to the
+# start-stop-daemon, see start-stop-daemon(8) for more details.
+# Per default we wait 1000ms after we have started the service to ensure
+# that the daemon is really up and running.
+#NGINX_SSDARGS="--wait 1000"
+
+# The termination timeout (start-stop-daemon parameter "retry") ensures
+# that the service will be terminated within a given time (60 + 5 seconds
+# per default) when you are stopping the service.
+#NGINX_TERMTIMEOUT="TERM/60/KILL/5"
+
+# For the 'upgrade' function, this defines the maximum amount of time (in
+# seconds) the script should wait for the new NGINX binary to start before
+# producing an error.
+#NGINX_MAXWAITTIME="3"
diff --git a/www-servers/nginx/files/nginx-r1.tmpfiles b/www-servers/nginx/files/nginx-r1.tmpfiles
new file mode 100644
index 000000000000..eda6d705bbb2
--- /dev/null
+++ b/www-servers/nginx/files/nginx-r1.tmpfiles
@@ -0,0 +1,4 @@
+d /var/cache/nginx 0755 root root
+
+# Clean up the cache only on boot to not break running NGINX
+e! /var/cache/nginx/ - - - 0
diff --git a/www-servers/nginx/files/nginx-r2.logrotate b/www-servers/nginx/files/nginx-r2.logrotate
new file mode 100644
index 000000000000..0e60d7415880
--- /dev/null
+++ b/www-servers/nginx/files/nginx-r2.logrotate
@@ -0,0 +1,11 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+/var/log/nginx/*.log {
+	missingok
+	delaycompress
+	sharedscripts
+	postrotate
+		test -r /run/nginx/nginx.pid && kill -s USR1 "$(cat /run/nginx/nginx.pid)"
+	endscript
+}
diff --git a/www-servers/nginx/files/nginx-r2.service b/www-servers/nginx/files/nginx-r2.service
new file mode 100644
index 000000000000..542afca8a0c2
--- /dev/null
+++ b/www-servers/nginx/files/nginx-r2.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=The NGINX HTTP and reverse proxy server
+After=network.target remote-fs.target nss-lookup.target
+
+[Service]
+Type=forking
+PIDFile=/run/nginx/nginx.pid
+RuntimeDirectory=nginx
+ExecStart=nginx
+ExecReload=kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target
diff --git a/www-servers/nginx/files/nginx-r4.conf b/www-servers/nginx/files/nginx-r4.conf
new file mode 100644
index 000000000000..1144af3d7ceb
--- /dev/null
+++ b/www-servers/nginx/files/nginx-r4.conf
@@ -0,0 +1,39 @@
+user nginx nginx;
+worker_processes auto;
+
+events {
+	# NGINX refuses to start if the 'events' section is not present. Yet,
+	# NGINX does not seem to care whether this section is non-empty.
+}
+
+http {
+	# Maximum hash table size is increased to accommodate for a large
+	# mime.types file that is shipped on Gentoo.
+	types_hash_max_size 4096;
+	include /etc/nginx/mime.types.nginx;
+
+	sendfile on;
+
+	# Example server. Warning: by default, the /var/www/localhost directory is
+	# NOT created; for the following configuration block to work, the
+	# directory must be created manually.
+	server {
+		listen 127.0.0.1;
+		server_name localhost;
+
+		# Substitute the directory below for the one you use.
+		#root /var/www/localhost/htdocs;
+	}
+
+	# SSL server example.
+	#server {
+		#listen 127.0.0.1:443 ssl;
+		#server_name localhost;
+
+		#ssl_certificate /etc/ssl/nginx/nginx.pem;
+		#ssl_certificate_key /etc/ssl/nginx/nginx.key;
+
+		#root /var/www/localhost/htdocs;
+	#}
+
+}
diff --git a/www-servers/nginx/files/nginx-r5.conf b/www-servers/nginx/files/nginx-r5.conf
new file mode 100644
index 000000000000..5c8aae56f380
--- /dev/null
+++ b/www-servers/nginx/files/nginx-r5.conf
@@ -0,0 +1,40 @@
+user nginx nginx;
+worker_processes auto;
+@GENTOO_MODULES_INCLUDE@
+
+events {
+	# NGINX refuses to start if the 'events' section is not present. Yet,
+	# NGINX does not seem to care whether this section is non-empty.
+}
+
+http {
+	# Maximum hash table size is increased to accommodate for a large
+	# mime.types file that is shipped on Gentoo.
+	types_hash_max_size 4096;
+	include mime.types.nginx;
+
+	sendfile on;
+
+	# Example server. Warning: by default, the /var/www/localhost directory is
+	# NOT created; for the following configuration block to work, the
+	# directory must be created manually.
+	server {
+		listen 127.0.0.1;
+		server_name localhost;
+
+		# Substitute the directory below for the one you use.
+		#root /var/www/localhost/htdocs;
+	}
+
+	# SSL server example.
+	#server {
+		#listen 127.0.0.1:443 ssl;
+		#server_name localhost;
+
+		#ssl_certificate /etc/ssl/nginx/nginx.pem;
+		#ssl_certificate_key /etc/ssl/nginx/nginx.key;
+
+		#root /var/www/localhost/htdocs;
+	#}
+
+}
diff --git a/www-servers/nginx/files/nginx-r6.initd b/www-servers/nginx/files/nginx-r6.initd
new file mode 100644
index 000000000000..35c05a9b3bb7
--- /dev/null
+++ b/www-servers/nginx/files/nginx-r6.initd
@@ -0,0 +1,91 @@
+#!/sbin/openrc-run
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+name="NGINX"
+description="Robust, small and high performance HTTP and reverse proxy server"
+description_configtest="Run NGINX's internal config check."
+description_upgrade="Upgrade the NGINX binary without losing connections."
+description_reload="Reload the NGINX configuration without losing connections."
+
+NGINX_CONFIGFILE=${NGINX_CONFIGFILE:-/etc/nginx/${RC_SVCNAME}.conf}
+NGINX_MAXWAITTIME=${NGINX_MAXWAITTIME:-3}
+
+command="/usr/sbin/nginx"
+start_stop_daemon_args=${NGINX_SSDARGS:-"--wait 1000"}
+pidfile="/run/${RC_SVCNAME}/${RC_SVCNAME}.pid"
+user=${NGINX_USER:-nginx}
+group=${NGINX_GROUP:-nginx}
+retry=${NGINX_TERMTIMEOUT:-"TERM/60/KILL/5"}
+command_args="-c \"${NGINX_CONFIGFILE}\" -g 'pid ${pidfile};'"
+
+extra_commands="configtest"
+extra_started_commands="upgrade reload"
+
+depend() {
+	use net dns logger netmount
+}
+
+start_pre() {
+	checkpath -d -m 0755 -o 0:0 "/run/${RC_SVCNAME}"
+}
+
+stop_pre() {
+	if [ "${RC_CMD}" = "restart" ]; then
+		configtest || return 1
+	fi
+}
+
+reload() {
+	ebegin "Refreshing NGINX's configuration"
+	start-stop-daemon --signal SIGHUP --pidfile "${pidfile}"
+	eend $? "Failed to reload NGINX's configuration, please correct the errors above"
+}
+
+upgrade() {
+	einfo "Upgrading NGINX"
+	configtest || { eerror "Unable to upgrade NGINX: Configuration check failed";
+					return 1; }
+
+	einfo "Sending USR2 signal to the old binary"
+	start-stop-daemon --signal SIGUSR2 --pidfile "${pidfile}"
+
+	ebegin "Waiting up to ${NGINX_MAXWAITTIME} seconds for NGINX to upgrade"
+	local startdate pidfile_found
+	pidfile_found=0
+	endtime=$(("$(date +%s)" + NGINX_MAXWAITTIME))
+	while [ "$(date +%s)" -le "${endtime}" ]; do
+		if [ -f "${pidfile}" ] && [ -f "${pidfile}.oldbin" ]; then
+			pidfile_found=1
+			break
+		fi
+		sleep 1
+	done
+
+	[ "${pidfile_found}" = 1 ]
+	if ! eend $?; then
+		eerror "NGINX has failed to upgrade in time. This might have been caused either"
+		eerror "by a configuration error, uncaught by the configuration check, or, more"
+		eerror "likely, by NGINX taking more time to load the configuration than is"
+		eerror "allowed by the NGINX_MAXWAITTIME variable"
+		eerror "The maximum waiting time can be adjusted by setting the NGINX_MAXWAITTIME"
+		eerror "variable to a larger value in /etc/conf.d/nginx"
+		return 1
+	fi
+
+	einfo "Sending QUIT signal to the old binary"
+	start-stop-daemon --signal SIGQUIT --pidfile "${pidfile}.oldbin" ||
+		{ eerror "The old NGINX binary may not have been stopped properly: Sending QUIT signal failed";
+		return 1; }
+
+	einfo "The upgrade has completed successfuly"
+}
+
+configtest() {
+	ebegin "Checking NGINX's configuration"
+	"${command}" -c "${NGINX_CONFIGFILE}" -t
+	if ! eend $?; then
+		eerror "Configuration check failed, please correct the errors above"
+		return 1
+	fi
+}
diff --git a/www-servers/nginx/files/nginx.conf-r3 b/www-servers/nginx/files/nginx.conf-r3
new file mode 100644
index 000000000000..f851bbf8934e
--- /dev/null
+++ b/www-servers/nginx/files/nginx.conf-r3
@@ -0,0 +1,72 @@
+user nginx nginx;
+worker_processes 1;
+
+error_log /var/log/nginx/error_log info;
+
+events {
+	worker_connections 1024;
+	use epoll;
+}
+
+http {
+	include /etc/nginx/mime.types.nginx;
+	types_hash_max_size 4096;
+	default_type application/octet-stream;
+
+	log_format main
+		'$remote_addr - $remote_user [$time_local] '
+		'"$request" $status $bytes_sent '
+		'"$http_referer" "$http_user_agent" '
+		'"$gzip_ratio"';
+
+	client_header_timeout 10m;
+	client_body_timeout 10m;
+	send_timeout 10m;
+
+	connection_pool_size 256;
+	client_header_buffer_size 1k;
+	large_client_header_buffers 4 2k;
+	request_pool_size 4k;
+
+	gzip off;
+
+	output_buffers 1 32k;
+	postpone_output 1460;
+
+	sendfile on;
+	tcp_nopush on;
+	tcp_nodelay on;
+
+	keepalive_timeout 75 20;
+
+	ignore_invalid_headers on;
+
+	index index.html;
+
+	server {
+		listen 127.0.0.1;
+		server_name localhost;
+
+		access_log /var/log/nginx/localhost.access_log main;
+		error_log /var/log/nginx/localhost.error_log info;
+
+		root /var/www/localhost/htdocs;
+	}
+
+	# SSL example
+	#server {
+	#	listen 127.0.0.1:443;
+	#	server_name localhost;
+
+	#	ssl on;
+	#	ssl_certificate /etc/ssl/nginx/nginx.pem;
+	#	ssl_certificate_key /etc/ssl/nginx/nginx.key;
+
+	#	access_log /var/log/nginx/localhost.ssl_access_log main;
+	#	error_log /var/log/nginx/localhost.ssl_error_log info;
+
+	#	root /var/www/localhost/htdocs;
+	#}
+
+	include /etc/nginx/*_vhost.conf;
+}
diff --git a/www-servers/nginx/files/nginx.confd b/www-servers/nginx/files/nginx.confd
new file mode 100644
index 000000000000..478ad588f4e4
--- /dev/null
+++ b/www-servers/nginx/files/nginx.confd
@@ -0,0 +1,35 @@
+# /etc/conf.d/nginx
+
+# Configuration file
+#NGINX_CONFIGFILE="/etc/nginx/nginx.conf"
+
+# PID file
+# If you should ever change this, remember to update
+# "/etc/logrotate.d/nginx", too.
+#NGINX_PIDFILE="/run/nginx/nginx.pid"
+
+# User to run nginx as
+# If you should ever change this, make sure this user has
+# execution permission on any of your log directories
+# (/var/log/nginx per default) but do NOT forget other log directories
+# one of your vhost(s) maybe using or logging after logrotation will
+# be broken).
+#NGINX_USER="nginx"
+
+# Group to run nginx as
+# See the note above regarding NGINX_USER.
+#NGINX_GROUP="nginx"
+
+# You can use this configuration option to pass additional options to the
+# start-stop-daemon, see start-stop-daemon(8) for more details.
+# Per default we wait 1000ms after we have started the service to ensure
+# that the daemon is really up and running.
+#NGINX_SSDARGS="--wait 1000"
+
+# The termination timeout (start-stop-daemon parameter "retry") ensures
+# that the service will be terminated within a given time (60 + 5 seconds
+# per default) when you are stopping the service.
+#NGINX_TERMTIMEOUT="TERM/60/KILL/5"
+
+# Run master process as user (requires configuration with setcap)
+#command_user="${NGINX_USER:-nginx}"
diff --git a/www-servers/nginx/files/nginx.initd-r4 b/www-servers/nginx/files/nginx.initd-r4
new file mode 100644
index 000000000000..c9896289975f
--- /dev/null
+++ b/www-servers/nginx/files/nginx.initd-r4
@@ -0,0 +1,94 @@
+#!/sbin/openrc-run
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="configtest"
+extra_started_commands="upgrade reload"
+
+description="Robust, small and high performance http and reverse proxy server"
+description_configtest="Run nginx' internal config check."
+description_upgrade="Upgrade the nginx binary without losing connections."
+description_reload="Reload the nginx configuration without losing connections."
+
+NGINX_CONFIGFILE=${NGINX_CONFIGFILE:-/etc/nginx/nginx.conf}
+
+command="/usr/sbin/nginx"
+command_args="-c \"${NGINX_CONFIGFILE}\""
+start_stop_daemon_args=${NGINX_SSDARGS:-"--wait 1000"}
+pidfile=${NGINX_PIDFILE:-/run/nginx/nginx.pid}
+user=${NGINX_USER:-nginx}
+group=${NGINX_GROUP:-nginx}
+retry=${NGINX_TERMTIMEOUT:-"TERM/60/KILL/5"}
+
+depend() {
+	need net
+	use dns logger netmount
+}
+
+start_pre() {
+	mkdir -m 0775 -p "/run/nginx"
+	chown -R "${user}:${group}" "/run/nginx"
+	if [ "${RC_CMD}" != "restart" ]; then
+		configtest || return 1
+	fi
+}
+
+stop_pre() {
+	if [ "${RC_CMD}" = "restart" ]; then
+		configtest || return 1
+	fi
+}
+
+stop_post() {
+	rm -f ${pidfile}
+}
+
+reload() {
+	configtest || return 1
+	ebegin "Refreshing nginx' configuration"
+	start-stop-daemon --signal SIGHUP --pidfile "${pidfile}"
+	eend $? "Failed to reload nginx"
+}
+
+upgrade() {
+	configtest || return 1
+	ebegin "Upgrading nginx"
+
+	einfo "Sending USR2 to old binary"
+	start-stop-daemon --signal SIGUSR2 --pidfile "${pidfile}"
+
+	einfo "Sleeping 3 seconds before pid-files checking"
+	sleep 3
+
+	if [ ! -f "${pidfile}.oldbin" ]; then
+		eerror "File with old pid not found"
+		return 1
+	fi
+
+	if [ ! -f "${pidfile}" ]; then
+		eerror "New binary failed to start"
+		return 1
+	fi
+
+	einfo "Sleeping 3 seconds before WINCH"
+	sleep 3
+	# Cannot send "WINCH" using start-stop-daemon yet, https://bugs.gentoo.org/604986
+	kill -WINCH $(cat "${pidfile}.oldbin")
+
+	einfo "Sending QUIT to old binary"
+	start-stop-daemon --signal SIGQUIT --pidfile "${pidfile}.oldbin"
+
+	einfo "Upgrade completed"
+	eend $? "Upgrade failed"
+}
+
+configtest() {
+	ebegin "Checking nginx' configuration"
+	${command} -c "${NGINX_CONFIGFILE}" -t -q
+
+	if [ $? -ne 0 ]; then
+		${command} -c "${NGINX_CONFIGFILE}" -t
+	fi
+
+	eend $? "failed, please correct errors above"
+}
diff --git a/www-servers/nginx/files/nginx.logrotate-r1 b/www-servers/nginx/files/nginx.logrotate-r1
new file mode 100644
index 000000000000..81eca0168ced
--- /dev/null
+++ b/www-servers/nginx/files/nginx.logrotate-r1
@@ -0,0 +1,11 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+/var/log/nginx/*_log {
+	missingok
+	delaycompress
+	sharedscripts
+	postrotate
+		test -r /run/nginx/nginx.pid && kill -USR1 `cat /run/nginx/nginx.pid`
+	endscript
+}
diff --git a/www-servers/nginx/files/nginx.service-r1 b/www-servers/nginx/files/nginx.service-r1
new file mode 100644
index 000000000000..74b023147587
--- /dev/null
+++ b/www-servers/nginx/files/nginx.service-r1
@@ -0,0 +1,16 @@
+[Unit]
+Description=The nginx HTTP and reverse proxy server
+After=network.target remote-fs.target nss-lookup.target
+
+[Service]
+Type=forking
+PIDFile=/run/nginx/nginx.pid
+RuntimeDirectory=nginx
+ExecStartPre=/usr/sbin/nginx -t
+ExecStart=/usr/sbin/nginx
+ExecStartPost=/bin/sleep 0.1
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStop=/bin/kill -QUIT $MAINPID
+
+[Install]
+WantedBy=multi-user.target
diff --git a/www-servers/nginx/files/nginx.tmpfiles b/www-servers/nginx/files/nginx.tmpfiles
new file mode 100644
index 000000000000..af9cdd26973f
--- /dev/null
+++ b/www-servers/nginx/files/nginx.tmpfiles
@@ -0,0 +1,2 @@
+D /var/tmp/nginx 0755 root root
+x /var/tmp/nginx
diff --git a/www-servers/nginx/metadata.xml b/www-servers/nginx/metadata.xml
new file mode 100644
index 000000000000..3daca06282e5
--- /dev/null
+++ b/www-servers/nginx/metadata.xml
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>zurabid2016@gmail.com</email>
+    <name>Zurab Kvachadze</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription>
+		nginx [engine x] is an HTTP and reverse proxy server, a mail proxy server, and a generic
+		TCP/UDP proxy server, originally written by Igor Sysoev.
+	</longdescription>
+  <use>
+    <flag name="aio">Enable asynchronous I/O support</flag>
+    <flag name="debug">Enable support for debugging log</flag>
+    <flag name="http">Enable core HTTP support</flag>
+    <flag name="libatomic">
+			Use <pkg>dev-libs/libatomic_ops</pkg> instead of builtin atomic operations
+		</flag>
+    <flag name="mail">Enable POP3/IMAP4/SMTP mail proxy server</flag>
+    <flag name="modules">Enable loadable module support</flag>
+    <flag name="stream">
+			Enable generic TCP/UDP proxying and load balancing
+		</flag>
+    <flag name="http2">Enable HTTP2 module support</flag>
+    <flag name="http3">Enable HTTP3 module support</flag>
+    <flag name="http-cache">Enable HTTP cache support</flag>
+    <flag name="ktls">Enable Kernel TLS offload (kTLS)</flag>
+    <flag name="pcre-jit">Enable JIT for pcre</flag>
+    <flag name="pcre2">Enable support for pcre2</flag>
+    <flag name="ssl">
+			Enable HTTPS module for http. Enable SSL/TLS support for POP3/IMAP/SMTP for mail.
+		</flag>
+    <flag name="rtmp">NGINX-based Media Streaming Server</flag>
+  </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:f5:nginx</remote-id>
+    <doc>https://nginx.org/en/docs/</doc>
+    <changelog>https://nginx.org/en/CHANGES</changelog>
+    <bugs-to>https://github.com/nginx/nginx/issues</bugs-to>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/nginx/nginx-1.26.3-r2.ebuild b/www-servers/nginx/nginx-1.26.3-r2.ebuild
new file mode 100644
index 000000000000..90a8eb479812
--- /dev/null
+++ b/www-servers/nginx/nginx-1.26.3-r2.ebuild
@@ -0,0 +1,1144 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainer notes:
+# - http_rewrite-independent pcre-support makes sense for matching locations without an actual rewrite
+# - any http-module activates the main http-functionality and overrides USE=-http
+# - keep the following requirements in mind before adding external modules:
+#	* alive upstream
+#	* sane packaging
+#	* builds cleanly
+#	* does not need a patch for nginx core
+# - Update NGINX_TESTS_REV to the current available revision and run tests.
+# - TODO: test the google-perftools module (included in vanilla tarball)
+
+# prevent perl-module from adding automagic perl DEPENDs
+GENTOO_DEPEND_ON_PERL="no"
+
+# devel_kit (https://github.com/simpl/ngx_devel_kit, BSD license)
+DEVEL_KIT_MODULE_PV="0.3.1"
+DEVEL_KIT_MODULE_P="ngx_devel_kit-${DEVEL_KIT_MODULE_PV}"
+DEVEL_KIT_MODULE_URI="https://github.com/simpl/ngx_devel_kit/archive/v${DEVEL_KIT_MODULE_PV}.tar.gz"
+DEVEL_KIT_MODULE_WD="${WORKDIR}/ngx_devel_kit-${DEVEL_KIT_MODULE_PV}"
+
+# ngx_brotli (https://github.com/google/ngx_brotli, BSD-2)
+HTTP_BROTLI_MODULE_PV="1.0.0rc"
+HTTP_BROTLI_MODULE_P="ngx_brotli-${HTTP_BROTLI_MODULE_PV}"
+HTTP_BROTLI_MODULE_URI="https://github.com/google/ngx_brotli/archive/v${HTTP_BROTLI_MODULE_PV}.tar.gz"
+HTTP_BROTLI_MODULE_WD="${WORKDIR}/ngx_brotli-${HTTP_BROTLI_MODULE_PV}"
+
+# http_uploadprogress (https://github.com/masterzen/nginx-upload-progress-module, BSD-2 license)
+HTTP_UPLOAD_PROGRESS_MODULE_PV="68b3ab3b64a0cee7f785d161401c8be357bbed12"
+HTTP_UPLOAD_PROGRESS_MODULE_P="ngx_http_upload_progress-${HTTP_UPLOAD_PROGRESS_MODULE_PV}"
+HTTP_UPLOAD_PROGRESS_MODULE_URI="https://github.com/masterzen/nginx-upload-progress-module/archive/${HTTP_UPLOAD_PROGRESS_MODULE_PV}.tar.gz"
+HTTP_UPLOAD_PROGRESS_MODULE_WD="${WORKDIR}/nginx-upload-progress-module-${HTTP_UPLOAD_PROGRESS_MODULE_PV}"
+
+# http_headers_more (https://github.com/openresty/headers-more-nginx-module, BSD license)
+HTTP_HEADERS_MORE_MODULE_PV="0.34"
+HTTP_HEADERS_MORE_MODULE_P="ngx_http_headers_more-${HTTP_HEADERS_MORE_MODULE_PV}"
+HTTP_HEADERS_MORE_MODULE_URI="https://github.com/openresty/headers-more-nginx-module/archive/v${HTTP_HEADERS_MORE_MODULE_PV}.tar.gz"
+HTTP_HEADERS_MORE_MODULE_WD="${WORKDIR}/headers-more-nginx-module-${HTTP_HEADERS_MORE_MODULE_PV}"
+
+# http_cache_purge (http://labs.frickle.com/nginx_ngx_cache_purge/, https://github.com/FRiCKLE/ngx_cache_purge, BSD-2 license)
+HTTP_CACHE_PURGE_MODULE_PV="2.3"
+HTTP_CACHE_PURGE_MODULE_P="ngx_http_cache_purge-${HTTP_CACHE_PURGE_MODULE_PV}"
+HTTP_CACHE_PURGE_MODULE_URI="http://labs.frickle.com/files/ngx_cache_purge-${HTTP_CACHE_PURGE_MODULE_PV}.tar.gz"
+HTTP_CACHE_PURGE_MODULE_WD="${WORKDIR}/ngx_cache_purge-${HTTP_CACHE_PURGE_MODULE_PV}"
+
+# http_slowfs_cache (http://labs.frickle.com/nginx_ngx_slowfs_cache/, BSD-2 license)
+HTTP_SLOWFS_CACHE_MODULE_PV="1.10"
+HTTP_SLOWFS_CACHE_MODULE_P="ngx_http_slowfs_cache-${HTTP_SLOWFS_CACHE_MODULE_PV}"
+HTTP_SLOWFS_CACHE_MODULE_URI="http://labs.frickle.com/files/ngx_slowfs_cache-${HTTP_SLOWFS_CACHE_MODULE_PV}.tar.gz"
+HTTP_SLOWFS_CACHE_MODULE_WD="${WORKDIR}/ngx_slowfs_cache-${HTTP_SLOWFS_CACHE_MODULE_PV}"
+
+# http_fancyindex (https://github.com/aperezdc/ngx-fancyindex, BSD license)
+HTTP_FANCYINDEX_MODULE_PV="0.4.4"
+HTTP_FANCYINDEX_MODULE_P="ngx_http_fancyindex-${HTTP_FANCYINDEX_MODULE_PV}"
+HTTP_FANCYINDEX_MODULE_URI="https://github.com/aperezdc/ngx-fancyindex/archive/v${HTTP_FANCYINDEX_MODULE_PV}.tar.gz"
+HTTP_FANCYINDEX_MODULE_WD="${WORKDIR}/ngx-fancyindex-${HTTP_FANCYINDEX_MODULE_PV}"
+
+# http_lua (https://github.com/openresty/lua-nginx-module, BSD license)
+HTTP_LUA_MODULE_PV="0.10.25"
+HTTP_LUA_MODULE_P="ngx_http_lua-${HTTP_LUA_MODULE_PV}"
+HTTP_LUA_MODULE_URI="https://github.com/openresty/lua-nginx-module/archive/v${HTTP_LUA_MODULE_PV}.tar.gz"
+HTTP_LUA_MODULE_WD="${WORKDIR}/lua-nginx-module-${HTTP_LUA_MODULE_PV}"
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+
+# http_auth_pam (https://github.com/stogh/ngx_http_auth_pam_module/, http://web.iti.upv.es/~sto/nginx/, BSD-2 license)
+HTTP_AUTH_PAM_MODULE_PV="1.5.2"
+HTTP_AUTH_PAM_MODULE_P="ngx_http_auth_pam-${HTTP_AUTH_PAM_MODULE_PV}"
+HTTP_AUTH_PAM_MODULE_URI="https://github.com/stogh/ngx_http_auth_pam_module/archive/v${HTTP_AUTH_PAM_MODULE_PV}.tar.gz"
+HTTP_AUTH_PAM_MODULE_WD="${WORKDIR}/ngx_http_auth_pam_module-${HTTP_AUTH_PAM_MODULE_PV}"
+
+# http_upstream_check (https://github.com/yaoweibin/nginx_upstream_check_module, BSD license)
+HTTP_UPSTREAM_CHECK_MODULE_PV="9aecf15ec379fe98f62355c57b60c0bc83296f04"
+HTTP_UPSTREAM_CHECK_MODULE_P="ngx_http_upstream_check-${HTTP_UPSTREAM_CHECK_MODULE_PV}"
+HTTP_UPSTREAM_CHECK_MODULE_URI="https://github.com/yaoweibin/nginx_upstream_check_module/archive/${HTTP_UPSTREAM_CHECK_MODULE_PV}.tar.gz"
+HTTP_UPSTREAM_CHECK_MODULE_WD="${WORKDIR}/nginx_upstream_check_module-${HTTP_UPSTREAM_CHECK_MODULE_PV}"
+
+# http_metrics (https://github.com/zenops/ngx_metrics, BSD license)
+HTTP_METRICS_MODULE_PV="0.1.1"
+HTTP_METRICS_MODULE_P="ngx_metrics-${HTTP_METRICS_MODULE_PV}"
+HTTP_METRICS_MODULE_URI="https://github.com/liquidm/ngx_metrics/archive/v${HTTP_METRICS_MODULE_PV}.tar.gz"
+HTTP_METRICS_MODULE_WD="${WORKDIR}/ngx_metrics-${HTTP_METRICS_MODULE_PV}"
+
+# http_vhost_traffic_status (https://github.com/vozlt/nginx-module-vts, BSD license)
+HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV="0.2.1"
+HTTP_VHOST_TRAFFIC_STATUS_MODULE_P="ngx_http_vhost_traffic_status-${HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV}"
+HTTP_VHOST_TRAFFIC_STATUS_MODULE_URI="https://github.com/vozlt/nginx-module-vts/archive/v${HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV}.tar.gz"
+HTTP_VHOST_TRAFFIC_STATUS_MODULE_WD="${WORKDIR}/nginx-module-vts-${HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV}"
+
+# naxsi-core (https://github.com/wargio/naxsi, GPL-3)
+HTTP_NAXSI_MODULE_PV="4140b2ded624eb36f04c783c460379b9403012d0"
+HTTP_NAXSI_MODULE_P="ngx_http_naxsi-${HTTP_NAXSI_MODULE_PV}"
+HTTP_NAXSI_MODULE_URI="https://github.com/wargio/naxsi/archive/${HTTP_NAXSI_MODULE_PV}.tar.gz"
+HTTP_NAXSI_MODULE_WD="${WORKDIR}/naxsi-${HTTP_NAXSI_MODULE_PV}/naxsi_src"
+HTTP_NAXSI_LIBINJECTION_MODULE_PV="49904c42a6e68dc8f16c022c693e897e4010a06c"
+HTTP_NAXSI_LIBINJECTION_MODULE_P="ngx_http_naxsi_libinjection-${HTTP_NAXSI_LIBINJECTION_MODULE_PV}"
+HTTP_NAXSI_LIBINJECTION_MODULE_URI="https://github.com/libinjection/libinjection/archive/${HTTP_NAXSI_LIBINJECTION_MODULE_PV}.tar.gz"
+
+# nginx-rtmp-module (https://github.com/arut/nginx-rtmp-module, BSD license)
+RTMP_MODULE_PV="1.2.2"
+RTMP_MODULE_P="ngx_rtmp-${RTMP_MODULE_PV}"
+RTMP_MODULE_URI="https://github.com/arut/nginx-rtmp-module/archive/v${RTMP_MODULE_PV}.tar.gz"
+RTMP_MODULE_WD="${WORKDIR}/nginx-rtmp-module-${RTMP_MODULE_PV}"
+
+# nginx-dav-ext-module (https://github.com/arut/nginx-dav-ext-module, BSD license)
+HTTP_DAV_EXT_MODULE_PV="3.0.0"
+HTTP_DAV_EXT_MODULE_P="ngx_http_dav_ext-${HTTP_DAV_EXT_MODULE_PV}"
+HTTP_DAV_EXT_MODULE_URI="https://github.com/arut/nginx-dav-ext-module/archive/v${HTTP_DAV_EXT_MODULE_PV}.tar.gz"
+HTTP_DAV_EXT_MODULE_WD="${WORKDIR}/nginx-dav-ext-module-${HTTP_DAV_EXT_MODULE_PV}"
+
+# echo-nginx-module (https://github.com/openresty/echo-nginx-module, BSD license)
+HTTP_ECHO_MODULE_PV="0.63"
+HTTP_ECHO_MODULE_P="ngx_http_echo-${HTTP_ECHO_MODULE_PV}"
+HTTP_ECHO_MODULE_URI="https://github.com/openresty/echo-nginx-module/archive/v${HTTP_ECHO_MODULE_PV}.tar.gz"
+HTTP_ECHO_MODULE_WD="${WORKDIR}/echo-nginx-module-${HTTP_ECHO_MODULE_PV}"
+
+# modsecurity for nginx (https://github.com/SpiderLabs/ModSecurity-nginx, https://github.com/SpiderLabs/ModSecurity, Apache-2.0)
+HTTP_SECURITY_MODULE_PV="1.0.3"
+HTTP_SECURITY_MODULE_P="modsecurity-nginx-${HTTP_SECURITY_MODULE_PV}"
+HTTP_SECURITY_MODULE_URI="https://github.com/SpiderLabs/ModSecurity-nginx/archive/refs/tags/v${HTTP_SECURITY_MODULE_PV}.tar.gz"
+HTTP_SECURITY_MODULE_WD="${WORKDIR}/ModSecurity-nginx-${HTTP_SECURITY_MODULE_PV}"
+
+# push-stream-module (http://www.nginxpushstream.com, https://github.com/wandenberg/nginx-push-stream-module, GPL-3)
+HTTP_PUSH_STREAM_MODULE_PV="8c02220d484d7848bc8e3a6d9b1c616987e86f66"
+HTTP_PUSH_STREAM_MODULE_P="ngx_http_push_stream-${HTTP_PUSH_STREAM_MODULE_PV}"
+HTTP_PUSH_STREAM_MODULE_URI="https://github.com/wandenberg/nginx-push-stream-module/archive/${HTTP_PUSH_STREAM_MODULE_PV}.tar.gz"
+HTTP_PUSH_STREAM_MODULE_WD="${WORKDIR}/nginx-push-stream-module-${HTTP_PUSH_STREAM_MODULE_PV}"
+
+# sticky-module (https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng, BSD-2)
+HTTP_STICKY_MODULE_PV="1.2.6-10-g08a395c66e42"
+HTTP_STICKY_MODULE_P="nginx_http_sticky_module_ng-${HTTP_STICKY_MODULE_PV}"
+HTTP_STICKY_MODULE_URI="https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng/get/${HTTP_STICKY_MODULE_PV}.tar.bz2"
+HTTP_STICKY_MODULE_WD="${WORKDIR}/nginx-goodies-nginx-sticky-module-ng-08a395c66e42"
+
+# mogilefs-module (https://github.com/vkholodkov/nginx-mogilefs-module, BSD-2)
+HTTP_MOGILEFS_MODULE_PV="1.0.4"
+HTTP_MOGILEFS_MODULE_P="ngx_mogilefs_module-${HTTP_MOGILEFS_MODULE_PV}"
+HTTP_MOGILEFS_MODULE_URI="https://github.com/vkholodkov/nginx-mogilefs-module/archive/${HTTP_MOGILEFS_MODULE_PV}.tar.gz"
+HTTP_MOGILEFS_MODULE_WD="${WORKDIR}/nginx_mogilefs_module-${HTTP_MOGILEFS_MODULE_PV}"
+
+# memc-module (https://github.com/openresty/memc-nginx-module, BSD-2)
+HTTP_MEMC_MODULE_PV="0.19"
+HTTP_MEMC_MODULE_P="ngx_memc_module-${HTTP_MEMC_MODULE_PV}"
+HTTP_MEMC_MODULE_URI="https://github.com/openresty/memc-nginx-module/archive/v${HTTP_MEMC_MODULE_PV}.tar.gz"
+HTTP_MEMC_MODULE_WD="${WORKDIR}/memc-nginx-module-${HTTP_MEMC_MODULE_PV}"
+
+# nginx-ldap-auth-module (https://github.com/kvspb/nginx-auth-ldap, BSD-2)
+HTTP_LDAP_MODULE_PV="42d195d7a7575ebab1c369ad3fc5d78dc2c2669c"
+HTTP_LDAP_MODULE_P="nginx-auth-ldap-${HTTP_LDAP_MODULE_PV}"
+HTTP_LDAP_MODULE_URI="https://github.com/kvspb/nginx-auth-ldap/archive/${HTTP_LDAP_MODULE_PV}.tar.gz"
+HTTP_LDAP_MODULE_WD="${WORKDIR}/nginx-auth-ldap-${HTTP_LDAP_MODULE_PV}"
+
+# nginx-vod-module (https://github.com/kaltura/nginx-vod-module, AGPL-3+)
+HTTP_VOD_MODULE_PV="1.33"
+HTTP_VOD_MODULE_P="nginx-vod-module-${HTTP_VOD_MODULE_PV}"
+HTTP_VOD_MODULE_URI="https://github.com/kaltura/nginx-vod-module/archive/${HTTP_VOD_MODULE_PV}.tar.gz"
+HTTP_VOD_MODULE_WD="${WORKDIR}/nginx-vod-module-${HTTP_VOD_MODULE_PV}"
+
+# geoip2 (https://github.com/leev/ngx_http_geoip2_module, BSD-2)
+GEOIP2_MODULE_PV="3.4"
+GEOIP2_MODULE_P="ngx_http_geoip2_module-${GEOIP2_MODULE_PV}"
+GEOIP2_MODULE_URI="https://github.com/leev/ngx_http_geoip2_module/archive/${GEOIP2_MODULE_PV}.tar.gz"
+GEOIP2_MODULE_WD="${WORKDIR}/ngx_http_geoip2_module-${GEOIP2_MODULE_PV}"
+
+# njs-module (https://github.com/nginx/njs, as-is)
+NJS_MODULE_PV="0.8.10"
+NJS_MODULE_P="njs-${NJS_MODULE_PV}"
+NJS_MODULE_URI="https://github.com/nginx/njs/archive/${NJS_MODULE_PV}.tar.gz"
+NJS_MODULE_WD="${WORKDIR}/njs-${NJS_MODULE_PV}"
+
+# nginx-tests (http://hg.nginx.org/nginx-tests, BSD-2)
+NGINX_TESTS_REV="0b5ec15c62ed"
+
+# We handle deps below ourselves
+SSL_DEPS_SKIP=1
+AUTOTOOLS_AUTO_DEPEND="no"
+
+inherit autotools lua-single multiprocessing ssl-cert toolchain-funcs perl-module systemd pax-utils
+
+DESCRIPTION="Robust, small and high performance http and reverse proxy server"
+HOMEPAGE="https://nginx.org"
+SRC_URI="https://nginx.org/download/${P}.tar.gz
+	${DEVEL_KIT_MODULE_URI} -> ${DEVEL_KIT_MODULE_P}.tar.gz
+	nginx_modules_http_auth_ldap? ( ${HTTP_LDAP_MODULE_URI} -> ${HTTP_LDAP_MODULE_P}.tar.gz )
+	nginx_modules_http_auth_pam? ( ${HTTP_AUTH_PAM_MODULE_URI} -> ${HTTP_AUTH_PAM_MODULE_P}.tar.gz )
+	nginx_modules_http_brotli? ( ${HTTP_BROTLI_MODULE_URI} -> ${HTTP_BROTLI_MODULE_P}.tar.gz )
+	nginx_modules_http_cache_purge? ( ${HTTP_CACHE_PURGE_MODULE_URI} -> ${HTTP_CACHE_PURGE_MODULE_P}.tar.gz )
+	nginx_modules_http_dav_ext? ( ${HTTP_DAV_EXT_MODULE_URI} -> ${HTTP_DAV_EXT_MODULE_P}.tar.gz )
+	nginx_modules_http_echo? ( ${HTTP_ECHO_MODULE_URI} -> ${HTTP_ECHO_MODULE_P}.tar.gz )
+	nginx_modules_http_fancyindex? ( ${HTTP_FANCYINDEX_MODULE_URI} -> ${HTTP_FANCYINDEX_MODULE_P}.tar.gz )
+	nginx_modules_http_geoip2? ( ${GEOIP2_MODULE_URI} -> ${GEOIP2_MODULE_P}.tar.gz )
+	nginx_modules_http_headers_more? ( ${HTTP_HEADERS_MORE_MODULE_URI} -> ${HTTP_HEADERS_MORE_MODULE_P}.tar.gz )
+	nginx_modules_http_javascript? ( ${NJS_MODULE_URI} -> ${NJS_MODULE_P}.tar.gz )
+	nginx_modules_http_lua? ( ${HTTP_LUA_MODULE_URI} -> ${HTTP_LUA_MODULE_P}.tar.gz )
+	nginx_modules_http_memc? ( ${HTTP_MEMC_MODULE_URI} -> ${HTTP_MEMC_MODULE_P}.tar.gz )
+	nginx_modules_http_metrics? ( ${HTTP_METRICS_MODULE_URI} -> ${HTTP_METRICS_MODULE_P}.tar.gz )
+	nginx_modules_http_mogilefs? ( ${HTTP_MOGILEFS_MODULE_URI} -> ${HTTP_MOGILEFS_MODULE_P}.tar.gz )
+	nginx_modules_http_naxsi? (
+		${HTTP_NAXSI_MODULE_URI} -> ${HTTP_NAXSI_MODULE_P}.tar.gz
+		${HTTP_NAXSI_LIBINJECTION_MODULE_URI} -> ${HTTP_NAXSI_LIBINJECTION_MODULE_P}.tar.gz
+	)
+	nginx_modules_http_push_stream? ( ${HTTP_PUSH_STREAM_MODULE_URI} -> ${HTTP_PUSH_STREAM_MODULE_P}.tar.gz )
+	nginx_modules_http_security? ( ${HTTP_SECURITY_MODULE_URI} -> ${HTTP_SECURITY_MODULE_P}.tar.gz )
+	nginx_modules_http_slowfs_cache? ( ${HTTP_SLOWFS_CACHE_MODULE_URI} -> ${HTTP_SLOWFS_CACHE_MODULE_P}.tar.gz )
+	nginx_modules_http_sticky? ( ${HTTP_STICKY_MODULE_URI} -> ${HTTP_STICKY_MODULE_P}.tar.bz2 )
+	nginx_modules_http_upload_progress? ( ${HTTP_UPLOAD_PROGRESS_MODULE_URI} -> ${HTTP_UPLOAD_PROGRESS_MODULE_P}.tar.gz )
+	nginx_modules_http_upstream_check? ( ${HTTP_UPSTREAM_CHECK_MODULE_URI} -> ${HTTP_UPSTREAM_CHECK_MODULE_P}.tar.gz )
+	nginx_modules_http_vhost_traffic_status? ( ${HTTP_VHOST_TRAFFIC_STATUS_MODULE_URI} -> ${HTTP_VHOST_TRAFFIC_STATUS_MODULE_P}.tar.gz )
+	nginx_modules_http_vod? ( ${HTTP_VOD_MODULE_URI} -> ${HTTP_VOD_MODULE_P}.tar.gz )
+	nginx_modules_stream_geoip2? ( ${GEOIP2_MODULE_URI} -> ${GEOIP2_MODULE_P}.tar.gz )
+	nginx_modules_stream_javascript? ( ${NJS_MODULE_URI} -> ${NJS_MODULE_P}.tar.gz )
+	rtmp? ( ${RTMP_MODULE_URI} -> ${RTMP_MODULE_P}.tar.gz )
+	test? ( https://hg.nginx.org/nginx-tests/archive/${NGINX_TESTS_REV}.tar.gz -> nginx-tests-${NGINX_TESTS_REV}.tar.gz )"
+
+LICENSE="BSD-2 BSD SSLeay MIT GPL-2 GPL-2+
+	nginx_modules_http_security? ( Apache-2.0 )
+	nginx_modules_http_push_stream? ( GPL-3 )"
+
+SLOT="0"
+KEYWORDS="amd64 arm arm64 ~loong ~ppc ~ppc64 ~riscv x86"
+
+RESTRICT="!test? ( test )"
+
+NGINX_MODULES_STD="access auth_basic autoindex browser charset empty_gif
+	fastcgi geo grpc gzip limit_req limit_conn map memcached mirror
+	proxy referer rewrite scgi ssi split_clients upstream_hash
+	upstream_ip_hash upstream_keepalive upstream_least_conn
+	upstream_zone userid uwsgi"
+NGINX_MODULES_OPT="addition auth_request dav degradation flv geoip gunzip
+	gzip_static image_filter mp4 perl random_index realip secure_link
+	slice stub_status sub xslt"
+NGINX_MODULES_STREAM_STD="access geo limit_conn map return split_clients
+	upstream_hash upstream_least_conn upstream_zone"
+NGINX_MODULES_STREAM_OPT="geoip realip ssl_preread"
+NGINX_MODULES_MAIL="imap pop3 smtp"
+NGINX_MODULES_3RD="
+	http_auth_ldap
+	http_auth_pam
+	http_brotli
+	http_cache_purge
+	http_dav_ext
+	http_echo
+	http_fancyindex
+	http_geoip2
+	http_headers_more
+	http_javascript
+	http_lua
+	http_memc
+	http_metrics
+	http_mogilefs
+	http_naxsi
+	http_push_stream
+	http_security
+	http_slowfs_cache
+	http_sticky
+	http_upload_progress
+	http_upstream_check
+	http_vhost_traffic_status
+	http_vod
+	stream_geoip2
+	stream_javascript
+"
+
+IUSE="aio debug +http +http2 http3 +http-cache ktls libatomic pcre +pcre2 pcre-jit rtmp selinux ssl test threads vim-syntax"
+
+for mod in $NGINX_MODULES_STD; do
+	IUSE="${IUSE} +nginx_modules_http_${mod}"
+done
+
+for mod in $NGINX_MODULES_OPT; do
+	IUSE="${IUSE} nginx_modules_http_${mod}"
+done
+
+for mod in $NGINX_MODULES_STREAM_STD; do
+	IUSE="${IUSE} nginx_modules_stream_${mod}"
+done
+
+for mod in $NGINX_MODULES_STREAM_OPT; do
+	IUSE="${IUSE} nginx_modules_stream_${mod}"
+done
+
+for mod in $NGINX_MODULES_MAIL; do
+	IUSE="${IUSE} nginx_modules_mail_${mod}"
+done
+
+for mod in $NGINX_MODULES_3RD; do
+	IUSE="${IUSE} nginx_modules_${mod}"
+done
+
+# Add so we can warn users updating about config changes
+# @TODO: jbergstroem: remove on next release series
+IUSE="${IUSE} nginx_modules_http_spdy"
+
+CDEPEND="
+	acct-group/nginx
+	acct-user/nginx
+	virtual/libcrypt:=
+	pcre? ( dev-libs/libpcre:= )
+	pcre2? ( dev-libs/libpcre2:= )
+	pcre-jit? ( dev-libs/libpcre:=[jit] )
+	ssl? (
+		dev-libs/openssl:0=
+	)
+	http2? (
+		>=dev-libs/openssl-1.0.1c:0=
+	)
+	http-cache? (
+		dev-libs/openssl:0=
+	)
+	ktls? (
+		>=dev-libs/openssl-3:0=[ktls]
+	)
+	nginx_modules_http_brotli? ( app-arch/brotli:= )
+	nginx_modules_http_geoip? ( dev-libs/geoip )
+	nginx_modules_http_geoip2? ( dev-libs/libmaxminddb:= )
+	nginx_modules_http_gunzip? ( virtual/zlib:= )
+	nginx_modules_http_gzip? ( virtual/zlib:= )
+	nginx_modules_http_gzip_static? ( virtual/zlib:= )
+	nginx_modules_http_image_filter? ( media-libs/gd:=[jpeg,png] )
+	nginx_modules_http_perl? ( >=dev-lang/perl-5.8:= )
+	nginx_modules_http_rewrite? ( dev-libs/libpcre:= )
+	nginx_modules_http_secure_link? ( dev-libs/openssl:0= )
+	nginx_modules_http_xslt? ( dev-libs/libxml2:= dev-libs/libxslt )
+	nginx_modules_http_lua? ( ${LUA_DEPS} )
+	nginx_modules_http_auth_pam? ( sys-libs/pam )
+	nginx_modules_http_metrics? ( dev-libs/yajl:= )
+	nginx_modules_http_dav_ext? ( dev-libs/libxml2:= )
+	nginx_modules_http_security? ( dev-libs/modsecurity:= )
+	nginx_modules_http_auth_ldap? ( net-nds/openldap:=[ssl?] )
+	nginx_modules_http_vod? ( media-video/ffmpeg:0= )
+	nginx_modules_stream_geoip? ( dev-libs/geoip )
+	nginx_modules_stream_geoip2? ( dev-libs/libmaxminddb:= )"
+RDEPEND="${CDEPEND}
+	app-misc/mime-types[nginx]
+	selinux? ( sec-policy/selinux-nginx )
+	!www-servers/nginx:mainline"
+DEPEND="${CDEPEND}
+	arm? ( dev-libs/libatomic_ops )
+	libatomic? ( dev-libs/libatomic_ops )"
+BDEPEND="
+	nginx_modules_http_brotli? ( virtual/pkgconfig )
+	test? (
+		dev-lang/perl
+		dev-perl/Cache-Memcached
+		dev-perl/Cache-Memcached-Fast
+		dev-perl/CryptX
+		dev-perl/FCGI
+		dev-perl/GD
+		dev-perl/Net-SSLeay
+	)"
+# Unpackaged perl modules which would be used by tests
+# Protocol::WebSocket
+# SCGI
+
+# Uwsgi doesn't start in tests
+# www-servers/uwsgi
+
+PDEPEND="vim-syntax? ( app-vim/nginx-syntax )"
+
+REQUIRED_USE="pcre-jit? ( pcre )
+	ktls? ( ssl )
+	nginx_modules_http_fancyindex? ( nginx_modules_http_addition )
+	nginx_modules_http_grpc? ( http2 )
+	nginx_modules_http_lua? (
+		${LUA_REQUIRED_USE}
+		nginx_modules_http_rewrite
+		pcre
+		!pcre2
+	)
+	nginx_modules_http_naxsi? ( nginx_modules_http_rewrite pcre )
+	nginx_modules_http_dav_ext? ( nginx_modules_http_dav nginx_modules_http_xslt )
+	nginx_modules_http_metrics? ( nginx_modules_http_stub_status )
+	nginx_modules_http_security? ( pcre )
+	nginx_modules_http_push_stream? ( ssl )
+	nginx_modules_http_vod? ( threads )"
+
+pkg_setup() {
+	NGINX_HOME="/var/lib/nginx"
+	NGINX_HOME_TMP="${NGINX_HOME}/tmp"
+
+	if use libatomic; then
+		ewarn "GCC 4.1+ features built-in atomic operations."
+		ewarn "Using libatomic_ops is only needed if using"
+		ewarn "a different compiler or a GCC prior to 4.1"
+	fi
+
+	if [[ -n $NGINX_ADD_MODULES ]]; then
+		ewarn "You are building custom modules via \$NGINX_ADD_MODULES!"
+		ewarn "This nginx installation is not supported!"
+		ewarn "Make sure you can reproduce the bug without those modules"
+		ewarn "_before_ reporting bugs."
+	fi
+
+	if use !http; then
+		ewarn "To actually disable all http-functionality you also have to disable"
+		ewarn "all nginx http modules."
+	fi
+
+	if use nginx_modules_http_mogilefs && use threads; then
+		eerror "mogilefs won't compile with threads support."
+		eerror "Please disable either flag and try again."
+		die "Can't compile mogilefs with threads support"
+	fi
+
+	use nginx_modules_http_lua && lua-single_pkg_setup
+}
+
+src_prepare() {
+	eapply "${FILESDIR}/${PN}-1.4.1-fix-perl-install-path.patch"
+	eapply "${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
+
+	if use nginx_modules_http_auth_ldap; then
+		cd "${HTTP_LDAP_MODULE_WD}" || die
+		eapply "${FILESDIR}/${PN}-1.23.2-mod_auth_ldap-fix.patch"
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_javascript; then
+		cd "${NJS_MODULE_WD}" || die
+		sed -e 's/-Werror//g' -i auto/cc || die
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_sticky; then
+		cd "${HTTP_STICKY_MODULE_WD}" || die
+		eapply "${FILESDIR}"/http_sticky-nginx-1.23.0.patch
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_naxsi; then
+		cd "${HTTP_NAXSI_MODULE_WD}" || die
+		rm -r libinjection || die
+		mv ../../libinjection-${HTTP_NAXSI_LIBINJECTION_MODULE_PV} libinjection || die
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_brotli; then
+		cd "${HTTP_BROTLI_MODULE_WD}" || die
+		eapply "${FILESDIR}"/http_brotli-detect-brotli-r3.patch
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_upstream_check; then
+		eapply -p0 "${FILESDIR}"/http_upstream_check-nginx-1.11.5+.patch
+	fi
+
+	if use nginx_modules_http_cache_purge; then
+		cd "${HTTP_CACHE_PURGE_MODULE_WD}" || die
+		eapply "${FILESDIR}"/http_cache_purge-1.11.6+.patch
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_upload_progress; then
+		cd "${HTTP_UPLOAD_PROGRESS_MODULE_WD}" || die
+		eapply "${FILESDIR}"/http_uploadprogress-nginx-1.23.0.patch
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_security ; then
+		cd "${HTTP_SECURITY_MODULE_WD}" || die
+		eapply "${FILESDIR}/http_security-nginx-1.26.2.patch"
+		cd "${S}" || die
+	fi
+
+	find auto/ -type f -print0 | xargs -0 sed -i 's:\&\& make:\&\& \\$(MAKE):' || die
+	# We have config protection, don't rename etc files
+	sed -i 's:.default::' auto/install || die
+	# remove useless files
+	sed -i -e '/koi-/d' -e '/win-/d' auto/install || die
+
+	# don't install to /etc/nginx/ if not in use
+	local module
+	for module in fastcgi scgi uwsgi ; do
+		if ! use nginx_modules_http_${module}; then
+			sed -i -e "/${module}/d" auto/install || die
+		fi
+	done
+
+	eapply_user
+}
+
+src_configure() {
+	local myconf=() http_enabled= mail_enabled= stream_enabled=
+
+	use aio       && myconf+=( --with-file-aio )
+	use debug     && myconf+=( --with-debug )
+	use http2     && myconf+=( --with-http_v2_module )
+	use http3     && myconf+=( --with-http_v3_module )
+	use ktls      && myconf+=( --with-openssl-opt=enable-ktls )
+	use libatomic && myconf+=( --with-libatomic )
+	use pcre      && myconf+=( --with-pcre --without-pcre2 )
+	use pcre-jit  && myconf+=( --with-pcre-jit )
+	use threads   && myconf+=( --with-threads )
+
+	# HTTP modules
+	for mod in $NGINX_MODULES_STD; do
+		if use nginx_modules_http_${mod}; then
+			http_enabled=1
+		else
+			myconf+=( --without-http_${mod}_module )
+		fi
+	done
+
+	for mod in $NGINX_MODULES_OPT; do
+		if use nginx_modules_http_${mod}; then
+			http_enabled=1
+			myconf+=( --with-http_${mod}_module )
+		fi
+	done
+
+	if use nginx_modules_http_fastcgi; then
+		myconf+=( --with-http_realip_module )
+	fi
+
+	# third-party modules
+	if use nginx_modules_http_upload_progress; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_UPLOAD_PROGRESS_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_headers_more; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_HEADERS_MORE_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_cache_purge; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_CACHE_PURGE_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_slowfs_cache; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_SLOWFS_CACHE_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_fancyindex; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_FANCYINDEX_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_lua; then
+		http_enabled=1
+		export LUAJIT_LIB=$(dirname $(lua_get_shared_lib))
+		export LUAJIT_INC=$(lua_get_include_dir)
+		myconf+=( --add-module=${DEVEL_KIT_MODULE_WD} )
+		myconf+=( --add-module=${HTTP_LUA_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_auth_pam; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_AUTH_PAM_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_upstream_check; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_UPSTREAM_CHECK_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_metrics; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_METRICS_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_naxsi ; then
+		http_enabled=1
+		myconf+=(  --add-module=${HTTP_NAXSI_MODULE_WD} )
+	fi
+
+	if use rtmp ; then
+		http_enabled=1
+		myconf+=( --add-module=${RTMP_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_dav_ext ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_DAV_EXT_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_echo ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_ECHO_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_security ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_SECURITY_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_push_stream ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_PUSH_STREAM_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_sticky ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_STICKY_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_mogilefs ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_MOGILEFS_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_memc ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_MEMC_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_auth_ldap; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_LDAP_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_vhost_traffic_status; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_VHOST_TRAFFIC_STATUS_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_geoip2 || use nginx_modules_stream_geoip2; then
+		myconf+=( --add-module=${GEOIP2_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_javascript || use nginx_modules_stream_javascript; then
+		myconf+=( --add-module="${NJS_MODULE_WD}/nginx" )
+	fi
+
+	if use nginx_modules_http_brotli; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_BROTLI_MODULE_WD} )
+	fi
+
+	if use http || use http-cache || use http2 || use http3 || use nginx_modules_http_javascript; then
+		http_enabled=1
+	fi
+
+	if use nginx_modules_http_vod; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_VOD_MODULE_WD} )
+	fi
+
+	if [ $http_enabled ]; then
+		use http-cache || myconf+=( --without-http-cache )
+		use ssl && myconf+=( --with-http_ssl_module )
+	else
+		myconf+=( --without-http --without-http-cache )
+	fi
+
+	# Stream modules
+	for mod in $NGINX_MODULES_STREAM_STD; do
+		if use nginx_modules_stream_${mod}; then
+			stream_enabled=1
+		else
+			myconf+=( --without-stream_${mod}_module )
+		fi
+	done
+
+	for mod in $NGINX_MODULES_STREAM_OPT; do
+		if use nginx_modules_stream_${mod}; then
+			stream_enabled=1
+			myconf+=( --with-stream_${mod}_module )
+		fi
+	done
+
+	if use nginx_modules_stream_geoip2 || use nginx_modules_stream_javascript; then
+		stream_enabled=1
+	fi
+
+	if [ $stream_enabled ]; then
+		myconf+=( --with-stream )
+		use ssl && myconf+=( --with-stream_ssl_module )
+	fi
+
+	# MAIL modules
+	for mod in $NGINX_MODULES_MAIL; do
+		if use nginx_modules_mail_${mod}; then
+			mail_enabled=1
+		else
+			myconf+=( --without-mail_${mod}_module )
+		fi
+	done
+
+	if [ $mail_enabled ]; then
+		myconf+=( --with-mail )
+		use ssl && myconf+=( --with-mail_ssl_module )
+	fi
+
+	# custom modules
+	for mod in $NGINX_ADD_MODULES; do
+		myconf+=(  --add-module=${mod} )
+	done
+
+	# https://bugs.gentoo.org/286772
+	export LANG=C LC_ALL=C
+	tc-export AR CC
+
+	if ! use prefix; then
+		myconf+=( --user=${PN} )
+		myconf+=( --group=${PN} )
+	fi
+
+	if [[ -n "${EXTRA_ECONF}" ]]; then
+		myconf+=( ${EXTRA_ECONF} )
+		ewarn "EXTRA_ECONF applied. Now you are on your own, good luck!"
+	fi
+
+	./configure \
+		--prefix="${EPREFIX}"/usr \
+		--conf-path="${EPREFIX}"/etc/${PN}/${PN}.conf \
+		--error-log-path="${EPREFIX}"/var/log/${PN}/error_log \
+		--pid-path="${EPREFIX}"/run/${PN}/${PN}.pid \
+		--lock-path="${EPREFIX}"/run/lock/${PN}.lock \
+		--with-cc-opt="-I${ESYSROOT}/usr/include" \
+		--with-ld-opt="-L${ESYSROOT}/usr/$(get_libdir)" \
+		--http-log-path="${EPREFIX}"/var/log/${PN}/access_log \
+		--http-client-body-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/client \
+		--http-proxy-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/proxy \
+		--http-fastcgi-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/fastcgi \
+		--http-scgi-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/scgi \
+		--http-uwsgi-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/uwsgi \
+		--with-compat \
+		"${myconf[@]}" || die "configure failed"
+
+	# A purely cosmetic change that makes nginx -V more readable. This can be
+	# good if people outside the gentoo community would troubleshoot and
+	# question the users setup.
+	sed -i -e "s|${WORKDIR}|external_module|g" objs/ngx_auto_config.h || die
+}
+
+src_compile() {
+	# https://bugs.gentoo.org/286772
+	export LANG=C LC_ALL=C
+	emake LINK="${CC} ${LDFLAGS}" OTHERLDFLAGS="${LDFLAGS}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	cp "${FILESDIR}"/nginx.conf-r3 "${ED}"/etc/nginx/nginx.conf || die
+
+	newinitd "${FILESDIR}"/nginx.initd-r4 nginx
+	newconfd "${FILESDIR}"/nginx.confd nginx
+
+	systemd_newunit "${FILESDIR}"/nginx.service-r1 nginx.service
+
+	doman man/nginx.8
+	dodoc CHANGES* README
+
+	# just keepdir. do not copy the default htdocs files (bug #449136)
+	keepdir /var/www/localhost
+	rm -rf "${ED}"/usr/html || die
+
+	# set up a list of directories to keep
+	local keepdir_list="${NGINX_HOME_TMP}"/client
+	local module
+	for module in proxy fastcgi scgi uwsgi; do
+		use nginx_modules_http_${module} && keepdir_list+=" ${NGINX_HOME_TMP}/${module}"
+	done
+
+	keepdir /var/log/nginx ${keepdir_list}
+
+	# this solves a problem with SELinux where nginx doesn't see the directories
+	# as root and tries to create them as nginx
+	fperms 0750 "${NGINX_HOME_TMP}"
+	fowners ${PN}:0 "${NGINX_HOME_TMP}"
+
+	fperms 0700 ${keepdir_list}
+	fowners ${PN}:${PN} ${keepdir_list}
+
+	fperms 0710 /var/log/nginx
+	fowners 0:${PN} /var/log/nginx
+
+	# logrotate
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/nginx.logrotate-r1 nginx
+
+	# Don't create /run
+	rm -rf "${ED}"/run || die
+
+	if use lua_single_target_luajit; then
+		pax-mark m "${ED}/usr/sbin/nginx"
+	fi
+
+	if use nginx_modules_http_perl; then
+		cd "${S}"/objs/src/http/modules/perl/ || die
+		emake DESTDIR="${D}" INSTALLDIRS=vendor
+		perl_delete_localpod
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_cache_purge; then
+		docinto ${HTTP_CACHE_PURGE_MODULE_P}
+		dodoc "${HTTP_CACHE_PURGE_MODULE_WD}"/{CHANGES,README.md,TODO.md}
+	fi
+
+	if use nginx_modules_http_slowfs_cache; then
+		docinto ${HTTP_SLOWFS_CACHE_MODULE_P}
+		dodoc "${HTTP_SLOWFS_CACHE_MODULE_WD}"/{CHANGES,README.md}
+	fi
+
+	if use nginx_modules_http_fancyindex; then
+		docinto ${HTTP_FANCYINDEX_MODULE_P}
+		dodoc "${HTTP_FANCYINDEX_MODULE_WD}"/README.rst
+	fi
+
+	if use nginx_modules_http_lua; then
+		docinto ${HTTP_LUA_MODULE_P}
+		dodoc "${HTTP_LUA_MODULE_WD}"/README.markdown
+		insinto /etc/nginx
+		newins - 00-config.lua_vhost.conf <<-EOF
+			lua_package_path "/etc/nginx/?.lua;;";
+		EOF
+		insinto /etc/nginx/resty
+		touch "${ED}"/etc/nginx/resty/core.lua
+	fi
+
+	if use nginx_modules_http_auth_pam; then
+		docinto ${HTTP_AUTH_PAM_MODULE_P}
+		dodoc "${HTTP_AUTH_PAM_MODULE_WD}"/{README.md,ChangeLog}
+	fi
+
+	if use nginx_modules_http_upstream_check; then
+		docinto ${HTTP_UPSTREAM_CHECK_MODULE_P}
+		dodoc "${HTTP_UPSTREAM_CHECK_MODULE_WD}"/{README,CHANGES}
+	fi
+
+	if use nginx_modules_http_naxsi; then
+		insinto /etc/nginx/naxsi
+		doins "${HTTP_NAXSI_MODULE_WD}"/../distros/nginx/*
+		doins "${HTTP_NAXSI_MODULE_WD}"/../naxsi_rules/naxsi_core.rules
+		doins -r "${HTTP_NAXSI_MODULE_WD}"/../naxsi_rules/blocking
+		doins -r "${HTTP_NAXSI_MODULE_WD}"/../naxsi_rules/whitelists
+	fi
+
+	if use rtmp; then
+		docinto ${RTMP_MODULE_P}
+		dodoc "${RTMP_MODULE_WD}"/{AUTHORS,README.md,stat.xsl}
+	fi
+
+	if use nginx_modules_http_dav_ext; then
+		docinto ${HTTP_DAV_EXT_MODULE_P}
+		dodoc "${HTTP_DAV_EXT_MODULE_WD}"/README.rst
+	fi
+
+	if use nginx_modules_http_echo; then
+		docinto ${HTTP_ECHO_MODULE_P}
+		dodoc "${HTTP_ECHO_MODULE_WD}"/README.markdown
+	fi
+
+	if use nginx_modules_http_security; then
+		docinto ${HTTP_SECURITY_MODULE_P}
+		dodoc "${HTTP_SECURITY_MODULE_WD}"/{AUTHORS,CHANGES,README.md}
+	fi
+
+	if use nginx_modules_http_push_stream; then
+		docinto ${HTTP_PUSH_STREAM_MODULE_P}
+		dodoc "${HTTP_PUSH_STREAM_MODULE_WD}"/{AUTHORS,CHANGELOG.textile,README.textile}
+	fi
+
+	if use nginx_modules_http_sticky; then
+		docinto ${HTTP_STICKY_MODULE_P}
+		dodoc "${HTTP_STICKY_MODULE_WD}"/{README.md,Changelog.txt,docs/sticky.pdf}
+	fi
+
+	if use nginx_modules_http_memc; then
+		docinto ${HTTP_MEMC_MODULE_P}
+		dodoc "${HTTP_MEMC_MODULE_WD}"/README.markdown
+	fi
+
+	if use nginx_modules_http_auth_ldap; then
+		docinto ${HTTP_LDAP_MODULE_P}
+		dodoc "${HTTP_LDAP_MODULE_WD}"/example.conf
+	fi
+
+	if use nginx_modules_http_vod; then
+		docinto ${HTTP_VOD_MODULE_P}
+		dodoc "${HTTP_VOD_MODULE_WD}"/{CHANGELOG,README}.md
+	fi
+}
+
+src_test() {
+	pushd "${WORKDIR}"/nginx-tests-"${NGINX_TESTS_REV}" > /dev/null || die
+
+	# FIXME: unsure why uwsgi fails to start
+	rm uwsgi*.t || die
+
+	local -x TEST_NGINX_BINARY="${S}/objs/nginx"
+	local -x TEST_NGINX_VERBOSE=1
+
+	prove -v -j $(makeopts_jobs) . || die
+	popd > /dev/null || die
+}
+
+pkg_postinst() {
+	if use ssl; then
+		if [[ ! -f "${EROOT}"/etc/ssl/${PN}/${PN}.key ]]; then
+			install_cert /etc/ssl/${PN}/${PN}
+			use prefix || chown ${PN}:${PN} "${EROOT}"/etc/ssl/${PN}/${PN}.{crt,csr,key,pem}
+		fi
+	fi
+
+	if use nginx_modules_http_spdy; then
+		ewarn ""
+		ewarn "In nginx 1.9.5 the spdy module was superseded by http2."
+		ewarn "Update your configs and package.use accordingly."
+	fi
+
+	if use nginx_modules_http_lua; then
+		ewarn ""
+		ewarn "While you can build lua 3rd party module against ${P}"
+		ewarn "the author warns that >=${PN}-1.11.11 is still not an"
+		ewarn "officially supported target yet. You are on your own."
+		ewarn "Expect runtime failures, memory leaks and other problems!"
+	fi
+
+	if use nginx_modules_http_lua && use http2; then
+		ewarn ""
+		ewarn "Lua 3rd party module author warns against using ${P} with"
+		ewarn "NGINX_MODULES_HTTP=\"lua http2\". For more info, see https://git.io/OldLsg"
+	fi
+
+	local _n_permission_layout_checks=0
+	local _has_to_adjust_permissions=0
+	local _has_to_show_permission_warning=0
+
+	# Defaults to 1 to inform people doing a fresh installation
+	# that we ship modified {scgi,uwsgi,fastcgi}_params files
+	local _has_to_show_httpoxy_mitigation_notice=1
+
+	local _replacing_version=
+	for _replacing_version in ${REPLACING_VERSIONS}; do
+		_n_permission_layout_checks=$((${_n_permission_layout_checks}+1))
+
+		if [[ ${_n_permission_layout_checks} -gt 1 ]]; then
+			# Should never happen:
+			# Package is abusing slots but doesn't allow multiple parallel installations.
+			# If we run into this situation it is unsafe to automatically adjust any
+			# permission...
+			_has_to_show_permission_warning=1
+
+			ewarn "Replacing multiple ${PN}' versions is unsupported! " \
+				"You will have to adjust permissions on your own."
+
+			break
+		fi
+
+		local _replacing_version_branch=$(ver_cut 1-2 "${_replacing_version}")
+		debug-print "Updating an existing installation (v${_replacing_version}; branch '${_replacing_version_branch}') ..."
+
+		# Do we need to adjust permissions to fix CVE-2013-0337 (bug #458726, #469094)?
+		# This was before we introduced multiple nginx versions so we
+		# do not need to distinguish between stable and mainline
+		local _need_to_fix_CVE2013_0337=1
+
+		if ver_test ${_replacing_version} -ge 1.4.1-r2; then
+			# We are updating an installation which should already be fixed
+			_need_to_fix_CVE2013_0337=0
+			debug-print "Skipping CVE-2013-0337 ... existing installation should not be affected!"
+		else
+			_has_to_adjust_permissions=1
+			debug-print "Need to adjust permissions to fix CVE-2013-0337!"
+		fi
+
+		# Do we need to inform about HTTPoxy mitigation?
+		# In repository since commit 8be44f76d4ac02cebcd1e0e6e6284bb72d054b0f
+		if ver_test ${_replacing_version_branch} -lt 1.10; then
+			# Updating from <1.10
+			_has_to_show_httpoxy_mitigation_notice=1
+			debug-print "Need to inform about HTTPoxy mitigation!"
+		else
+			# Updating from >=1.10
+			local _fixed_in_pvr=
+			case "${_replacing_version_branch}" in
+				"1.10")
+					_fixed_in_pvr="1.10.1-r2"
+					;;
+				"1.11")
+					_fixed_in_pvr="1.11.3-r1"
+					;;
+				*)
+					# This should be any future branch.
+					# If we run this code it is safe to assume that the user has
+					# already seen the HTTPoxy mitigation notice because he/she is doing
+					# an update from previous version where we have already shown
+					# the warning. Otherwise, we wouldn't hit this code path ...
+					_fixed_in_pvr=
+			esac
+
+			if [[ -z "${_fixed_in_pvr}" ]] || ver_test ${_replacing_version} -ge ${_fixed_in_pvr}; then
+				# We are updating an installation where we already informed
+				# that we are mitigating HTTPoxy per default
+				_has_to_show_httpoxy_mitigation_notice=0
+				debug-print "No need to inform about HTTPoxy mitigation ... information was already shown for existing installation!"
+			else
+				_has_to_show_httpoxy_mitigation_notice=1
+				debug-print "Need to inform about HTTPoxy mitigation!"
+			fi
+		fi
+
+		# Do we need to adjust permissions to fix CVE-2016-1247 (bug #605008)?
+		# All branches up to 1.11 are affected
+		local _need_to_fix_CVE2016_1247=1
+
+		if ver_test ${_replacing_version_branch} -lt 1.10; then
+			# Updating from <1.10
+			_has_to_adjust_permissions=1
+			debug-print "Need to adjust permissions to fix CVE-2016-1247!"
+		else
+			# Updating from >=1.10
+			local _fixed_in_pvr=
+			case "${_replacing_version_branch}" in
+				"1.10")
+					_fixed_in_pvr="1.10.2-r3"
+					;;
+				"1.11")
+					_fixed_in_pvr="1.11.6-r1"
+					;;
+				*)
+					# This should be any future branch.
+					# If we run this code it is safe to assume that we have already
+					# adjusted permissions or were never affected because user is
+					# doing an update from previous version which was safe or did
+					# the adjustments. Otherwise, we wouldn't hit this code path ...
+					_fixed_in_pvr=
+			esac
+
+			if [[ -z "${_fixed_in_pvr}" ]] || ver_test ${_replacing_version} -ge ${_fixed_in_pvr}; then
+				# We are updating an installation which should already be adjusted
+				# or which was never affected
+				_need_to_fix_CVE2016_1247=0
+				debug-print "Skipping CVE-2016-1247 ... existing installation should not be affected!"
+			else
+				_has_to_adjust_permissions=1
+				debug-print "Need to adjust permissions to fix CVE-2016-1247!"
+			fi
+		fi
+	done
+
+	if [[ ${_has_to_adjust_permissions} -eq 1 ]]; then
+		# We do not DIE when chmod/chown commands are failing because
+		# package is already merged on user's system at this stage
+		# and we cannot retry without losing the information that
+		# the existing installation needs to adjust permissions.
+		# Instead we are going to a show a big warning ...
+
+		if [[ ${_has_to_show_permission_warning} -eq 0 ]] && [[ ${_need_to_fix_CVE2013_0337} -eq 1 ]]; then
+			ewarn ""
+			ewarn "The world-readable bit (if set) has been removed from the"
+			ewarn "following directories to mitigate a security bug"
+			ewarn "(CVE-2013-0337, bug #458726):"
+			ewarn ""
+			ewarn "  ${EPREFIX}/var/log/nginx"
+			ewarn "  ${EPREFIX}${NGINX_HOME_TMP}/{,client,proxy,fastcgi,scgi,uwsgi}"
+			ewarn ""
+			ewarn "Check if this is correct for your setup before restarting nginx!"
+			ewarn "This is a one-time change and will not happen on subsequent updates."
+			ewarn "Furthermore nginx' temp directories got moved to '${EPREFIX}${NGINX_HOME_TMP}'"
+			chmod o-rwx \
+				"${EPREFIX}"/var/log/nginx \
+				"${EPREFIX}"${NGINX_HOME_TMP}/{,client,proxy,fastcgi,scgi,uwsgi} || \
+				_has_to_show_permission_warning=1
+		fi
+
+		if [[ ${_has_to_show_permission_warning} -eq 0 ]] && [[ ${_need_to_fix_CVE2016_1247} -eq 1 ]]; then
+			ewarn ""
+			ewarn "The permissions on the following directory have been reset in"
+			ewarn "order to mitigate a security bug (CVE-2016-1247, bug #605008):"
+			ewarn ""
+			ewarn "  ${EPREFIX}/var/log/nginx"
+			ewarn ""
+			ewarn "Check if this is correct for your setup before restarting nginx!"
+			ewarn "Also ensure that no other log directory used by any of your"
+			ewarn "vhost(s) is not writeable for nginx user. Any of your log files"
+			ewarn "used by nginx can be abused to escalate privileges!"
+			ewarn "This is a one-time change and will not happen on subsequent updates."
+			chown 0:nginx "${EPREFIX}"/var/log/nginx || _has_to_show_permission_warning=1
+			chmod 710 "${EPREFIX}"/var/log/nginx || _has_to_show_permission_warning=1
+		fi
+
+		if [[ ${_has_to_show_permission_warning} -eq 1 ]]; then
+			# Should never happen ...
+			ewarn ""
+			ewarn "*************************************************************"
+			ewarn "***************         W A R N I N G         ***************"
+			ewarn "*************************************************************"
+			ewarn "The one-time only attempt to adjust permissions of the"
+			ewarn "existing nginx installation failed. Be aware that we will not"
+			ewarn "try to adjust the same permissions again because now you are"
+			ewarn "using a nginx version where we expect that the permissions"
+			ewarn "are already adjusted or that you know what you are doing and"
+			ewarn "want to keep custom permissions."
+			ewarn ""
+		fi
+	fi
+
+	# Sanity check for CVE-2016-1247
+	# Required to warn users who received the warning above and thought
+	# they could fix it by unmerging and re-merging the package or have
+	# unmerged a affected installation on purpose in the past leaving
+	# /var/log/nginx on their system due to keepdir/non-empty folder
+	# and are now installing the package again.
+	local _sanity_check_testfile=$(mktemp --dry-run "${EPREFIX}"/var/log/nginx/.CVE-2016-1247.XXXXXXXXX)
+	su -s /bin/sh -c "touch ${_sanity_check_testfile}" nginx >&/dev/null
+	if [ $? -eq 0 ] ; then
+		# Cleanup -- no reason to die here!
+		rm -f "${_sanity_check_testfile}"
+
+		ewarn ""
+		ewarn "*************************************************************"
+		ewarn "***************         W A R N I N G         ***************"
+		ewarn "*************************************************************"
+		ewarn "Looks like your installation is vulnerable to CVE-2016-1247"
+		ewarn "(bug #605008) because nginx user is able to create files in"
+		ewarn ""
+		ewarn "  ${EPREFIX}/var/log/nginx"
+		ewarn ""
+		ewarn "Also ensure that no other log directory used by any of your"
+		ewarn "vhost(s) is not writeable for nginx user. Any of your log files"
+		ewarn "used by nginx can be abused to escalate privileges!"
+	fi
+
+	if [[ ${_has_to_show_httpoxy_mitigation_notice} -eq 1 ]]; then
+		# HTTPoxy mitigation
+		ewarn ""
+		ewarn "This nginx installation comes with a mitigation for the HTTPoxy"
+		ewarn "vulnerability for FastCGI, SCGI and uWSGI applications by setting"
+		ewarn "the HTTP_PROXY parameter to an empty string per default when you"
+		ewarn "are sourcing one of the default"
+		ewarn ""
+		ewarn "  - 'fastcgi_params' or 'fastcgi.conf'"
+		ewarn "  - 'scgi_params'"
+		ewarn "  - 'uwsgi_params'"
+		ewarn ""
+		ewarn "files in your server block(s)."
+		ewarn ""
+		ewarn "If this is causing any problems for you make sure that you are sourcing the"
+		ewarn "default parameters _before_ you set your own values."
+		ewarn "If you are relying on user-supplied proxy values you have to remove the"
+		ewarn "correlating lines from the file(s) mentioned above."
+		ewarn ""
+	fi
+}
diff --git a/www-servers/nginx/nginx-1.27.5-r1.ebuild b/www-servers/nginx/nginx-1.27.5-r1.ebuild
new file mode 100644
index 000000000000..a5ac25de4edd
--- /dev/null
+++ b/www-servers/nginx/nginx-1.27.5-r1.ebuild
@@ -0,0 +1,1132 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainer notes:
+# - http_rewrite-independent pcre-support makes sense for matching locations without an actual rewrite
+# - any http-module activates the main http-functionality and overrides USE=-http
+# - keep the following requirements in mind before adding external modules:
+#	* alive upstream
+#	* sane packaging
+#	* builds cleanly
+#	* does not need a patch for nginx core
+# - Update NGINX_TESTS_REV to the current available revision and run tests.
+# - TODO: test the google-perftools module (included in vanilla tarball)
+
+# prevent perl-module from adding automagic perl DEPENDs
+GENTOO_DEPEND_ON_PERL="no"
+
+# devel_kit (https://github.com/simpl/ngx_devel_kit, BSD license)
+DEVEL_KIT_MODULE_PV="0.3.1"
+DEVEL_KIT_MODULE_P="ngx_devel_kit-${DEVEL_KIT_MODULE_PV}"
+DEVEL_KIT_MODULE_URI="https://github.com/simpl/ngx_devel_kit/archive/v${DEVEL_KIT_MODULE_PV}.tar.gz"
+DEVEL_KIT_MODULE_WD="${WORKDIR}/ngx_devel_kit-${DEVEL_KIT_MODULE_PV}"
+
+# ngx_brotli (https://github.com/google/ngx_brotli, BSD-2)
+HTTP_BROTLI_MODULE_PV="1.0.0rc"
+HTTP_BROTLI_MODULE_P="ngx_brotli-${HTTP_BROTLI_MODULE_PV}"
+HTTP_BROTLI_MODULE_URI="https://github.com/google/ngx_brotli/archive/v${HTTP_BROTLI_MODULE_PV}.tar.gz"
+HTTP_BROTLI_MODULE_WD="${WORKDIR}/ngx_brotli-${HTTP_BROTLI_MODULE_PV}"
+
+# http_uploadprogress (https://github.com/masterzen/nginx-upload-progress-module, BSD-2 license)
+HTTP_UPLOAD_PROGRESS_MODULE_PV="68b3ab3b64a0cee7f785d161401c8be357bbed12"
+HTTP_UPLOAD_PROGRESS_MODULE_P="ngx_http_upload_progress-${HTTP_UPLOAD_PROGRESS_MODULE_PV}"
+HTTP_UPLOAD_PROGRESS_MODULE_URI="https://github.com/masterzen/nginx-upload-progress-module/archive/${HTTP_UPLOAD_PROGRESS_MODULE_PV}.tar.gz"
+HTTP_UPLOAD_PROGRESS_MODULE_WD="${WORKDIR}/nginx-upload-progress-module-${HTTP_UPLOAD_PROGRESS_MODULE_PV}"
+
+# http_headers_more (https://github.com/openresty/headers-more-nginx-module, BSD license)
+HTTP_HEADERS_MORE_MODULE_PV="0.34"
+HTTP_HEADERS_MORE_MODULE_P="ngx_http_headers_more-${HTTP_HEADERS_MORE_MODULE_PV}"
+HTTP_HEADERS_MORE_MODULE_URI="https://github.com/openresty/headers-more-nginx-module/archive/v${HTTP_HEADERS_MORE_MODULE_PV}.tar.gz"
+HTTP_HEADERS_MORE_MODULE_WD="${WORKDIR}/headers-more-nginx-module-${HTTP_HEADERS_MORE_MODULE_PV}"
+
+# http_cache_purge (https://github.com/nginx-modules/ngx_cache_purge, BSD-2 license)
+HTTP_CACHE_PURGE_MODULE_PV="2.5.3"
+HTTP_CACHE_PURGE_MODULE_P="ngx_http_cache_purge-${HTTP_CACHE_PURGE_MODULE_PV}"
+HTTP_CACHE_PURGE_MODULE_URI="https://github.com/nginx-modules/ngx_cache_purge/archive/refs/tags/${HTTP_CACHE_PURGE_MODULE_PV}.tar.gz"
+HTTP_CACHE_PURGE_MODULE_WD="${WORKDIR}/ngx_cache_purge-${HTTP_CACHE_PURGE_MODULE_PV}"
+
+# http_slowfs_cache (http://labs.frickle.com/nginx_ngx_slowfs_cache/, BSD-2 license)
+HTTP_SLOWFS_CACHE_MODULE_PV="1.10"
+HTTP_SLOWFS_CACHE_MODULE_P="ngx_http_slowfs_cache-${HTTP_SLOWFS_CACHE_MODULE_PV}"
+HTTP_SLOWFS_CACHE_MODULE_URI="http://labs.frickle.com/files/ngx_slowfs_cache-${HTTP_SLOWFS_CACHE_MODULE_PV}.tar.gz"
+HTTP_SLOWFS_CACHE_MODULE_WD="${WORKDIR}/ngx_slowfs_cache-${HTTP_SLOWFS_CACHE_MODULE_PV}"
+
+# http_fancyindex (https://github.com/aperezdc/ngx-fancyindex, BSD license)
+HTTP_FANCYINDEX_MODULE_PV="0.4.4"
+HTTP_FANCYINDEX_MODULE_P="ngx_http_fancyindex-${HTTP_FANCYINDEX_MODULE_PV}"
+HTTP_FANCYINDEX_MODULE_URI="https://github.com/aperezdc/ngx-fancyindex/archive/v${HTTP_FANCYINDEX_MODULE_PV}.tar.gz"
+HTTP_FANCYINDEX_MODULE_WD="${WORKDIR}/ngx-fancyindex-${HTTP_FANCYINDEX_MODULE_PV}"
+
+# http_lua (https://github.com/openresty/lua-nginx-module, BSD license)
+HTTP_LUA_MODULE_PV="0.10.25"
+HTTP_LUA_MODULE_P="ngx_http_lua-${HTTP_LUA_MODULE_PV}"
+HTTP_LUA_MODULE_URI="https://github.com/openresty/lua-nginx-module/archive/v${HTTP_LUA_MODULE_PV}.tar.gz"
+HTTP_LUA_MODULE_WD="${WORKDIR}/lua-nginx-module-${HTTP_LUA_MODULE_PV}"
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+
+# http_auth_pam (https://github.com/stogh/ngx_http_auth_pam_module/, http://web.iti.upv.es/~sto/nginx/, BSD-2 license)
+HTTP_AUTH_PAM_MODULE_PV="1.5.2"
+HTTP_AUTH_PAM_MODULE_P="ngx_http_auth_pam-${HTTP_AUTH_PAM_MODULE_PV}"
+HTTP_AUTH_PAM_MODULE_URI="https://github.com/stogh/ngx_http_auth_pam_module/archive/v${HTTP_AUTH_PAM_MODULE_PV}.tar.gz"
+HTTP_AUTH_PAM_MODULE_WD="${WORKDIR}/ngx_http_auth_pam_module-${HTTP_AUTH_PAM_MODULE_PV}"
+
+# http_upstream_check (https://github.com/yaoweibin/nginx_upstream_check_module, BSD license)
+HTTP_UPSTREAM_CHECK_MODULE_PV="9aecf15ec379fe98f62355c57b60c0bc83296f04"
+HTTP_UPSTREAM_CHECK_MODULE_P="ngx_http_upstream_check-${HTTP_UPSTREAM_CHECK_MODULE_PV}"
+HTTP_UPSTREAM_CHECK_MODULE_URI="https://github.com/yaoweibin/nginx_upstream_check_module/archive/${HTTP_UPSTREAM_CHECK_MODULE_PV}.tar.gz"
+HTTP_UPSTREAM_CHECK_MODULE_WD="${WORKDIR}/nginx_upstream_check_module-${HTTP_UPSTREAM_CHECK_MODULE_PV}"
+
+# http_metrics (https://github.com/zenops/ngx_metrics, BSD license)
+HTTP_METRICS_MODULE_PV="0.1.1"
+HTTP_METRICS_MODULE_P="ngx_metrics-${HTTP_METRICS_MODULE_PV}"
+HTTP_METRICS_MODULE_URI="https://github.com/liquidm/ngx_metrics/archive/v${HTTP_METRICS_MODULE_PV}.tar.gz"
+HTTP_METRICS_MODULE_WD="${WORKDIR}/ngx_metrics-${HTTP_METRICS_MODULE_PV}"
+
+# http_vhost_traffic_status (https://github.com/vozlt/nginx-module-vts, BSD license)
+HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV="0.2.1"
+HTTP_VHOST_TRAFFIC_STATUS_MODULE_P="ngx_http_vhost_traffic_status-${HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV}"
+HTTP_VHOST_TRAFFIC_STATUS_MODULE_URI="https://github.com/vozlt/nginx-module-vts/archive/v${HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV}.tar.gz"
+HTTP_VHOST_TRAFFIC_STATUS_MODULE_WD="${WORKDIR}/nginx-module-vts-${HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV}"
+
+# naxsi-core (https://github.com/wargio/naxsi, GPL-3)
+HTTP_NAXSI_MODULE_PV="4140b2ded624eb36f04c783c460379b9403012d0"
+HTTP_NAXSI_MODULE_P="ngx_http_naxsi-${HTTP_NAXSI_MODULE_PV}"
+HTTP_NAXSI_MODULE_URI="https://github.com/wargio/naxsi/archive/${HTTP_NAXSI_MODULE_PV}.tar.gz"
+HTTP_NAXSI_MODULE_WD="${WORKDIR}/naxsi-${HTTP_NAXSI_MODULE_PV}/naxsi_src"
+HTTP_NAXSI_LIBINJECTION_MODULE_PV="49904c42a6e68dc8f16c022c693e897e4010a06c"
+HTTP_NAXSI_LIBINJECTION_MODULE_P="ngx_http_naxsi_libinjection-${HTTP_NAXSI_LIBINJECTION_MODULE_PV}"
+HTTP_NAXSI_LIBINJECTION_MODULE_URI="https://github.com/libinjection/libinjection/archive/${HTTP_NAXSI_LIBINJECTION_MODULE_PV}.tar.gz"
+
+# nginx-rtmp-module (https://github.com/arut/nginx-rtmp-module, BSD license)
+RTMP_MODULE_PV="1.2.2"
+RTMP_MODULE_P="ngx_rtmp-${RTMP_MODULE_PV}"
+RTMP_MODULE_URI="https://github.com/arut/nginx-rtmp-module/archive/v${RTMP_MODULE_PV}.tar.gz"
+RTMP_MODULE_WD="${WORKDIR}/nginx-rtmp-module-${RTMP_MODULE_PV}"
+
+# nginx-dav-ext-module (https://github.com/arut/nginx-dav-ext-module, BSD license)
+HTTP_DAV_EXT_MODULE_PV="3.0.0"
+HTTP_DAV_EXT_MODULE_P="ngx_http_dav_ext-${HTTP_DAV_EXT_MODULE_PV}"
+HTTP_DAV_EXT_MODULE_URI="https://github.com/arut/nginx-dav-ext-module/archive/v${HTTP_DAV_EXT_MODULE_PV}.tar.gz"
+HTTP_DAV_EXT_MODULE_WD="${WORKDIR}/nginx-dav-ext-module-${HTTP_DAV_EXT_MODULE_PV}"
+
+# echo-nginx-module (https://github.com/openresty/echo-nginx-module, BSD license)
+HTTP_ECHO_MODULE_PV="0.63"
+HTTP_ECHO_MODULE_P="ngx_http_echo-${HTTP_ECHO_MODULE_PV}"
+HTTP_ECHO_MODULE_URI="https://github.com/openresty/echo-nginx-module/archive/v${HTTP_ECHO_MODULE_PV}.tar.gz"
+HTTP_ECHO_MODULE_WD="${WORKDIR}/echo-nginx-module-${HTTP_ECHO_MODULE_PV}"
+
+# modsecurity for nginx (https://github.com/SpiderLabs/ModSecurity-nginx, https://github.com/SpiderLabs/ModSecurity, Apache-2.0)
+HTTP_SECURITY_MODULE_PV="1.0.3"
+HTTP_SECURITY_MODULE_P="modsecurity-nginx-${HTTP_SECURITY_MODULE_PV}"
+HTTP_SECURITY_MODULE_URI="https://github.com/SpiderLabs/ModSecurity-nginx/archive/refs/tags/v${HTTP_SECURITY_MODULE_PV}.tar.gz"
+HTTP_SECURITY_MODULE_WD="${WORKDIR}/ModSecurity-nginx-${HTTP_SECURITY_MODULE_PV}"
+
+# push-stream-module (http://www.nginxpushstream.com, https://github.com/wandenberg/nginx-push-stream-module, GPL-3)
+HTTP_PUSH_STREAM_MODULE_PV="8c02220d484d7848bc8e3a6d9b1c616987e86f66"
+HTTP_PUSH_STREAM_MODULE_P="ngx_http_push_stream-${HTTP_PUSH_STREAM_MODULE_PV}"
+HTTP_PUSH_STREAM_MODULE_URI="https://github.com/wandenberg/nginx-push-stream-module/archive/${HTTP_PUSH_STREAM_MODULE_PV}.tar.gz"
+HTTP_PUSH_STREAM_MODULE_WD="${WORKDIR}/nginx-push-stream-module-${HTTP_PUSH_STREAM_MODULE_PV}"
+
+# sticky-module (https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng, BSD-2)
+HTTP_STICKY_MODULE_PV="1.2.6-10-g08a395c66e42"
+HTTP_STICKY_MODULE_P="nginx_http_sticky_module_ng-${HTTP_STICKY_MODULE_PV}"
+HTTP_STICKY_MODULE_URI="https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng/get/${HTTP_STICKY_MODULE_PV}.tar.bz2"
+HTTP_STICKY_MODULE_WD="${WORKDIR}/nginx-goodies-nginx-sticky-module-ng-08a395c66e42"
+
+# mogilefs-module (https://github.com/vkholodkov/nginx-mogilefs-module, BSD-2)
+HTTP_MOGILEFS_MODULE_PV="1.0.4"
+HTTP_MOGILEFS_MODULE_P="ngx_mogilefs_module-${HTTP_MOGILEFS_MODULE_PV}"
+HTTP_MOGILEFS_MODULE_URI="https://github.com/vkholodkov/nginx-mogilefs-module/archive/${HTTP_MOGILEFS_MODULE_PV}.tar.gz"
+HTTP_MOGILEFS_MODULE_WD="${WORKDIR}/nginx_mogilefs_module-${HTTP_MOGILEFS_MODULE_PV}"
+
+# memc-module (https://github.com/openresty/memc-nginx-module, BSD-2)
+HTTP_MEMC_MODULE_PV="0.19"
+HTTP_MEMC_MODULE_P="ngx_memc_module-${HTTP_MEMC_MODULE_PV}"
+HTTP_MEMC_MODULE_URI="https://github.com/openresty/memc-nginx-module/archive/v${HTTP_MEMC_MODULE_PV}.tar.gz"
+HTTP_MEMC_MODULE_WD="${WORKDIR}/memc-nginx-module-${HTTP_MEMC_MODULE_PV}"
+
+# nginx-ldap-auth-module (https://github.com/kvspb/nginx-auth-ldap, BSD-2)
+HTTP_LDAP_MODULE_PV="42d195d7a7575ebab1c369ad3fc5d78dc2c2669c"
+HTTP_LDAP_MODULE_P="nginx-auth-ldap-${HTTP_LDAP_MODULE_PV}"
+HTTP_LDAP_MODULE_URI="https://github.com/kvspb/nginx-auth-ldap/archive/${HTTP_LDAP_MODULE_PV}.tar.gz"
+HTTP_LDAP_MODULE_WD="${WORKDIR}/nginx-auth-ldap-${HTTP_LDAP_MODULE_PV}"
+
+# nginx-vod-module (https://github.com/kaltura/nginx-vod-module, AGPL-3+)
+HTTP_VOD_MODULE_PV="1.33"
+HTTP_VOD_MODULE_P="nginx-vod-module-${HTTP_VOD_MODULE_PV}"
+HTTP_VOD_MODULE_URI="https://github.com/kaltura/nginx-vod-module/archive/${HTTP_VOD_MODULE_PV}.tar.gz"
+HTTP_VOD_MODULE_WD="${WORKDIR}/nginx-vod-module-${HTTP_VOD_MODULE_PV}"
+
+# geoip2 (https://github.com/leev/ngx_http_geoip2_module, BSD-2)
+GEOIP2_MODULE_PV="3.4"
+GEOIP2_MODULE_P="ngx_http_geoip2_module-${GEOIP2_MODULE_PV}"
+GEOIP2_MODULE_URI="https://github.com/leev/ngx_http_geoip2_module/archive/${GEOIP2_MODULE_PV}.tar.gz"
+GEOIP2_MODULE_WD="${WORKDIR}/ngx_http_geoip2_module-${GEOIP2_MODULE_PV}"
+
+# njs-module (https://github.com/nginx/njs, as-is)
+NJS_MODULE_PV="0.8.10"
+NJS_MODULE_P="njs-${NJS_MODULE_PV}"
+NJS_MODULE_URI="https://github.com/nginx/njs/archive/${NJS_MODULE_PV}.tar.gz"
+NJS_MODULE_WD="${WORKDIR}/njs-${NJS_MODULE_PV}"
+
+# nginx-tests (http://hg.nginx.org/nginx-tests, BSD-2)
+NGINX_TESTS_REV="0b5ec15c62ed"
+
+# We handle deps below ourselves
+SSL_DEPS_SKIP=1
+AUTOTOOLS_AUTO_DEPEND="no"
+
+inherit autotools lua-single multiprocessing ssl-cert toolchain-funcs perl-module systemd pax-utils
+
+DESCRIPTION="Robust, small and high performance http and reverse proxy server"
+HOMEPAGE="https://nginx.org"
+SRC_URI="https://nginx.org/download/${P}.tar.gz
+	${DEVEL_KIT_MODULE_URI} -> ${DEVEL_KIT_MODULE_P}.tar.gz
+	nginx_modules_http_auth_ldap? ( ${HTTP_LDAP_MODULE_URI} -> ${HTTP_LDAP_MODULE_P}.tar.gz )
+	nginx_modules_http_auth_pam? ( ${HTTP_AUTH_PAM_MODULE_URI} -> ${HTTP_AUTH_PAM_MODULE_P}.tar.gz )
+	nginx_modules_http_brotli? ( ${HTTP_BROTLI_MODULE_URI} -> ${HTTP_BROTLI_MODULE_P}.tar.gz )
+	nginx_modules_http_cache_purge? ( ${HTTP_CACHE_PURGE_MODULE_URI} -> ${HTTP_CACHE_PURGE_MODULE_P}.tar.gz )
+	nginx_modules_http_dav_ext? ( ${HTTP_DAV_EXT_MODULE_URI} -> ${HTTP_DAV_EXT_MODULE_P}.tar.gz )
+	nginx_modules_http_echo? ( ${HTTP_ECHO_MODULE_URI} -> ${HTTP_ECHO_MODULE_P}.tar.gz )
+	nginx_modules_http_fancyindex? ( ${HTTP_FANCYINDEX_MODULE_URI} -> ${HTTP_FANCYINDEX_MODULE_P}.tar.gz )
+	nginx_modules_http_geoip2? ( ${GEOIP2_MODULE_URI} -> ${GEOIP2_MODULE_P}.tar.gz )
+	nginx_modules_http_headers_more? ( ${HTTP_HEADERS_MORE_MODULE_URI} -> ${HTTP_HEADERS_MORE_MODULE_P}.tar.gz )
+	nginx_modules_http_javascript? ( ${NJS_MODULE_URI} -> ${NJS_MODULE_P}.tar.gz )
+	nginx_modules_http_lua? ( ${HTTP_LUA_MODULE_URI} -> ${HTTP_LUA_MODULE_P}.tar.gz )
+	nginx_modules_http_memc? ( ${HTTP_MEMC_MODULE_URI} -> ${HTTP_MEMC_MODULE_P}.tar.gz )
+	nginx_modules_http_metrics? ( ${HTTP_METRICS_MODULE_URI} -> ${HTTP_METRICS_MODULE_P}.tar.gz )
+	nginx_modules_http_mogilefs? ( ${HTTP_MOGILEFS_MODULE_URI} -> ${HTTP_MOGILEFS_MODULE_P}.tar.gz )
+	nginx_modules_http_naxsi? (
+		${HTTP_NAXSI_MODULE_URI} -> ${HTTP_NAXSI_MODULE_P}.tar.gz
+		${HTTP_NAXSI_LIBINJECTION_MODULE_URI} -> ${HTTP_NAXSI_LIBINJECTION_MODULE_P}.tar.gz
+	)
+	nginx_modules_http_push_stream? ( ${HTTP_PUSH_STREAM_MODULE_URI} -> ${HTTP_PUSH_STREAM_MODULE_P}.tar.gz )
+	nginx_modules_http_security? ( ${HTTP_SECURITY_MODULE_URI} -> ${HTTP_SECURITY_MODULE_P}.tar.gz )
+	nginx_modules_http_slowfs_cache? ( ${HTTP_SLOWFS_CACHE_MODULE_URI} -> ${HTTP_SLOWFS_CACHE_MODULE_P}.tar.gz )
+	nginx_modules_http_sticky? ( ${HTTP_STICKY_MODULE_URI} -> ${HTTP_STICKY_MODULE_P}.tar.bz2 )
+	nginx_modules_http_upload_progress? ( ${HTTP_UPLOAD_PROGRESS_MODULE_URI} -> ${HTTP_UPLOAD_PROGRESS_MODULE_P}.tar.gz )
+	nginx_modules_http_upstream_check? ( ${HTTP_UPSTREAM_CHECK_MODULE_URI} -> ${HTTP_UPSTREAM_CHECK_MODULE_P}.tar.gz )
+	nginx_modules_http_vhost_traffic_status? ( ${HTTP_VHOST_TRAFFIC_STATUS_MODULE_URI} -> ${HTTP_VHOST_TRAFFIC_STATUS_MODULE_P}.tar.gz )
+	nginx_modules_http_vod? ( ${HTTP_VOD_MODULE_URI} -> ${HTTP_VOD_MODULE_P}.tar.gz )
+	nginx_modules_stream_geoip2? ( ${GEOIP2_MODULE_URI} -> ${GEOIP2_MODULE_P}.tar.gz )
+	nginx_modules_stream_javascript? ( ${NJS_MODULE_URI} -> ${NJS_MODULE_P}.tar.gz )
+	rtmp? ( ${RTMP_MODULE_URI} -> ${RTMP_MODULE_P}.tar.gz )
+	test? ( https://hg.nginx.org/nginx-tests/archive/${NGINX_TESTS_REV}.tar.gz -> nginx-tests-${NGINX_TESTS_REV}.tar.gz )"
+
+LICENSE="BSD-2 BSD SSLeay MIT GPL-2 GPL-2+
+	nginx_modules_http_security? ( Apache-2.0 )
+	nginx_modules_http_push_stream? ( GPL-3 )"
+
+SLOT="mainline"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+
+NGINX_MODULES_STD="access auth_basic autoindex browser charset empty_gif
+	fastcgi geo grpc gzip limit_req limit_conn map memcached mirror
+	proxy referer rewrite scgi ssi split_clients upstream_hash
+	upstream_ip_hash upstream_keepalive upstream_least_conn
+	upstream_zone userid uwsgi"
+NGINX_MODULES_OPT="addition auth_request dav degradation flv geoip gunzip
+	gzip_static image_filter mp4 perl random_index realip secure_link
+	slice stub_status sub xslt"
+NGINX_MODULES_STREAM_STD="access geo limit_conn map return split_clients
+	upstream_hash upstream_least_conn upstream_zone"
+NGINX_MODULES_STREAM_OPT="geoip realip ssl_preread"
+NGINX_MODULES_MAIL="imap pop3 smtp"
+NGINX_MODULES_3RD="
+	http_auth_ldap
+	http_auth_pam
+	http_brotli
+	http_cache_purge
+	http_dav_ext
+	http_echo
+	http_fancyindex
+	http_geoip2
+	http_headers_more
+	http_javascript
+	http_lua
+	http_memc
+	http_metrics
+	http_mogilefs
+	http_naxsi
+	http_push_stream
+	http_security
+	http_slowfs_cache
+	http_sticky
+	http_upload_progress
+	http_upstream_check
+	http_vhost_traffic_status
+	http_vod
+	stream_geoip2
+	stream_javascript
+"
+
+RESTRICT="!test? ( test )"
+
+IUSE="aio debug +http +http2 http3 +http-cache ktls libatomic pcre +pcre2 pcre-jit rtmp selinux ssl test threads vim-syntax"
+
+for mod in $NGINX_MODULES_STD; do
+	IUSE="${IUSE} +nginx_modules_http_${mod}"
+done
+
+for mod in $NGINX_MODULES_OPT; do
+	IUSE="${IUSE} nginx_modules_http_${mod}"
+done
+
+for mod in $NGINX_MODULES_STREAM_STD; do
+	IUSE="${IUSE} nginx_modules_stream_${mod}"
+done
+
+for mod in $NGINX_MODULES_STREAM_OPT; do
+	IUSE="${IUSE} nginx_modules_stream_${mod}"
+done
+
+for mod in $NGINX_MODULES_MAIL; do
+	IUSE="${IUSE} nginx_modules_mail_${mod}"
+done
+
+for mod in $NGINX_MODULES_3RD; do
+	IUSE="${IUSE} nginx_modules_${mod}"
+done
+
+# Add so we can warn users updating about config changes
+# @TODO: jbergstroem: remove on next release series
+IUSE="${IUSE} nginx_modules_http_spdy"
+
+CDEPEND="
+	acct-group/nginx
+	acct-user/nginx
+	virtual/libcrypt:=
+	pcre? ( dev-libs/libpcre:= )
+	pcre2? ( dev-libs/libpcre2:= )
+	pcre-jit? ( dev-libs/libpcre:=[jit] )
+	ssl? (
+		dev-libs/openssl:0=
+	)
+	http2? (
+		>=dev-libs/openssl-1.0.1c:0=
+	)
+	http-cache? (
+		dev-libs/openssl:0=
+	)
+	ktls? (
+		>=dev-libs/openssl-3:0=[ktls]
+	)
+	nginx_modules_http_brotli? ( app-arch/brotli:= )
+	nginx_modules_http_geoip? ( dev-libs/geoip )
+	nginx_modules_http_geoip2? ( dev-libs/libmaxminddb:= )
+	nginx_modules_http_gunzip? ( virtual/zlib:= )
+	nginx_modules_http_gzip? ( virtual/zlib:= )
+	nginx_modules_http_gzip_static? ( virtual/zlib:= )
+	nginx_modules_http_image_filter? ( media-libs/gd:=[jpeg,png] )
+	nginx_modules_http_perl? ( >=dev-lang/perl-5.8:= )
+	nginx_modules_http_rewrite? ( dev-libs/libpcre:= )
+	nginx_modules_http_secure_link? ( dev-libs/openssl:0= )
+	nginx_modules_http_xslt? ( dev-libs/libxml2:= dev-libs/libxslt )
+	nginx_modules_http_lua? ( ${LUA_DEPS} )
+	nginx_modules_http_auth_pam? ( sys-libs/pam )
+	nginx_modules_http_metrics? ( dev-libs/yajl:= )
+	nginx_modules_http_dav_ext? ( dev-libs/libxml2:= )
+	nginx_modules_http_security? ( dev-libs/modsecurity:= )
+	nginx_modules_http_auth_ldap? ( net-nds/openldap:=[ssl?] )
+	nginx_modules_http_vod? ( media-video/ffmpeg:0= )
+	nginx_modules_stream_geoip? ( dev-libs/geoip )
+	nginx_modules_stream_geoip2? ( dev-libs/libmaxminddb:= )"
+RDEPEND="${CDEPEND}
+	app-misc/mime-types[nginx]
+	selinux? ( sec-policy/selinux-nginx )
+	!www-servers/nginx:0"
+DEPEND="${CDEPEND}
+	arm? ( dev-libs/libatomic_ops )
+	libatomic? ( dev-libs/libatomic_ops )"
+BDEPEND="
+	nginx_modules_http_brotli? ( virtual/pkgconfig )
+	test? (
+		dev-lang/perl
+		dev-perl/Cache-Memcached
+		dev-perl/Cache-Memcached-Fast
+		dev-perl/CryptX
+		dev-perl/FCGI
+		dev-perl/GD
+		dev-perl/Net-SSLeay
+	)"
+# Unpackaged perl modules which would be used by tests
+# Protocol::WebSocket
+# SCGI
+
+# Uwsgi doesn't start in tests
+# www-servers/uwsgi
+
+PDEPEND="vim-syntax? ( app-vim/nginx-syntax )"
+
+REQUIRED_USE="pcre-jit? ( pcre )
+	ktls? ( ssl )
+	nginx_modules_http_fancyindex? ( nginx_modules_http_addition )
+	nginx_modules_http_grpc? ( http2 )
+	nginx_modules_http_lua? (
+		${LUA_REQUIRED_USE}
+		nginx_modules_http_rewrite
+		pcre
+		!pcre2
+	)
+	nginx_modules_http_naxsi? ( nginx_modules_http_rewrite pcre )
+	nginx_modules_http_dav_ext? ( nginx_modules_http_dav nginx_modules_http_xslt )
+	nginx_modules_http_metrics? ( nginx_modules_http_stub_status )
+	nginx_modules_http_security? ( pcre )
+	nginx_modules_http_push_stream? ( ssl )
+	nginx_modules_http_vod? ( threads )"
+
+pkg_setup() {
+	NGINX_HOME="/var/lib/nginx"
+	NGINX_HOME_TMP="${NGINX_HOME}/tmp"
+
+	if use libatomic; then
+		ewarn "GCC 4.1+ features built-in atomic operations."
+		ewarn "Using libatomic_ops is only needed if using"
+		ewarn "a different compiler or a GCC prior to 4.1"
+	fi
+
+	if [[ -n $NGINX_ADD_MODULES ]]; then
+		ewarn "You are building custom modules via \$NGINX_ADD_MODULES!"
+		ewarn "This nginx installation is not supported!"
+		ewarn "Make sure you can reproduce the bug without those modules"
+		ewarn "_before_ reporting bugs."
+	fi
+
+	if use !http; then
+		ewarn "To actually disable all http-functionality you also have to disable"
+		ewarn "all nginx http modules."
+	fi
+
+	if use nginx_modules_http_mogilefs && use threads; then
+		eerror "mogilefs won't compile with threads support."
+		eerror "Please disable either flag and try again."
+		die "Can't compile mogilefs with threads support"
+	fi
+
+	use nginx_modules_http_lua && lua-single_pkg_setup
+}
+
+src_prepare() {
+	eapply "${FILESDIR}/${PN}-1.4.1-fix-perl-install-path.patch"
+	eapply "${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
+
+	if use nginx_modules_http_auth_ldap; then
+		cd "${HTTP_LDAP_MODULE_WD}" || die
+		eapply "${FILESDIR}/${PN}-1.23.2-mod_auth_ldap-fix.patch"
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_javascript; then
+		cd "${NJS_MODULE_WD}" || die
+		sed -e 's/-Werror//g' -i auto/cc || die
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_sticky; then
+		cd "${HTTP_STICKY_MODULE_WD}" || die
+		eapply "${FILESDIR}"/http_sticky-nginx-1.23.0.patch
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_naxsi; then
+		cd "${HTTP_NAXSI_MODULE_WD}" || die
+		rm -r libinjection || die
+		mv ../../libinjection-${HTTP_NAXSI_LIBINJECTION_MODULE_PV} libinjection || die
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_brotli; then
+		cd "${HTTP_BROTLI_MODULE_WD}" || die
+		eapply "${FILESDIR}"/http_brotli-detect-brotli-r3.patch
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_upstream_check; then
+		eapply -p0 "${FILESDIR}"/http_upstream_check-nginx-1.11.5+.patch
+	fi
+
+	if use nginx_modules_http_upload_progress; then
+		cd "${HTTP_UPLOAD_PROGRESS_MODULE_WD}" || die
+		eapply "${FILESDIR}"/http_uploadprogress-nginx-1.23.0.patch
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_security ; then
+		cd "${HTTP_SECURITY_MODULE_WD}" || die
+		eapply "${FILESDIR}/http_security-nginx-1.26.2.patch"
+		cd "${S}" || die
+	fi
+
+	find auto/ -type f -print0 | xargs -0 sed -i 's:\&\& make:\&\& \\$(MAKE):' || die
+	# We have config protection, don't rename etc files
+	sed -i 's:.default::' auto/install || die
+	# remove useless files
+	sed -i -e '/koi-/d' -e '/win-/d' auto/install || die
+
+	# don't install to /etc/nginx/ if not in use
+	local module
+	for module in fastcgi scgi uwsgi ; do
+		if ! use nginx_modules_http_${module}; then
+			sed -i -e "/${module}/d" auto/install || die
+		fi
+	done
+
+	eapply_user
+}
+
+src_configure() {
+	local myconf=() http_enabled= mail_enabled= stream_enabled=
+
+	use aio       && myconf+=( --with-file-aio )
+	use debug     && myconf+=( --with-debug )
+	use http2     && myconf+=( --with-http_v2_module )
+	use http3     && myconf+=( --with-http_v3_module )
+	use ktls      && myconf+=( --with-openssl-opt=enable-ktls )
+	use libatomic && myconf+=( --with-libatomic )
+	use pcre      && myconf+=( --with-pcre --without-pcre2 )
+	use pcre-jit  && myconf+=( --with-pcre-jit )
+	use threads   && myconf+=( --with-threads )
+
+	# HTTP modules
+	for mod in $NGINX_MODULES_STD; do
+		if use nginx_modules_http_${mod}; then
+			http_enabled=1
+		else
+			myconf+=( --without-http_${mod}_module )
+		fi
+	done
+
+	for mod in $NGINX_MODULES_OPT; do
+		if use nginx_modules_http_${mod}; then
+			http_enabled=1
+			myconf+=( --with-http_${mod}_module )
+		fi
+	done
+
+	if use nginx_modules_http_fastcgi; then
+		myconf+=( --with-http_realip_module )
+	fi
+
+	# third-party modules
+	if use nginx_modules_http_upload_progress; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_UPLOAD_PROGRESS_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_headers_more; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_HEADERS_MORE_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_cache_purge; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_CACHE_PURGE_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_slowfs_cache; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_SLOWFS_CACHE_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_fancyindex; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_FANCYINDEX_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_lua; then
+		http_enabled=1
+		export LUAJIT_LIB=$(dirname $(lua_get_shared_lib))
+		export LUAJIT_INC=$(lua_get_include_dir)
+		myconf+=( --add-module=${DEVEL_KIT_MODULE_WD} )
+		myconf+=( --add-module=${HTTP_LUA_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_auth_pam; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_AUTH_PAM_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_upstream_check; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_UPSTREAM_CHECK_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_metrics; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_METRICS_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_naxsi ; then
+		http_enabled=1
+		myconf+=(  --add-module=${HTTP_NAXSI_MODULE_WD} )
+	fi
+
+	if use rtmp ; then
+		http_enabled=1
+		myconf+=( --add-module=${RTMP_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_dav_ext ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_DAV_EXT_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_echo ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_ECHO_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_security ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_SECURITY_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_push_stream ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_PUSH_STREAM_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_sticky ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_STICKY_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_mogilefs ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_MOGILEFS_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_memc ; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_MEMC_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_auth_ldap; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_LDAP_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_vhost_traffic_status; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_VHOST_TRAFFIC_STATUS_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_geoip2 || use nginx_modules_stream_geoip2; then
+		myconf+=( --add-module=${GEOIP2_MODULE_WD} )
+	fi
+
+	if use nginx_modules_http_javascript || use nginx_modules_stream_javascript; then
+		myconf+=( --add-module="${NJS_MODULE_WD}/nginx" )
+	fi
+
+	if use nginx_modules_http_brotli; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_BROTLI_MODULE_WD} )
+	fi
+
+	if use http || use http-cache || use http2 || use http3 || use nginx_modules_http_javascript; then
+		http_enabled=1
+	fi
+
+	if use nginx_modules_http_vod; then
+		http_enabled=1
+		myconf+=( --add-module=${HTTP_VOD_MODULE_WD} )
+	fi
+
+	if [ $http_enabled ]; then
+		use http-cache || myconf+=( --without-http-cache )
+		use ssl && myconf+=( --with-http_ssl_module )
+	else
+		myconf+=( --without-http --without-http-cache )
+	fi
+
+	# Stream modules
+	for mod in $NGINX_MODULES_STREAM_STD; do
+		if use nginx_modules_stream_${mod}; then
+			stream_enabled=1
+		else
+			myconf+=( --without-stream_${mod}_module )
+		fi
+	done
+
+	for mod in $NGINX_MODULES_STREAM_OPT; do
+		if use nginx_modules_stream_${mod}; then
+			stream_enabled=1
+			myconf+=( --with-stream_${mod}_module )
+		fi
+	done
+
+	if use nginx_modules_stream_geoip2 || use nginx_modules_stream_javascript; then
+		stream_enabled=1
+	fi
+
+	if [ $stream_enabled ]; then
+		myconf+=( --with-stream )
+		use ssl && myconf+=( --with-stream_ssl_module )
+	fi
+
+	# MAIL modules
+	for mod in $NGINX_MODULES_MAIL; do
+		if use nginx_modules_mail_${mod}; then
+			mail_enabled=1
+		else
+			myconf+=( --without-mail_${mod}_module )
+		fi
+	done
+
+	if [ $mail_enabled ]; then
+		myconf+=( --with-mail )
+		use ssl && myconf+=( --with-mail_ssl_module )
+	fi
+
+	# custom modules
+	for mod in $NGINX_ADD_MODULES; do
+		myconf+=(  --add-module=${mod} )
+	done
+
+	# https://bugs.gentoo.org/286772
+	export LANG=C LC_ALL=C
+	tc-export AR CC
+
+	if ! use prefix; then
+		myconf+=( --user=${PN} )
+		myconf+=( --group=${PN} )
+	fi
+
+	if [[ -n "${EXTRA_ECONF}" ]]; then
+		myconf+=( ${EXTRA_ECONF} )
+		ewarn "EXTRA_ECONF applied. Now you are on your own, good luck!"
+	fi
+
+	./configure \
+		--prefix="${EPREFIX}"/usr \
+		--conf-path="${EPREFIX}"/etc/${PN}/${PN}.conf \
+		--error-log-path="${EPREFIX}"/var/log/${PN}/error_log \
+		--pid-path="${EPREFIX}"/run/${PN}/${PN}.pid \
+		--lock-path="${EPREFIX}"/run/lock/${PN}.lock \
+		--with-cc-opt="-I${ESYSROOT}/usr/include" \
+		--with-ld-opt="-L${ESYSROOT}/usr/$(get_libdir)" \
+		--http-log-path="${EPREFIX}"/var/log/${PN}/access_log \
+		--http-client-body-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/client \
+		--http-proxy-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/proxy \
+		--http-fastcgi-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/fastcgi \
+		--http-scgi-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/scgi \
+		--http-uwsgi-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/uwsgi \
+		--with-compat \
+		"${myconf[@]}" || die "configure failed"
+
+	# A purely cosmetic change that makes nginx -V more readable. This can be
+	# good if people outside the gentoo community would troubleshoot and
+	# question the users setup.
+	sed -i -e "s|${WORKDIR}|external_module|g" objs/ngx_auto_config.h || die
+}
+
+src_compile() {
+	# https://bugs.gentoo.org/286772
+	export LANG=C LC_ALL=C
+	emake LINK="${CC} ${LDFLAGS}" OTHERLDFLAGS="${LDFLAGS}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	cp "${FILESDIR}"/nginx.conf-r3 "${ED}"/etc/nginx/nginx.conf || die
+
+	newinitd "${FILESDIR}"/nginx.initd-r4 nginx
+	newconfd "${FILESDIR}"/nginx.confd nginx
+
+	systemd_newunit "${FILESDIR}"/nginx.service-r1 nginx.service
+
+	doman man/nginx.8
+	dodoc CHANGES* README.md
+
+	# just keepdir. do not copy the default htdocs files (bug #449136)
+	keepdir /var/www/localhost
+	rm -rf "${ED}"/usr/html || die
+
+	# set up a list of directories to keep
+	local keepdir_list="${NGINX_HOME_TMP}"/client
+	local module
+	for module in proxy fastcgi scgi uwsgi; do
+		use nginx_modules_http_${module} && keepdir_list+=" ${NGINX_HOME_TMP}/${module}"
+	done
+
+	keepdir /var/log/nginx ${keepdir_list}
+
+	# this solves a problem with SELinux where nginx doesn't see the directories
+	# as root and tries to create them as nginx
+	fperms 0750 "${NGINX_HOME_TMP}"
+	fowners ${PN}:0 "${NGINX_HOME_TMP}"
+
+	fperms 0700 ${keepdir_list}
+	fowners ${PN}:${PN} ${keepdir_list}
+
+	fperms 0710 /var/log/nginx
+	fowners 0:${PN} /var/log/nginx
+
+	# logrotate
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/nginx.logrotate-r1 nginx
+
+	# Don't create /run
+	rm -rf "${ED}"/run || die
+
+	if use lua_single_target_luajit; then
+		pax-mark m "${ED}/usr/sbin/nginx"
+	fi
+
+	if use nginx_modules_http_perl; then
+		cd "${S}"/objs/src/http/modules/perl/ || die
+		emake DESTDIR="${D}" INSTALLDIRS=vendor
+		perl_delete_localpod
+		cd "${S}" || die
+	fi
+
+	if use nginx_modules_http_cache_purge; then
+		docinto ${HTTP_CACHE_PURGE_MODULE_P}
+		dodoc "${HTTP_CACHE_PURGE_MODULE_WD}"/{CHANGES,README.md}
+	fi
+
+	if use nginx_modules_http_slowfs_cache; then
+		docinto ${HTTP_SLOWFS_CACHE_MODULE_P}
+		dodoc "${HTTP_SLOWFS_CACHE_MODULE_WD}"/{CHANGES,README.md}
+	fi
+
+	if use nginx_modules_http_fancyindex; then
+		docinto ${HTTP_FANCYINDEX_MODULE_P}
+		dodoc "${HTTP_FANCYINDEX_MODULE_WD}"/README.rst
+	fi
+
+	if use nginx_modules_http_lua; then
+		docinto ${HTTP_LUA_MODULE_P}
+		dodoc "${HTTP_LUA_MODULE_WD}"/README.markdown
+	fi
+
+	if use nginx_modules_http_auth_pam; then
+		docinto ${HTTP_AUTH_PAM_MODULE_P}
+		dodoc "${HTTP_AUTH_PAM_MODULE_WD}"/{README.md,ChangeLog}
+	fi
+
+	if use nginx_modules_http_upstream_check; then
+		docinto ${HTTP_UPSTREAM_CHECK_MODULE_P}
+		dodoc "${HTTP_UPSTREAM_CHECK_MODULE_WD}"/{README,CHANGES}
+	fi
+
+	if use nginx_modules_http_naxsi; then
+		insinto /etc/nginx/naxsi
+		doins "${HTTP_NAXSI_MODULE_WD}"/../distros/nginx/*
+		doins "${HTTP_NAXSI_MODULE_WD}"/../naxsi_rules/naxsi_core.rules
+		doins -r "${HTTP_NAXSI_MODULE_WD}"/../naxsi_rules/blocking
+		doins -r "${HTTP_NAXSI_MODULE_WD}"/../naxsi_rules/whitelists
+	fi
+
+	if use rtmp; then
+		docinto ${RTMP_MODULE_P}
+		dodoc "${RTMP_MODULE_WD}"/{AUTHORS,README.md,stat.xsl}
+	fi
+
+	if use nginx_modules_http_dav_ext; then
+		docinto ${HTTP_DAV_EXT_MODULE_P}
+		dodoc "${HTTP_DAV_EXT_MODULE_WD}"/README.rst
+	fi
+
+	if use nginx_modules_http_echo; then
+		docinto ${HTTP_ECHO_MODULE_P}
+		dodoc "${HTTP_ECHO_MODULE_WD}"/README.markdown
+	fi
+
+	if use nginx_modules_http_security; then
+		docinto ${HTTP_SECURITY_MODULE_P}
+		dodoc "${HTTP_SECURITY_MODULE_WD}"/{AUTHORS,CHANGES,README.md}
+	fi
+
+	if use nginx_modules_http_push_stream; then
+		docinto ${HTTP_PUSH_STREAM_MODULE_P}
+		dodoc "${HTTP_PUSH_STREAM_MODULE_WD}"/{AUTHORS,CHANGELOG.textile,README.textile}
+	fi
+
+	if use nginx_modules_http_sticky; then
+		docinto ${HTTP_STICKY_MODULE_P}
+		dodoc "${HTTP_STICKY_MODULE_WD}"/{README.md,Changelog.txt,docs/sticky.pdf}
+	fi
+
+	if use nginx_modules_http_memc; then
+		docinto ${HTTP_MEMC_MODULE_P}
+		dodoc "${HTTP_MEMC_MODULE_WD}"/README.markdown
+	fi
+
+	if use nginx_modules_http_auth_ldap; then
+		docinto ${HTTP_LDAP_MODULE_P}
+		dodoc "${HTTP_LDAP_MODULE_WD}"/example.conf
+	fi
+
+	if use nginx_modules_http_vod; then
+		docinto ${HTTP_VOD_MODULE_P}
+		dodoc "${HTTP_VOD_MODULE_WD}"/{CHANGELOG,README}.md
+	fi
+}
+
+src_test() {
+	pushd "${WORKDIR}"/nginx-tests-"${NGINX_TESTS_REV}" > /dev/null || die
+
+	# FIXME: unsure why uwsgi fails to start
+	rm uwsgi*.t || die
+
+	local -x TEST_NGINX_BINARY="${S}/objs/nginx"
+	local -x TEST_NGINX_VERBOSE=1
+
+	prove -v -j $(makeopts_jobs) . || die
+	popd > /dev/null || die
+}
+
+pkg_postinst() {
+	if use ssl; then
+		if [[ ! -f "${EROOT}"/etc/ssl/${PN}/${PN}.key ]]; then
+			install_cert /etc/ssl/${PN}/${PN}
+			use prefix || chown ${PN}:${PN} "${EROOT}"/etc/ssl/${PN}/${PN}.{crt,csr,key,pem}
+		fi
+	fi
+
+	if use nginx_modules_http_spdy; then
+		ewarn ""
+		ewarn "In nginx 1.9.5 the spdy module was superseded by http2."
+		ewarn "Update your configs and package.use accordingly."
+	fi
+
+	if use nginx_modules_http_lua; then
+		ewarn ""
+		ewarn "While you can build lua 3rd party module against ${P}"
+		ewarn "the author warns that >=${PN}-1.11.11 is still not an"
+		ewarn "officially supported target yet. You are on your own."
+		ewarn "Expect runtime failures, memory leaks and other problems!"
+	fi
+
+	if use nginx_modules_http_lua && use http2; then
+		ewarn ""
+		ewarn "Lua 3rd party module author warns against using ${P} with"
+		ewarn "NGINX_MODULES_HTTP=\"lua http2\". For more info, see https://git.io/OldLsg"
+	fi
+
+	local _n_permission_layout_checks=0
+	local _has_to_adjust_permissions=0
+	local _has_to_show_permission_warning=0
+
+	# Defaults to 1 to inform people doing a fresh installation
+	# that we ship modified {scgi,uwsgi,fastcgi}_params files
+	local _has_to_show_httpoxy_mitigation_notice=1
+
+	local _replacing_version=
+	for _replacing_version in ${REPLACING_VERSIONS}; do
+		_n_permission_layout_checks=$((${_n_permission_layout_checks}+1))
+
+		if [[ ${_n_permission_layout_checks} -gt 1 ]]; then
+			# Should never happen:
+			# Package is abusing slots but doesn't allow multiple parallel installations.
+			# If we run into this situation it is unsafe to automatically adjust any
+			# permission...
+			_has_to_show_permission_warning=1
+
+			ewarn "Replacing multiple ${PN}' versions is unsupported! " \
+				"You will have to adjust permissions on your own."
+
+			break
+		fi
+
+		local _replacing_version_branch=$(ver_cut 1-2 "${_replacing_version}")
+		debug-print "Updating an existing installation (v${_replacing_version}; branch '${_replacing_version_branch}') ..."
+
+		# Do we need to adjust permissions to fix CVE-2013-0337 (bug #458726, #469094)?
+		# This was before we introduced multiple nginx versions so we
+		# do not need to distinguish between stable and mainline
+		local _need_to_fix_CVE2013_0337=1
+
+		if ver_test ${_replacing_version} -ge 1.4.1-r2; then
+			# We are updating an installation which should already be fixed
+			_need_to_fix_CVE2013_0337=0
+			debug-print "Skipping CVE-2013-0337 ... existing installation should not be affected!"
+		else
+			_has_to_adjust_permissions=1
+			debug-print "Need to adjust permissions to fix CVE-2013-0337!"
+		fi
+
+		# Do we need to inform about HTTPoxy mitigation?
+		# In repository since commit 8be44f76d4ac02cebcd1e0e6e6284bb72d054b0f
+		if ver_test ${_replacing_version_branch} -lt 1.10; then
+			# Updating from <1.10
+			_has_to_show_httpoxy_mitigation_notice=1
+			debug-print "Need to inform about HTTPoxy mitigation!"
+		else
+			# Updating from >=1.10
+			local _fixed_in_pvr=
+			case "${_replacing_version_branch}" in
+				"1.10")
+					_fixed_in_pvr="1.10.1-r2"
+					;;
+				"1.11")
+					_fixed_in_pvr="1.11.3-r1"
+					;;
+				*)
+					# This should be any future branch.
+					# If we run this code it is safe to assume that the user has
+					# already seen the HTTPoxy mitigation notice because he/she is doing
+					# an update from previous version where we have already shown
+					# the warning. Otherwise, we wouldn't hit this code path ...
+					_fixed_in_pvr=
+			esac
+
+			if [[ -z "${_fixed_in_pvr}" ]] || ver_test ${_replacing_version} -ge ${_fixed_in_pvr}; then
+				# We are updating an installation where we already informed
+				# that we are mitigating HTTPoxy per default
+				_has_to_show_httpoxy_mitigation_notice=0
+				debug-print "No need to inform about HTTPoxy mitigation ... information was already shown for existing installation!"
+			else
+				_has_to_show_httpoxy_mitigation_notice=1
+				debug-print "Need to inform about HTTPoxy mitigation!"
+			fi
+		fi
+
+		# Do we need to adjust permissions to fix CVE-2016-1247 (bug #605008)?
+		# All branches up to 1.11 are affected
+		local _need_to_fix_CVE2016_1247=1
+
+		if ver_test ${_replacing_version_branch} -lt 1.10; then
+			# Updating from <1.10
+			_has_to_adjust_permissions=1
+			debug-print "Need to adjust permissions to fix CVE-2016-1247!"
+		else
+			# Updating from >=1.10
+			local _fixed_in_pvr=
+			case "${_replacing_version_branch}" in
+				"1.10")
+					_fixed_in_pvr="1.10.2-r3"
+					;;
+				"1.11")
+					_fixed_in_pvr="1.11.6-r1"
+					;;
+				*)
+					# This should be any future branch.
+					# If we run this code it is safe to assume that we have already
+					# adjusted permissions or were never affected because user is
+					# doing an update from previous version which was safe or did
+					# the adjustments. Otherwise, we wouldn't hit this code path ...
+					_fixed_in_pvr=
+			esac
+
+			if [[ -z "${_fixed_in_pvr}" ]] || ver_test ${_replacing_version} -ge ${_fixed_in_pvr}; then
+				# We are updating an installation which should already be adjusted
+				# or which was never affected
+				_need_to_fix_CVE2016_1247=0
+				debug-print "Skipping CVE-2016-1247 ... existing installation should not be affected!"
+			else
+				_has_to_adjust_permissions=1
+				debug-print "Need to adjust permissions to fix CVE-2016-1247!"
+			fi
+		fi
+	done
+
+	if [[ ${_has_to_adjust_permissions} -eq 1 ]]; then
+		# We do not DIE when chmod/chown commands are failing because
+		# package is already merged on user's system at this stage
+		# and we cannot retry without losing the information that
+		# the existing installation needs to adjust permissions.
+		# Instead we are going to a show a big warning ...
+
+		if [[ ${_has_to_show_permission_warning} -eq 0 ]] && [[ ${_need_to_fix_CVE2013_0337} -eq 1 ]]; then
+			ewarn ""
+			ewarn "The world-readable bit (if set) has been removed from the"
+			ewarn "following directories to mitigate a security bug"
+			ewarn "(CVE-2013-0337, bug #458726):"
+			ewarn ""
+			ewarn "  ${EPREFIX}/var/log/nginx"
+			ewarn "  ${EPREFIX}${NGINX_HOME_TMP}/{,client,proxy,fastcgi,scgi,uwsgi}"
+			ewarn ""
+			ewarn "Check if this is correct for your setup before restarting nginx!"
+			ewarn "This is a one-time change and will not happen on subsequent updates."
+			ewarn "Furthermore nginx' temp directories got moved to '${EPREFIX}${NGINX_HOME_TMP}'"
+			chmod o-rwx \
+				"${EPREFIX}"/var/log/nginx \
+				"${EPREFIX}"${NGINX_HOME_TMP}/{,client,proxy,fastcgi,scgi,uwsgi} || \
+				_has_to_show_permission_warning=1
+		fi
+
+		if [[ ${_has_to_show_permission_warning} -eq 0 ]] && [[ ${_need_to_fix_CVE2016_1247} -eq 1 ]]; then
+			ewarn ""
+			ewarn "The permissions on the following directory have been reset in"
+			ewarn "order to mitigate a security bug (CVE-2016-1247, bug #605008):"
+			ewarn ""
+			ewarn "  ${EPREFIX}/var/log/nginx"
+			ewarn ""
+			ewarn "Check if this is correct for your setup before restarting nginx!"
+			ewarn "Also ensure that no other log directory used by any of your"
+			ewarn "vhost(s) is not writeable for nginx user. Any of your log files"
+			ewarn "used by nginx can be abused to escalate privileges!"
+			ewarn "This is a one-time change and will not happen on subsequent updates."
+			chown 0:nginx "${EPREFIX}"/var/log/nginx || _has_to_show_permission_warning=1
+			chmod 710 "${EPREFIX}"/var/log/nginx || _has_to_show_permission_warning=1
+		fi
+
+		if [[ ${_has_to_show_permission_warning} -eq 1 ]]; then
+			# Should never happen ...
+			ewarn ""
+			ewarn "*************************************************************"
+			ewarn "***************         W A R N I N G         ***************"
+			ewarn "*************************************************************"
+			ewarn "The one-time only attempt to adjust permissions of the"
+			ewarn "existing nginx installation failed. Be aware that we will not"
+			ewarn "try to adjust the same permissions again because now you are"
+			ewarn "using a nginx version where we expect that the permissions"
+			ewarn "are already adjusted or that you know what you are doing and"
+			ewarn "want to keep custom permissions."
+			ewarn ""
+		fi
+	fi
+
+	# Sanity check for CVE-2016-1247
+	# Required to warn users who received the warning above and thought
+	# they could fix it by unmerging and re-merging the package or have
+	# unmerged a affected installation on purpose in the past leaving
+	# /var/log/nginx on their system due to keepdir/non-empty folder
+	# and are now installing the package again.
+	local _sanity_check_testfile=$(mktemp --dry-run "${EPREFIX}"/var/log/nginx/.CVE-2016-1247.XXXXXXXXX)
+	su -s /bin/sh -c "touch ${_sanity_check_testfile}" nginx >&/dev/null
+	if [ $? -eq 0 ] ; then
+		# Cleanup -- no reason to die here!
+		rm -f "${_sanity_check_testfile}"
+
+		ewarn ""
+		ewarn "*************************************************************"
+		ewarn "***************         W A R N I N G         ***************"
+		ewarn "*************************************************************"
+		ewarn "Looks like your installation is vulnerable to CVE-2016-1247"
+		ewarn "(bug #605008) because nginx user is able to create files in"
+		ewarn ""
+		ewarn "  ${EPREFIX}/var/log/nginx"
+		ewarn ""
+		ewarn "Also ensure that no other log directory used by any of your"
+		ewarn "vhost(s) is not writeable for nginx user. Any of your log files"
+		ewarn "used by nginx can be abused to escalate privileges!"
+	fi
+
+	if [[ ${_has_to_show_httpoxy_mitigation_notice} -eq 1 ]]; then
+		# HTTPoxy mitigation
+		ewarn ""
+		ewarn "This nginx installation comes with a mitigation for the HTTPoxy"
+		ewarn "vulnerability for FastCGI, SCGI and uWSGI applications by setting"
+		ewarn "the HTTP_PROXY parameter to an empty string per default when you"
+		ewarn "are sourcing one of the default"
+		ewarn ""
+		ewarn "  - 'fastcgi_params' or 'fastcgi.conf'"
+		ewarn "  - 'scgi_params'"
+		ewarn "  - 'uwsgi_params'"
+		ewarn ""
+		ewarn "files in your server block(s)."
+		ewarn ""
+		ewarn "If this is causing any problems for you make sure that you are sourcing the"
+		ewarn "default parameters _before_ you set your own values."
+		ewarn "If you are relying on user-supplied proxy values you have to remove the"
+		ewarn "correlating lines from the file(s) mentioned above."
+		ewarn ""
+	fi
+}
diff --git a/www-servers/nginx/nginx-1.29.5.ebuild b/www-servers/nginx/nginx-1.29.5.ebuild
new file mode 100644
index 000000000000..568efe79ce15
--- /dev/null
+++ b/www-servers/nginx/nginx-1.29.5.ebuild
@@ -0,0 +1,34 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+NGINX_SUBSYSTEMS=(+http stream mail)
+NGINX_MODULES=(
+	+http_{charset,gzip,ssi,userid,access,auth_basic,mirror,autoindex,geo,map}
+	+http_{split_clients,referer,rewrite,proxy,fastcgi,uwsgi,scgi,grpc}
+	+http_{memcached,limit_conn,limit_req,empty_gif,browser,upstream_hash}
+	+http_{upstream_ip_hash,upstream_least_conn,upstream_random}
+	+http_{upstream_keepalive,upstream_zone}
+	http_{ssl,v2,v3,realip,addition,xslt,image_filter,geoip,sub,dav,flv,mp4}
+	http_{gunzip,gzip_static,auth_request,random_index,secure_link,degradation}
+	http_{slice,stub_status,perl}
+	+mail_{pop3,imap,smtp}
+	mail_ssl
+	+stream_{limit_conn,access,geo,map,split_clients,return,pass,set}
+	+stream_{upstream_hash,upstream_least_conn,upstream_random,upstream_zone}
+	stream_{ssl,realip,geoip,ssl_preread}
+)
+NGINX_UPDATE_STREAM=mainline
+NGINX_TESTS_COMMIT=2993130953b28ff4d64ea75b5bd35c92c7e510f7
+NGINX_MISC_FILES=(
+	nginx-{r2.logrotate,r2.service,r4.conf,r6.initd,r1.confd,r1.tmpfiles}
+)
+
+inherit nginx
+
+KEYWORDS="amd64 arm arm64 ~loong ~ppc ~ppc64 ~riscv x86"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
+)
diff --git a/www-servers/nginx/nginx-1.29.7-r1.ebuild b/www-servers/nginx/nginx-1.29.7-r1.ebuild
new file mode 100644
index 000000000000..bba0e71122bf
--- /dev/null
+++ b/www-servers/nginx/nginx-1.29.7-r1.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+NGINX_SUBSYSTEMS=(+http stream mail)
+NGINX_MODULES=(
+	+http_{charset,gzip,ssi,userid,access,auth_basic,mirror,autoindex,geo,map}
+	+http_{split_clients,referer,rewrite,proxy,fastcgi,uwsgi,scgi,grpc}
+	+http_{memcached,limit_conn,limit_req,empty_gif,browser,upstream_hash}
+	+http_{upstream_ip_hash,upstream_least_conn,upstream_random}
+	+http_{upstream_keepalive,upstream_zone}
+	http_{ssl,v2,v3,realip,addition,xslt,image_filter,geoip,sub,dav,flv,mp4}
+	http_{gunzip,gzip_static,auth_request,random_index,secure_link,degradation}
+	http_{slice,stub_status,perl}
+	+mail_{pop3,imap,smtp}
+	mail_ssl
+	+stream_{limit_conn,access,geo,map,split_clients,return,pass,set}
+	+stream_{upstream_hash,upstream_least_conn,upstream_random,upstream_zone}
+	stream_{ssl,realip,geoip,ssl_preread}
+)
+NGINX_UPDATE_STREAM=mainline
+NGINX_TESTS_COMMIT=cf90a22921652731302e8a4dc2a88049c723377d
+NGINX_MISC_FILES=(
+	nginx-{r2.logrotate,r2.service,r5.conf,r6.initd,r1.confd,r1.tmpfiles}
+)
+NGINX_SUPPORT_MODULE_STUBS=1
+
+inherit nginx
+
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
+)
diff --git a/www-servers/nginx/nginx-1.30.0.ebuild b/www-servers/nginx/nginx-1.30.0.ebuild
new file mode 100644
index 000000000000..1e34b4185370
--- /dev/null
+++ b/www-servers/nginx/nginx-1.30.0.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+NGINX_SUBSYSTEMS=(+http stream mail)
+NGINX_MODULES=(
+	+http_{charset,gzip,ssi,userid,access,auth_basic,mirror,autoindex,geo,map}
+	+http_{split_clients,referer,rewrite,proxy,fastcgi,uwsgi,scgi,grpc}
+	+http_{memcached,limit_conn,limit_req,empty_gif,browser,upstream_hash}
+	+http_{upstream_ip_hash,upstream_least_conn,upstream_random}
+	+http_{upstream_keepalive,upstream_zone}
+	http_{ssl,v2,v3,realip,addition,xslt,image_filter,geoip,sub,dav,flv,mp4}
+	http_{gunzip,gzip_static,auth_request,random_index,secure_link,degradation}
+	http_{slice,stub_status,perl}
+	+mail_{pop3,imap,smtp}
+	mail_ssl
+	+stream_{limit_conn,access,geo,map,split_clients,return,pass,set}
+	+stream_{upstream_hash,upstream_least_conn,upstream_random,upstream_zone}
+	stream_{ssl,realip,geoip,ssl_preread}
+)
+NGINX_UPDATE_STREAM=stable
+NGINX_TESTS_COMMIT=0f72f59c40de9977bd8f3deff5d200e761b8b683
+NGINX_MISC_FILES=(
+	nginx-{r2.logrotate,r2.service,r5.conf,r6.initd,r1.confd,r1.tmpfiles}
+)
+NGINX_SUPPORT_MODULE_STUBS=1
+
+inherit nginx
+
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
+)
diff --git a/www-servers/nginx/nginx-1.30.2.ebuild b/www-servers/nginx/nginx-1.30.2.ebuild
new file mode 100644
index 000000000000..0f000bf923cf
--- /dev/null
+++ b/www-servers/nginx/nginx-1.30.2.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+NGINX_SUBSYSTEMS=(+http stream mail)
+NGINX_MODULES=(
+	+http_{charset,gzip,ssi,userid,access,auth_basic,mirror,autoindex,geo,map}
+	+http_{split_clients,referer,rewrite,proxy,fastcgi,uwsgi,scgi,grpc}
+	+http_{memcached,limit_conn,limit_req,empty_gif,browser,upstream_hash}
+	+http_{upstream_ip_hash,upstream_least_conn,upstream_random}
+	+http_{upstream_keepalive,upstream_zone}
+	http_{ssl,v2,v3,realip,addition,xslt,image_filter,geoip,sub,dav,flv,mp4}
+	http_{gunzip,gzip_static,auth_request,random_index,secure_link,degradation}
+	http_{slice,stub_status,perl}
+	+mail_{pop3,imap,smtp}
+	mail_ssl
+	+stream_{limit_conn,access,geo,map,split_clients,return,pass,set}
+	+stream_{upstream_hash,upstream_least_conn,upstream_random,upstream_zone}
+	stream_{ssl,realip,geoip,ssl_preread}
+)
+NGINX_UPDATE_STREAM=stable
+NGINX_TESTS_COMMIT=0f72f59c40de9977bd8f3deff5d200e761b8b683
+NGINX_MISC_FILES=(
+	nginx-{r2.logrotate,r2.service,r5.conf,r6.initd,r1.confd,r1.tmpfiles}
+)
+NGINX_SUPPORT_MODULE_STUBS=1
+
+inherit nginx
+
+KEYWORDS="amd64 arm arm64 ~loong ~ppc ~ppc64 ~riscv x86"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
+)
diff --git a/www-servers/nginx/nginx-1.31.1.ebuild b/www-servers/nginx/nginx-1.31.1.ebuild
new file mode 100644
index 000000000000..6be0e089f969
--- /dev/null
+++ b/www-servers/nginx/nginx-1.31.1.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+NGINX_SUBSYSTEMS=(+http stream mail)
+NGINX_MODULES=(
+	+http_{charset,gzip,ssi,userid,access,auth_basic,mirror,autoindex,geo,map}
+	+http_{split_clients,referer,rewrite,proxy,fastcgi,uwsgi,scgi,grpc}
+	+http_{memcached,limit_conn,limit_req,empty_gif,browser,upstream_hash}
+	+http_{upstream_ip_hash,upstream_least_conn,upstream_random}
+	+http_{upstream_keepalive,upstream_zone}
+	http_{ssl,v2,v3,realip,addition,xslt,image_filter,geoip,sub,dav,flv,mp4}
+	http_{gunzip,gzip_static,auth_request,random_index,secure_link,degradation}
+	http_{slice,stub_status,perl}
+	+mail_{pop3,imap,smtp}
+	mail_ssl
+	+stream_{limit_conn,access,geo,map,split_clients,return,pass,set}
+	+stream_{upstream_hash,upstream_least_conn,upstream_random,upstream_zone}
+	stream_{ssl,realip,geoip,ssl_preread}
+)
+NGINX_UPDATE_STREAM=mainline
+NGINX_TESTS_COMMIT=4d1de3f357afeb91865d024b27516d6b67aad86e
+NGINX_MISC_FILES=(
+	nginx-{r2.logrotate,r2.service,r5.conf,r6.initd,r1.confd,r1.tmpfiles}
+)
+NGINX_SUPPORT_MODULE_STUBS=1
+
+inherit nginx
+
+KEYWORDS="~amd64 arm arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
+)
diff --git a/www-servers/nginx/nginx-9999.ebuild b/www-servers/nginx/nginx-9999.ebuild
new file mode 100644
index 000000000000..dd446c87d26c
--- /dev/null
+++ b/www-servers/nginx/nginx-9999.ebuild
@@ -0,0 +1,33 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+NGINX_SUBSYSTEMS=(+http stream mail)
+NGINX_MODULES=(
+	+http_{charset,gzip,ssi,userid,access,auth_basic,mirror,autoindex,geo,map}
+	+http_{split_clients,referer,rewrite,proxy,fastcgi,uwsgi,scgi,grpc}
+	+http_{memcached,limit_conn,limit_req,empty_gif,browser,upstream_hash}
+	+http_{upstream_ip_hash,upstream_least_conn,upstream_random}
+	+http_{upstream_keepalive,upstream_zone}
+	http_{ssl,v2,v3,realip,addition,xslt,image_filter,geoip,sub,dav,flv,mp4}
+	http_{gunzip,gzip_static,auth_request,random_index,secure_link,degradation}
+	http_{slice,stub_status,perl}
+	+mail_{pop3,imap,smtp}
+	mail_ssl
+	+stream_{limit_conn,access,geo,map,split_clients,return,pass,set}
+	+stream_{upstream_hash,upstream_least_conn,upstream_random,upstream_zone}
+	stream_{ssl,realip,geoip,ssl_preread}
+)
+NGINX_UPDATE_STREAM=live
+NGINX_TESTS_COMMIT=live
+NGINX_MISC_FILES=(
+	nginx-{r2.logrotate,r2.service,r5.conf,r6.initd,r1.confd,r1.tmpfiles}
+)
+NGINX_SUPPORT_MODULE_STUBS=1
+
+inherit nginx
+
+PATCHES=(
+	"${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
+)
diff --git a/www-servers/puma/Manifest b/www-servers/puma/Manifest
new file mode 100644
index 000000000000..f9f4946bafc3
--- /dev/null
+++ b/www-servers/puma/Manifest
@@ -0,0 +1,4 @@
+DIST puma-6.6.0.tar.gz 408988 BLAKE2B 656a82b50ef0556ae78791ed268a081c868eda85f273d29003ac587691345f066e3c539a3799a364cd89e57791866dd27af2971c05b3e4a906651e99f6d2a296 SHA512 aa55a06f153c3572e68333c1608b2cf624d85eaad315a76fea886adae22ef00ea1d5f316ecad2e7f02b2e923090c0587a8d17666eda69c6526399b23cb83f289
+DIST puma-6.6.1.tar.gz 412347 BLAKE2B 6d0146f9bc39b0eb82edcea78cceeccccf9dba69d8d39a4c7710ab1a073f4909d5d7f2ec470c3d9a9d51738639b4fd72b16c359ccfeb6573ecfbbdbbf5384897 SHA512 5838b5eabb1190ba7af5429c08f34428954fb3e9c23bc8b78850021fc628bcb888feefea6f76d24caf490b1a45d890289dfe9b5c90ee9891b6387f81b6c05626
+DIST puma-7.1.0.tar.gz 424242 BLAKE2B be800a0b7ae2850ddbaac3408331956278a13150e20383270f874b404992fe6c80c430658f96fcb29f741c09a966d716f2e80e5fa757943b0bb7f1b4069f5686 SHA512 f00140080664e9f44181b289fb98059d1da70d6f6e555d8506a8e971954187635e36444d5aec14b9a849fec53b4e41d72961ca5550e69043dab2f211494455a5
+DIST puma-7.2.0.tar.gz 426885 BLAKE2B ed2849482d00731a7098627891690bc314c7048e64d352a481b432cede78ca310f01dcd5c0658475467804430b63b8cc67fd09245b5781571bcaeaae24913920 SHA512 4439f2f752eef8f2f9aa45ad879f9b5a4e40e27af66623f4b7c54b5c93b1648e4713ef5c00d9a77e874960a3d8ecdddf6e77f9c80d2319215fd5fc7b312d1c46
diff --git a/www-servers/puma/metadata.xml b/www-servers/puma/metadata.xml
new file mode 100644
index 000000000000..be8b06c29142
--- /dev/null
+++ b/www-servers/puma/metadata.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>ruby@gentoo.org</email>
+    <name>Gentoo Ruby Project</name>
+  </maintainer>
+  <longdescription>
+    Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1
+    server for Ruby/Rack applications. Puma is intended for use in
+    both development and production environments. In order to get the
+    best throughput, it is highly recommended that you use a Ruby
+    implementation with real threads like Rubinius or JRuby.
+  </longdescription>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:puma:puma</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/puma/puma-6.6.0.ebuild b/www-servers/puma/puma-6.6.0.ebuild
new file mode 100644
index 000000000000..3b6a213bf32d
--- /dev/null
+++ b/www-servers/puma/puma-6.6.0.ebuild
@@ -0,0 +1,87 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+USE_RUBY="ruby31 ruby32 ruby33 ruby34"
+
+RUBY_FAKEGEM_GEMSPEC="puma.gemspec"
+
+RUBY_FAKEGEM_EXTENSIONS=(ext/puma_http11/extconf.rb)
+RUBY_FAKEGEM_EXTENSION_LIBDIR=lib/puma
+
+inherit ruby-fakegem
+
+DESCRIPTION="a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack"
+HOMEPAGE="https://puma.io/"
+SRC_URI="https://github.com/puma/puma/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="3"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+
+DEPEND="dev-libs/openssl:0 test? ( net-misc/curl )"
+RDEPEND="dev-libs/openssl:0="
+
+ruby_add_bdepend "virtual/ruby-ssl
+	test? (
+		dev-ruby/concurrent-ruby
+		dev-ruby/localhost
+		|| ( dev-ruby/rack:3.1 dev-ruby/rack:3.0 )
+		dev-ruby/rackup
+		>=dev-ruby/minitest-5.9:5
+		>=dev-ruby/test-unit-3.0:2
+	)"
+
+ruby_add_rdepend "dev-ruby/nio4r:2"
+
+all_ruby_prepare() {
+	sed -e '/\(pride\|prove\|stub_const\)/ s:^:#:' \
+		-e '/require_relative.*verbose/ s:^:#:' \
+		-i test/helper.rb || die
+
+	# Avoid tests failing inconsistently
+	#sed -i -e '/test_bad_client/askip "inconsistent results"' test/test_web_server.rb || die
+
+	# Avoid tests depending on specific encoding
+	#sed -i -e '/test_lowlevel_error_handler_response/askip "specific encoding required"' test/test_puma_server.rb || die
+
+	# Avoid launcher tests since they make assumptions about bundler use
+	rm -f test/test_launcher.rb test/test_worker_gem_independence.rb test/test_bundle_pruner.rb || die
+	sed -e '/test_web_concurrency_with_concurrent_ruby_unavailable/askip "Cannot provide environment for this"' \
+		-i test/test_web_concurrency_auto.rb || die
+
+	# Skip integration tests since they make a lot of assumptions about
+	# the environment
+	rm -f test/test_integration_* test/test_preserve_bundler_env.rb|| die
+
+	# Avoid test that uses unpackaged stub_const
+	sed -i -e '/test_shutdown_with_grace/,/^  end/ s:^:#:' test/test_thread_pool.rb || die
+
+	# Avoid test that fails, most likely due to how we run the test suite
+	rm -f test/test_url_map.rb || die
+
+	# Avoid test that fails sometimes, possibly due to timing
+	# constraints or a race condition.
+	#sed -e '/test_systemd_notify_usr1_phased_restart_cluster/askip "Flaky test"' \
+	#	-i test/test_plugin_systemd.rb || die
+
+	# Avoid a test that fails on systemd systems due to the pluging
+	# getting autoloaded there, bug #954180
+	sed -e '/test_plugins/askip "Fails on a systemd system"' \
+		-i test/test_cli.rb || die
+
+	# Tries to call 'rackup' directly
+	sed -i -e '/def test_bin/,/^    end/ s:^:#:' test/test_rack_handler.rb || die
+
+	sed -e 's/git ls-files --/find/' \
+		-e 's:_relative ": "./:' \
+		-i ${RUBY_FAKEGEM_GEMSPEC} || die
+}
+
+each_ruby_test() {
+	einfo "Running test suite"
+
+	MT_NO_PLUGINS=true ${RUBY} -Ilib:.:test \
+		-e "require 'minitest/autorun'; Dir['test/**/*test_*.rb'].each{require _1}" || die
+}
diff --git a/www-servers/puma/puma-6.6.1.ebuild b/www-servers/puma/puma-6.6.1.ebuild
new file mode 100644
index 000000000000..55a315c44bad
--- /dev/null
+++ b/www-servers/puma/puma-6.6.1.ebuild
@@ -0,0 +1,87 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+USE_RUBY="ruby32 ruby33 ruby34"
+
+RUBY_FAKEGEM_GEMSPEC="puma.gemspec"
+
+RUBY_FAKEGEM_EXTENSIONS=(ext/puma_http11/extconf.rb)
+RUBY_FAKEGEM_EXTENSION_LIBDIR=lib/puma
+
+inherit ruby-fakegem
+
+DESCRIPTION="a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack"
+HOMEPAGE="https://puma.io/"
+SRC_URI="https://github.com/puma/puma/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="3"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+
+DEPEND="dev-libs/openssl:0 test? ( net-misc/curl )"
+RDEPEND="dev-libs/openssl:0="
+
+ruby_add_bdepend "virtual/ruby-ssl
+	test? (
+		dev-ruby/concurrent-ruby
+		dev-ruby/localhost
+		|| ( dev-ruby/rack:3.1 dev-ruby/rack:3.0 )
+		dev-ruby/rackup
+		>=dev-ruby/minitest-5.9:5
+		>=dev-ruby/test-unit-3.0:2
+	)"
+
+ruby_add_rdepend "dev-ruby/nio4r:2"
+
+all_ruby_prepare() {
+	sed -e '/\(pride\|prove\|stub_const\)/ s:^:#:' \
+		-e '/require_relative.*verbose/ s:^:#:' \
+		-i test/helper.rb || die
+
+	# Avoid tests failing inconsistently
+	#sed -i -e '/test_bad_client/askip "inconsistent results"' test/test_web_server.rb || die
+
+	# Avoid tests depending on specific encoding
+	#sed -i -e '/test_lowlevel_error_handler_response/askip "specific encoding required"' test/test_puma_server.rb || die
+
+	# Avoid launcher tests since they make assumptions about bundler use
+	rm -f test/test_launcher.rb test/test_worker_gem_independence.rb test/test_bundle_pruner.rb || die
+	sed -e '/test_web_concurrency_with_concurrent_ruby_unavailable/askip "Cannot provide environment for this"' \
+		-i test/test_web_concurrency_auto.rb || die
+
+	# Skip integration tests since they make a lot of assumptions about
+	# the environment
+	rm -f test/test_integration_* test/test_preserve_bundler_env.rb|| die
+
+	# Avoid test that uses unpackaged stub_const
+	sed -i -e '/test_shutdown_with_grace/,/^  end/ s:^:#:' test/test_thread_pool.rb || die
+
+	# Avoid test that fails, most likely due to how we run the test suite
+	rm -f test/test_url_map.rb || die
+
+	# Avoid test that fails sometimes, possibly due to timing
+	# constraints or a race condition.
+	#sed -e '/test_systemd_notify_usr1_phased_restart_cluster/askip "Flaky test"' \
+	#	-i test/test_plugin_systemd.rb || die
+
+	# Avoid a test that fails on systemd systems due to the pluging
+	# getting autoloaded there, bug #954180
+	sed -e '/test_plugins/askip "Fails on a systemd system"' \
+		-i test/test_cli.rb || die
+
+	# Tries to call 'rackup' directly
+	sed -i -e '/def test_bin/,/^    end/ s:^:#:' test/test_rack_handler.rb || die
+
+	sed -e 's/git ls-files --/find/' \
+		-e 's:_relative ": "./:' \
+		-i ${RUBY_FAKEGEM_GEMSPEC} || die
+}
+
+each_ruby_test() {
+	einfo "Running test suite"
+
+	MT_NO_PLUGINS=true ${RUBY} -Ilib:.:test \
+		-e "require 'minitest/autorun'; Dir['test/**/*test_*.rb'].each{require _1}" || die
+}
diff --git a/www-servers/puma/puma-7.1.0.ebuild b/www-servers/puma/puma-7.1.0.ebuild
new file mode 100644
index 000000000000..55a315c44bad
--- /dev/null
+++ b/www-servers/puma/puma-7.1.0.ebuild
@@ -0,0 +1,87 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+USE_RUBY="ruby32 ruby33 ruby34"
+
+RUBY_FAKEGEM_GEMSPEC="puma.gemspec"
+
+RUBY_FAKEGEM_EXTENSIONS=(ext/puma_http11/extconf.rb)
+RUBY_FAKEGEM_EXTENSION_LIBDIR=lib/puma
+
+inherit ruby-fakegem
+
+DESCRIPTION="a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack"
+HOMEPAGE="https://puma.io/"
+SRC_URI="https://github.com/puma/puma/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="3"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+
+DEPEND="dev-libs/openssl:0 test? ( net-misc/curl )"
+RDEPEND="dev-libs/openssl:0="
+
+ruby_add_bdepend "virtual/ruby-ssl
+	test? (
+		dev-ruby/concurrent-ruby
+		dev-ruby/localhost
+		|| ( dev-ruby/rack:3.1 dev-ruby/rack:3.0 )
+		dev-ruby/rackup
+		>=dev-ruby/minitest-5.9:5
+		>=dev-ruby/test-unit-3.0:2
+	)"
+
+ruby_add_rdepend "dev-ruby/nio4r:2"
+
+all_ruby_prepare() {
+	sed -e '/\(pride\|prove\|stub_const\)/ s:^:#:' \
+		-e '/require_relative.*verbose/ s:^:#:' \
+		-i test/helper.rb || die
+
+	# Avoid tests failing inconsistently
+	#sed -i -e '/test_bad_client/askip "inconsistent results"' test/test_web_server.rb || die
+
+	# Avoid tests depending on specific encoding
+	#sed -i -e '/test_lowlevel_error_handler_response/askip "specific encoding required"' test/test_puma_server.rb || die
+
+	# Avoid launcher tests since they make assumptions about bundler use
+	rm -f test/test_launcher.rb test/test_worker_gem_independence.rb test/test_bundle_pruner.rb || die
+	sed -e '/test_web_concurrency_with_concurrent_ruby_unavailable/askip "Cannot provide environment for this"' \
+		-i test/test_web_concurrency_auto.rb || die
+
+	# Skip integration tests since they make a lot of assumptions about
+	# the environment
+	rm -f test/test_integration_* test/test_preserve_bundler_env.rb|| die
+
+	# Avoid test that uses unpackaged stub_const
+	sed -i -e '/test_shutdown_with_grace/,/^  end/ s:^:#:' test/test_thread_pool.rb || die
+
+	# Avoid test that fails, most likely due to how we run the test suite
+	rm -f test/test_url_map.rb || die
+
+	# Avoid test that fails sometimes, possibly due to timing
+	# constraints or a race condition.
+	#sed -e '/test_systemd_notify_usr1_phased_restart_cluster/askip "Flaky test"' \
+	#	-i test/test_plugin_systemd.rb || die
+
+	# Avoid a test that fails on systemd systems due to the pluging
+	# getting autoloaded there, bug #954180
+	sed -e '/test_plugins/askip "Fails on a systemd system"' \
+		-i test/test_cli.rb || die
+
+	# Tries to call 'rackup' directly
+	sed -i -e '/def test_bin/,/^    end/ s:^:#:' test/test_rack_handler.rb || die
+
+	sed -e 's/git ls-files --/find/' \
+		-e 's:_relative ": "./:' \
+		-i ${RUBY_FAKEGEM_GEMSPEC} || die
+}
+
+each_ruby_test() {
+	einfo "Running test suite"
+
+	MT_NO_PLUGINS=true ${RUBY} -Ilib:.:test \
+		-e "require 'minitest/autorun'; Dir['test/**/*test_*.rb'].each{require _1}" || die
+}
diff --git a/www-servers/puma/puma-7.2.0.ebuild b/www-servers/puma/puma-7.2.0.ebuild
new file mode 100644
index 000000000000..75a23fe9e723
--- /dev/null
+++ b/www-servers/puma/puma-7.2.0.ebuild
@@ -0,0 +1,87 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+USE_RUBY="ruby32 ruby33 ruby34"
+
+RUBY_FAKEGEM_GEMSPEC="puma.gemspec"
+
+RUBY_FAKEGEM_EXTENSIONS=(ext/puma_http11/extconf.rb)
+RUBY_FAKEGEM_EXTENSION_LIBDIR=lib/puma
+
+inherit ruby-fakegem
+
+DESCRIPTION="a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack"
+HOMEPAGE="https://puma.io/"
+SRC_URI="https://github.com/puma/puma/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="3"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+
+DEPEND="dev-libs/openssl:0 test? ( net-misc/curl )"
+RDEPEND="dev-libs/openssl:0="
+
+ruby_add_bdepend "virtual/ruby-ssl
+	test? (
+		dev-ruby/concurrent-ruby
+		dev-ruby/localhost
+		|| ( dev-ruby/rack:3.2 dev-ruby/rack:3.1 dev-ruby/rack:3.0 )
+		dev-ruby/rackup
+		>=dev-ruby/minitest-5.9:5
+		>=dev-ruby/test-unit-3.0:2
+	)"
+
+ruby_add_rdepend "dev-ruby/nio4r:2"
+
+all_ruby_prepare() {
+	sed -e '/\(pride\|prove\|stub_const\)/ s:^:#:' \
+		-e '/require_relative.*verbose/ s:^:#:' \
+		-i test/helper.rb || die
+
+	# Avoid tests failing inconsistently
+	#sed -i -e '/test_bad_client/askip "inconsistent results"' test/test_web_server.rb || die
+
+	# Avoid tests depending on specific encoding
+	#sed -i -e '/test_lowlevel_error_handler_response/askip "specific encoding required"' test/test_puma_server.rb || die
+
+	# Avoid launcher tests since they make assumptions about bundler use
+	rm -f test/test_launcher.rb test/test_worker_gem_independence.rb test/test_bundle_pruner.rb || die
+	sed -e '/test_web_concurrency_with_concurrent_ruby_unavailable/askip "Cannot provide environment for this"' \
+		-i test/test_web_concurrency_auto.rb || die
+
+	# Skip integration tests since they make a lot of assumptions about
+	# the environment
+	rm -f test/test_integration_* test/test_preserve_bundler_env.rb|| die
+
+	# Avoid test that uses unpackaged stub_const
+	sed -i -e '/test_shutdown_with_grace/,/^  end/ s:^:#:' test/test_thread_pool.rb || die
+
+	# Avoid test that fails, most likely due to how we run the test suite
+	rm -f test/test_url_map.rb || die
+
+	# Avoid test that fails sometimes, possibly due to timing
+	# constraints or a race condition.
+	#sed -e '/test_systemd_notify_usr1_phased_restart_cluster/askip "Flaky test"' \
+	#	-i test/test_plugin_systemd.rb || die
+
+	# Avoid a test that fails on systemd systems due to the pluging
+	# getting autoloaded there, bug #954180
+	sed -e '/test_plugins/askip "Fails on a systemd system"' \
+		-i test/test_cli.rb || die
+
+	# Tries to call 'rackup' directly
+	sed -i -e '/def test_bin/,/^    end/ s:^:#:' test/test_rack_handler.rb || die
+
+	sed -e 's/git ls-files --/find/' \
+		-e 's:_relative ": "./:' \
+		-i ${RUBY_FAKEGEM_GEMSPEC} || die
+}
+
+each_ruby_test() {
+	einfo "Running test suite"
+
+	MT_NO_PLUGINS=true ${RUBY} -Ilib:.:test \
+		-e "gem 'minitest', '~> 5.0'; require 'minitest/autorun'; Dir['test/**/*test_*.rb'].each{require _1}" || die
+}
diff --git a/www-servers/servefile/Manifest b/www-servers/servefile/Manifest
new file mode 100644
index 000000000000..343c2afac23c
--- /dev/null
+++ b/www-servers/servefile/Manifest
@@ -0,0 +1 @@
+DIST servefile-0.5.4.tar.gz 21936 BLAKE2B 3356edbe20a76dc7750700cb1adb90625554065ecc904f7a32ea599523e897c0f2ce6c5d4fd4689ddd68572fa55a7fc2eb6d1e27c4bc6f44a737cdcc28eebad3 SHA512 114ca0c156c41002f1ec4d547f309fafe0d698560129c8365f1b6317547e46837c123d2659a17583deb78f9975ae31388a72a831e3a1f0f3e6ad2b21fe254884
diff --git a/www-servers/servefile/files/servefile-0.5.2-ipv6-absent-tests.patch b/www-servers/servefile/files/servefile-0.5.2-ipv6-absent-tests.patch
new file mode 100644
index 000000000000..6231fc8b7d91
--- /dev/null
+++ b/www-servers/servefile/files/servefile-0.5.2-ipv6-absent-tests.patch
@@ -0,0 +1,25 @@
+From 3d34ff40f1a24873793c33b8f16a9940050fa93f Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 24 May 2020 15:51:15 +0200
+Subject: [PATCH] Fix test test_ipv4_only for global USE=-ipv6
+
+---
+ tests/test_servefile.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/test_servefile.py b/tests/test_servefile.py
+index 8132f6b..3f127f4 100644
+--- a/tests/test_servefile.py
++++ b/tests/test_servefile.py
+@@ -137,7 +137,7 @@ def test_ipv4_only(run_servefile, datadir):
+     check_download(data, fname='testfile', host='127.0.0.1')
+ 
+     sock = socket.socket(socket.AF_INET6)
+-    with pytest.raises(connrefused_exc):
++    with pytest.raises((connrefused_exc, OSError)):
+         sock.connect(("::1", SERVEFILE_DEFAULT_PORT))
+ 
+ 
+-- 
+2.26.2
+
diff --git a/www-servers/servefile/metadata.xml b/www-servers/servefile/metadata.xml
new file mode 100644
index 000000000000..c083c00402f0
--- /dev/null
+++ b/www-servers/servefile/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>sping@gentoo.org</email>
+    <name>Sebastian Pipping</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/servefile/servefile-0.5.4-r2.ebuild b/www-servers/servefile/servefile-0.5.4-r2.ebuild
new file mode 100644
index 000000000000..621a93bf02ff
--- /dev/null
+++ b/www-servers/servefile/servefile-0.5.4-r2.ebuild
@@ -0,0 +1,43 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+PYTHON_COMPAT=( python3_{13..14} )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit distutils-r1
+
+DESCRIPTION="Serve a single file via HTTP"
+HOMEPAGE="https://github.com/sebageek/servefile"
+SRC_URI="https://github.com/sebageek/servefile/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}"/${P}
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="ssl test"
+
+RDEPEND="
+	ssl? ( dev-python/pyopenssl[${PYTHON_USEDEP}] )
+	sys-apps/grep
+	sys-apps/iproute2
+	sys-apps/net-tools
+	sys-apps/sed
+	$(python_gen_cond_dep '
+		dev-python/legacy-cgi[${PYTHON_USEDEP}]
+	' 3.13)"
+DEPEND="test? (
+		${RDEPEND}
+		dev-python/requests[${PYTHON_USEDEP}]
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.5.2-ipv6-absent-tests.patch
+)
+
+distutils_enable_tests pytest
+
+src_install() {
+	distutils-r1_src_install
+	doman ${PN}.1
+}
diff --git a/www-servers/servefile/servefile-0.5.4-r3.ebuild b/www-servers/servefile/servefile-0.5.4-r3.ebuild
new file mode 100644
index 000000000000..2a2f063bcb77
--- /dev/null
+++ b/www-servers/servefile/servefile-0.5.4-r3.ebuild
@@ -0,0 +1,43 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+PYTHON_COMPAT=( python3_{13..14} )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit distutils-r1
+
+DESCRIPTION="Serve a single file via HTTP"
+HOMEPAGE="https://github.com/sebageek/servefile"
+SRC_URI="https://github.com/sebageek/servefile/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}"/${P}
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="ssl test"
+
+RDEPEND="
+	ssl? ( dev-python/pyopenssl[${PYTHON_USEDEP}] )
+	sys-apps/grep
+	sys-apps/iproute2
+	sys-apps/net-tools
+	sys-apps/sed
+	$(python_gen_cond_dep '
+		dev-python/legacy-cgi[${PYTHON_USEDEP}]
+	' 3.13 3.14)"
+DEPEND="test? (
+		${RDEPEND}
+		dev-python/requests[${PYTHON_USEDEP}]
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.5.2-ipv6-absent-tests.patch
+)
+
+distutils_enable_tests pytest
+
+src_install() {
+	distutils-r1_src_install
+	doman ${PN}.1
+}
diff --git a/www-servers/sniproxy/Manifest b/www-servers/sniproxy/Manifest
new file mode 100644
index 000000000000..75a6aa3dca5b
--- /dev/null
+++ b/www-servers/sniproxy/Manifest
@@ -0,0 +1 @@
+DIST sniproxy-0.6.1.tar.gz 78939 BLAKE2B dd11d47779dbf876724a8e0951c137343c25e420ca0b34055adbd31abda9ad56e38d1addd3ab0a7d85079fec3a456faba87df9cdf261570d8c1d7cfdf534f852 SHA512 4a20830ee6dfeb33a363c480c4698c263a8deccfcac2071198248147ef40d951a1b551c373b0e1e29f6b6bfcdac350390f8f4c3653ed9d1f1940ed50c96af785
diff --git a/www-servers/sniproxy/files/sniproxy.init b/www-servers/sniproxy/files/sniproxy.init
new file mode 100644
index 000000000000..db9c99bfabeb
--- /dev/null
+++ b/www-servers/sniproxy/files/sniproxy.init
@@ -0,0 +1,17 @@
+#!/sbin/openrc-run
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+name="sniproxy daemon"
+description="Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request."
+
+SNIPROXY_CONFFILE=${SNIPROXY_CONFFILE:-/etc/sniproxy/${SVCNAME}.conf}
+
+command="/usr/sbin/sniproxy"
+command_args="-c \"${SNIPROXY_CONFFILE}\""
+pidfile=${SNIPROXY_PIDFILE:-/var/run/sniproxy.pid}
+
+depend() {
+	need net
+	use logger
+}
diff --git a/www-servers/sniproxy/metadata.xml b/www-servers/sniproxy/metadata.xml
new file mode 100644
index 000000000000..ba0d7c3d14c1
--- /dev/null
+++ b/www-servers/sniproxy/metadata.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>nemunaire@nemunai.re</email>
+    <name>Pierre-Olivier Mercier</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <use>
+    <flag name="dns">
+			Enable DNS resolver via <pkg>net-libs/udns</pkg>
+    </flag>
+    <flag name="largefile">
+			Enable large file support (so we can log more than 2GB)
+		</flag>
+    <flag name="rfc3339">
+			Use RFC3339 timestamp format in log.
+		</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/sniproxy/sniproxy-0.6.1.ebuild b/www-servers/sniproxy/sniproxy-0.6.1.ebuild
new file mode 100644
index 000000000000..68ab699da316
--- /dev/null
+++ b/www-servers/sniproxy/sniproxy-0.6.1.ebuild
@@ -0,0 +1,76 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools
+
+if [[ ${PV} == *9999 ]]; then
+	EGIT_REPO_URI="https://github.com/dlundquist/sniproxy.git"
+	EGIT_BRANCH="master"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/dlundquist/sniproxy/archive/${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~x86"
+fi
+
+DESCRIPTION="Proxies incoming HTTP and TLS connections based on the hostname"
+HOMEPAGE="https://github.com/dlundquist/sniproxy"
+
+LICENSE="BSD-2"
+SLOT="0"
+IUSE="+dns +largefile rfc3339 test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	acct-group/sniproxy
+	acct-user/sniproxy
+	dev-libs/libev
+	>=dev-libs/libpcre-3
+	dns? ( net-libs/udns )"
+DEPEND="${RDEPEND}
+	elibc_musl? ( sys-libs/queue-standalone )
+	test? ( net-misc/curl )"
+BDEPEND="
+	sys-devel/gettext
+	virtual/pkgconfig"
+
+src_prepare() {
+	default
+	eautoreconf
+
+	sed -i "/user/s/daemon/sniproxy/" debian/sniproxy.conf || die "Unable to replace configuration"
+	sed -i "/create/s/daemon/sniproxy/" debian/logrotate.conf || die "Unable to replace logrotate configuration"
+}
+
+src_configure() {
+	local my_conf=(
+		$(use_enable dns)
+		$(use_enable largefile)
+		$(use_enable rfc3339 rfc3339-timestamps)
+	)
+
+	econf "${my_conf[@]}"
+}
+
+src_test() {
+	emake -j1 check
+}
+
+src_install() {
+	default
+
+	newinitd "${FILESDIR}/sniproxy.init" sniproxy
+
+	insinto /etc/sniproxy
+	doins debian/sniproxy.conf
+
+	keepdir /var/log/sniproxy
+
+	insinto /etc/logrotate.d
+	newins debian/logrotate.conf sniproxy
+
+	dodoc ARCHITECTURE.md AUTHORS README.md
+	doman man/sniproxy.8
+	doman man/sniproxy.conf.5
+}
diff --git a/www-servers/spawn-fcgi/Manifest b/www-servers/spawn-fcgi/Manifest
new file mode 100644
index 000000000000..8709362ae219
--- /dev/null
+++ b/www-servers/spawn-fcgi/Manifest
@@ -0,0 +1,2 @@
+DIST spawn-fcgi-1.6.5.tar.xz 79968 BLAKE2B 04e8d94e1b8428f4482c4b557c3ba455ff2649ba46e37c55812dba7dccd99a8aa94f04060ba6ea249aa10fe5ca0a3c1b1f995828750cd9a1b0ec0d1f669c5312 SHA512 a6dc2a977953e1092c0b6808b134dfda77869a5c86801d04cfe9e00ee1dcd528d4e2c3adc906f6b6130d6f2cdafd436ba550197701c8b27bbc5a8419e02d269c
+DIST spawn-fcgi-1.6.6.tar.xz 11852 BLAKE2B 03bdb7cdf2dae4caecc879e41057bd814a89a17f159e95ea759a1c3244ba74e68514f3638fa82be25585465eb17f12f3409f52cd7d812ccaa008e8b3ef8d8434 SHA512 d84db80960853dfa65deaea0783d12cb1fdd5c95a6febda5ff59d9feaea119700da563e638c84a6922ea20c8f8295f26c1369144a374410cce06f4d33ade8c63
diff --git a/www-servers/spawn-fcgi/files/spawn-fcgi.confd b/www-servers/spawn-fcgi/files/spawn-fcgi.confd
new file mode 100644
index 000000000000..3e7f103a8fe2
--- /dev/null
+++ b/www-servers/spawn-fcgi/files/spawn-fcgi.confd
@@ -0,0 +1,73 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+# DO NOT MODIFY THIS FILE DIRECTLY! CREATE A COPY AND MODIFY THAT INSTEAD!
+
+# The FCGI process can be made available through a filesystem socket or
+# through a inet socket. One and only one of the two types must be choosen.
+# Default is the inet socket.
+
+# The filename specified by
+# FCGI_SOCKET will be suffixed with a number for each child process, for
+# example, fcgi.socket-1. 
+# Leave empty to use an IP socket (default). See below. Enabling this, 
+# disables the IP socket.
+# 
+FCGI_SOCKET=
+
+# When using FCGI_PORT, connections will only be accepted from the following
+# address. The default is 127.0.0.1. Use 0.0.0.0 to bind to all addresses.
+#
+FCGI_ADDRESS=127.0.0.1
+
+# The port specified by FCGI_PORT is the port used
+# by the first child process. If this is set to 1234 then subsequent child
+# processes will use 1235, 1236, etc.
+#
+FCGI_PORT=1234
+
+# The path to your FastCGI application. These sometimes carry the .fcgi
+# extension but not always. For PHP, you should usually point this to
+# /usr/bin/php-cgi.
+#
+#FCGI_PROGRAM=/usr/bin/php-cgi
+FCGI_PROGRAM=
+
+# The number of child processes to spawn. The default is 1.
+#
+FCGI_CHILDREN=1
+
+# If you want to run your application inside a chroot then specify the
+# directory here. Leave this blank otherwise.
+#
+FCGI_CHROOT=
+
+# If you want to run your application from a specific directiory specify
+# it here. Leave this blank otherwise.
+#
+FCGI_CHDIR=
+
+# The user and group to run your application as. If you do not specify these,
+# the application will be run as root:root.
+#
+FCGI_USER=
+FCGI_GROUP=
+
+# Additional options you might want to pass to spawn-fcgi
+#
+#FCGI_EXTRA_OPTIONS=
+
+# If your application requires additional environment variables, you may
+# specify them here. See PHP example below.
+#
+ALLOWED_ENV="PATH"
+
+# PHP ONLY :: These two options are specific to PHP. The first is the number
+# of child processes to spawn. The second is the number of requests to be
+# served by a single PHP process before it is restarted.
+#
+#PHP_FCGI_CHILDREN=5
+#PHP_FCGI_MAX_REQUESTS=500
+#
+# For this to work you would set
+# ALLOWED_ENV="PATH PHP_FCGI_CHILDREN PHP_FCGI_MAX_REQUESTS"
diff --git a/www-servers/spawn-fcgi/files/spawn-fcgi.initd-r3 b/www-servers/spawn-fcgi/files/spawn-fcgi.initd-r3
new file mode 100644
index 000000000000..ef680aad2776
--- /dev/null
+++ b/www-servers/spawn-fcgi/files/spawn-fcgi.initd-r3
@@ -0,0 +1,116 @@
+#!/sbin/openrc-run
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+PROGNAME=${SVCNAME#*.}
+SPAWNFCGI=/usr/bin/spawn-fcgi
+PIDPATH=/run/spawn-fcgi
+PIDFILE=${PIDPATH}/${PROGNAME}
+
+depend() {
+	need net
+}
+
+start() {
+	local X E OPTIONS i RETVAL FCGI_PROGRAM_EXEC
+	FCGI_PROGRAM_EXEC=$(echo ${FCGI_PROGRAM} | awk "{print \$1}")
+
+	if [ "${SVCNAME}" = "spawn-fcgi" ]; then
+		eerror "You are not supposed to run this script directly. Create a symlink"
+		eerror "for the FastCGI application you want to run as well as a copy of the"
+		eerror "configuration file and modify it appropriately like so..."
+		eerror
+		eerror "  ln -s spawn-fcgi /etc/init.d/spawn-fcgi.trac"
+		eerror "  cp /etc/conf.d/spawn-fcgi /etc/conf.d/spawn-fcgi.trac"
+		eerror "  `basename "${EDITOR}"` /etc/conf.d/spawn-fcgi.trac"
+		eerror
+		return 1
+	fi
+
+	if [ ! -z "${FCGI_SOCKET}" ] && [ ! -z "${FCGI_PORT}" ]; then
+		eerror "Only one of the two may be defined:"
+		eerror "  FCGI_SOCKET=${FCGI_SOCKET}"
+		eerror "  FCGI_PORT=${FCGI_PORT}"
+		return 1
+	fi
+
+	if [ -z "${FCGI_PROGRAM}" ]; then
+		eerror "You need to specify which \$FCGI_PROGRAM"
+		eerror "you want to start."
+		eerror "Please adjust /etc/conf.d/spawn-fcgi.${PROGNAME}"
+		return 1
+	fi
+
+	if [ ! -x "${FCGI_PROGRAM_EXEC}" ]; then
+		eerror "The file specified as \$FCGI_PROGRAM"
+		eerror "does not exist or is not executable."
+		eerror "Please adjust /etc/conf.d/spawn-fcgi.${PROGNAME}"
+		return 1
+	fi
+
+	if [ -z "${FCGI_ADDRESS}" ]; then
+		FCGI_ADDRESS=127.0.0.1
+	fi
+
+	if [ -z "${FCGI_CHILDREN}" ]; then
+		FCGI_CHILDREN=1
+	fi
+
+	if [ -n "${FCGI_CHROOT}" ]; then
+		OPTIONS="${OPTIONS} -c ${FCGI_CHROOT}"
+	fi
+
+	if [ -n "${FCGI_CHDIR}" ]; then
+		OPTIONS="${OPTIONS} -d ${FCGI_CHDIR}"
+	fi
+
+	if [ -n "${FCGI_USER}" ] && [ "${FCGI_USER}" != "root" ]; then
+		OPTIONS="${OPTIONS} -u ${FCGI_USER}"
+	fi
+
+	if [ -n "${FCGI_GROUP}" ] && [ "${FCGI_GROUP}" != "root" ]; then
+		OPTIONS="${OPTIONS} -g ${FCGI_GROUP}"
+	fi
+
+	if [ -n "${FCGI_EXTRA_OPTIONS}" ]; then
+		OPTIONS="${OPTIONS} ${FCGI_EXTRA_OPTIONS}"
+	fi
+
+	unset E
+	for i in ${ALLOWED_ENV}; do
+		local j
+		eval j=$(echo \$"$i")
+		[ -n "${j}" ] && E="${E} --env ${i}=${j}"
+	done
+
+	ebegin "Starting FastCGI application ${PROGNAME}"
+	checkpath -q -d -m 700 /run/spawn-fcgi
+	X=0
+	while [ $X -lt ${FCGI_CHILDREN} ]; do
+		X=$(($X+1))
+		local P SOCKET_OPTION INET_OPTION
+		P=${PIDFILE}-${X}.pid
+		[ -n "${FCGI_SOCKET}" ] && SOCKET_OPTION="-s ${FCGI_SOCKET}-${X}"
+		[ -n "${FCGI_PORT}" ] && INET_OPTION="-a ${FCGI_ADDRESS} -p $((${FCGI_PORT} + ${X} - 1))"
+
+		start-stop-daemon --start --pidfile ${P} --exec ${SPAWNFCGI} \
+			${E} -- ${SOCKET_OPTION} ${INET_OPTION} \
+			-P ${P} ${OPTIONS} -- ${FCGI_PROGRAM}
+		RETVAL=$?
+
+		# Stop on error. Don't want to spawn a mess!
+		[ "${RETVAL}" != "0" ] && break
+	done
+	eend ${RETVAL}
+}
+
+stop() {
+	local X RETVAL=0
+
+	ebegin "Stopping FastCGI application ${PROGNAME}"
+	for X in ${PIDFILE}-[0-9]*.pid ; do
+		start-stop-daemon --stop --pidfile ${X} || \
+			{ RETVAL=$? && break ; }
+	done
+	eend ${RETVAL}
+}
diff --git a/www-servers/spawn-fcgi/metadata.xml b/www-servers/spawn-fcgi/metadata.xml
new file mode 100644
index 000000000000..18cdda42ecb3
--- /dev/null
+++ b/www-servers/spawn-fcgi/metadata.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>andcycle-gentoo@andcycle.idv.tw</email>
+    <name>Hsu, Chih-Hsiang</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription lang="en">
+		spawn-fcgi is used to spawn FastCGI applications
+
+		Features:
+		- binds to IPv4 and Unix domain sockets
+		- supports privilege separation: chmod/chown socket, drop to uid/gid
+		- supports chroot
+		- supports daemontools supervise
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/spawn-fcgi/spawn-fcgi-1.6.5.ebuild b/www-servers/spawn-fcgi/spawn-fcgi-1.6.5.ebuild
new file mode 100644
index 000000000000..b4a29d71af84
--- /dev/null
+++ b/www-servers/spawn-fcgi/spawn-fcgi-1.6.5.ebuild
@@ -0,0 +1,22 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="A FCGI spawner for lighttpd and cherokee and other webservers"
+HOMEPAGE="https://redmine.lighttpd.net/projects/spawn-fcgi/wiki"
+SRC_URI="https://download.lighttpd.net/spawn-fcgi/releases-1.6.x/${P}.tar.xz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~hppa ppc ppc64 ~sparc x86"
+
+src_install() {
+	default
+
+	newconfd "${FILESDIR}"/spawn-fcgi.confd spawn-fcgi
+	newinitd "${FILESDIR}"/spawn-fcgi.initd-r3 spawn-fcgi
+
+	docinto examples
+	dodoc doc/run-generic doc/run-php doc/run-rails
+}
diff --git a/www-servers/spawn-fcgi/spawn-fcgi-1.6.6.ebuild b/www-servers/spawn-fcgi/spawn-fcgi-1.6.6.ebuild
new file mode 100644
index 000000000000..1170baf1c14a
--- /dev/null
+++ b/www-servers/spawn-fcgi/spawn-fcgi-1.6.6.ebuild
@@ -0,0 +1,33 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson
+
+DESCRIPTION="A FCGI spawner for lighttpd and cherokee and other webservers"
+HOMEPAGE="https://redmine.lighttpd.net/projects/spawn-fcgi/wiki"
+SRC_URI="https://download.lighttpd.net/spawn-fcgi/releases-1.6.x/${P}.tar.xz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~hppa ppc ppc64 ~sparc x86"
+
+src_configure() {
+	local emesonargs=(
+		# Adds -D_FORTIFY_SOURCE=2 which clobbers toolchain default
+		-Dextra-warnings=false
+	)
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	newconfd "${FILESDIR}"/spawn-fcgi.confd spawn-fcgi
+	newinitd "${FILESDIR}"/spawn-fcgi.initd-r3 spawn-fcgi
+
+	docinto examples
+	dodoc doc/run-generic doc/run-php doc/run-rails
+}
diff --git a/www-servers/thin/Manifest b/www-servers/thin/Manifest
new file mode 100644
index 000000000000..7a5a45ea898b
--- /dev/null
+++ b/www-servers/thin/Manifest
@@ -0,0 +1,3 @@
+DIST thin-1.8.2.tar.gz 181290 BLAKE2B 6c8d3be6dca6f9b9b549b863150de85efdd26700c27b28f1765e4d2212827d31f2aae9f586cfa485b62b3da3742c5205486c9c8fd5bd38ec32a2a896c5e0af93 SHA512 5f222b54a86156bc5c4b9623a225cd9a4e189f3d2744f8d11efc74e91167e201a554a191f19abb081a050a206f3b281bb7c627a3e72a5ba2b0a73e0e500dd0ed
+DIST thin-2.0.0.tar.gz 182105 BLAKE2B f608e1905756d73b78402b28ee696db4ce414c195f47f07cd9976796adfc2c0ca50632c6cce837ff1b00425bb107bda68ec79ea9bc840f38438157aafa5bdd54 SHA512 b38b71c6f6f69a1bd8804948519c59f45e5fc80d92b4242926d53a52e90a18809f7cba4f3e1edfa55258b727f6d85b3613dfa8939fb92d73212fd33312a527e8
+DIST thin-2.0.1.tar.gz 190197 BLAKE2B 3ce422b4e88f1635954363204b8b7fec77d8e63c7ed01b1932be200b27d8d01fe6374a5b0853d8e3c8bb093d81ebedc34f6d4a8bdaec75c921c3f320d393c407 SHA512 2a32c37116f8753fb29210b4c48b0179dc18d80c0328bfabfae5d3507790befc0d088bf898e49dd1c660598df956268b6d98ff694fe3f673bf9e929fd1c19596
diff --git a/www-servers/thin/files/thin.confd-2 b/www-servers/thin/files/thin.confd-2
new file mode 100644
index 000000000000..a5e5da829e17
--- /dev/null
+++ b/www-servers/thin/files/thin.confd-2
@@ -0,0 +1,43 @@
+# /etc/conf.d/thin: Configuration for /etc/init.d/thin*
+# Copy this file to /etc/conf.d/thin.SERVERNAME for server specific options.
+
+# Set the configuration file location.
+# In start-all mode (/etc/init.d/thin), this must point to the directory where
+# all the thin configurations are located.
+# When starting a specific server (/etc/init.d/thin.SERVER), point to the exact
+# location of the .yml configuration file.
+# CONFIG="/etc/thin/${SVCNAME#*.}.yml"
+
+# Disable looking for a configuration file.
+# You can use THIN_OPTS instead for setting command line options.
+# NOCONFIG=0
+
+# Set the Ruby interpreter to use.
+# RUBY="/usr/bin/ruby"
+
+# Whether to start thin using `bundle exec'
+# DO_BUNDLER=0
+
+# What directory to cd into before starting thin
+# (useful for DO_BUNDLER)
+# CHDIR=
+
+# Set the user for this instance.
+# (Should mirror "user" value in /etc/thin/${SVCNAME#*.}.yml)
+# THIN_USER=
+
+# Set the group for this instance.
+# (Should mirror "group" value in /etc/thin/${SVCNAME#*.}.yml)
+# THIN_GROUP=
+
+# Set the pidfile for this instance.
+# (Should mirror "pid" value in /etc/thin/${SVCNAME#*.}.yml)
+# THIN_PID=
+
+# Set command line options to pass to thin.
+# In specific server mode, '--tag SERVER_NAME' is automatically appended.
+# THIN_OPTS=
+
+# Thin binary
+# THIN=thin # use bundled thin
+# THIN=usr/bin/thin # use system thin
diff --git a/www-servers/thin/files/thin.initd-r4 b/www-servers/thin/files/thin.initd-r4
new file mode 100644
index 000000000000..960d100b596f
--- /dev/null
+++ b/www-servers/thin/files/thin.initd-r4
@@ -0,0 +1,88 @@
+#!/sbin/openrc-run
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+SERVER=${SVCNAME#*.}
+if [ ${SERVER} != thin ]; then
+	CONFIG=${CONFIG:-/etc/thin/${SERVER}.yml}
+else
+	CONFIG=${CONFIG:-/etc/thin/}
+fi
+NOCONFIG=${NOCONFIG:-0}
+RUBY=${RUBY:-/usr/bin/ruby}
+DO_BUNDLER=${DO_BUNDLER:-0}
+CHDIR=${CHDIR:-}
+THIN=${THIN:-/usr/bin/thin}
+THIN_USER=${THIN_USER:-root}
+THIN_GROUP=${THIN_GROUP:-root}
+THIN_PID=${THIN_PID:-/var/run/thin/thin.pid}
+THIN_OPTS=${THIN_OPTS:-}
+
+depend() {
+	need localmount
+}
+
+checkconfig() {
+	if [ -n ${CHDIR} ]; then
+		cd "${CHDIR}"
+
+		if [ $? -ne 0 ]; then
+			eerror "Cannot cd into requested directory"
+			return 1
+		fi
+	fi
+
+	[ ${SERVER} = thin -o ${NOCONFIG} != 0 ] && return 0
+
+	if [ ! -f ${CONFIG} ]; then
+		eerror "Unable to find the server configuration."
+		eerror "Please set the CONFIG variable in /etc/conf.d/${SVCNAME} or"
+		eerror "set NOCONFIG there to 1 to disable looking for a config file."
+		return 1
+	fi
+}
+
+buildargs() {
+	if [ ${NOCONFIG} = 0 -a ${SERVER} != thin ]; then
+		echo -n "-C ${CONFIG} "
+	fi
+
+	echo -n "${THIN_OPTS}"
+}
+
+action() {
+	checkconfig || return 1
+
+	[ ${DO_BUNDLER} -ne 0 ] && RUBY="${RUBY} /usr/bin/bundle exec"
+
+	if [ ${SERVER} = thin ]; then
+		ebegin "$2 all thin servers in ${CONFIG}"
+		${RUBY} ${THIN} $1 $(buildargs) --all ${CONFIG}
+		eend $?
+	else
+		ebegin "$2 thin server ${SERVER}"
+		${RUBY} ${THIN} $(buildargs) --tag ${SERVER} $1
+		eend $?
+	fi
+}
+
+start() {
+	action start 'Starting'
+}
+
+stop() {
+	action stop 'Stopping'
+}
+
+restart() {
+	action restart 'Restarting'
+}
+
+start_pre() {
+	# If the path to the pidfile is /var/run/thin/foo/thin.pid
+	# then checkpath will fail if /var/run/thin/ does not exist.
+	# This caught infra...
+	d=$(dirname ${THIN_PID})
+	mkdir -p "$d"
+	checkpath -d -m 0775 -o ${THIN_USER}:${THIN_GROUP} "$d"
+}
diff --git a/www-servers/thin/metadata.xml b/www-servers/thin/metadata.xml
new file mode 100644
index 000000000000..d7b90caed9ac
--- /dev/null
+++ b/www-servers/thin/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>ruby@gentoo.org</email>
+    <name>Gentoo Ruby Project</name>
+  </maintainer>
+  <longdescription>
+	Thin is a very simple web server written in Ruby. It's single-threaded, which
+	means it can only serve one request at a time. This simplicity affords increased
+	speed and decreased memory usage for singled-threaded framework like Rails.
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/thin/thin-1.8.2.ebuild b/www-servers/thin/thin-1.8.2.ebuild
new file mode 100644
index 000000000000..0f52fb11ac61
--- /dev/null
+++ b/www-servers/thin/thin-1.8.2.ebuild
@@ -0,0 +1,95 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+USE_RUBY="ruby27 ruby30 ruby31 ruby32"
+
+RUBY_FAKEGEM_RECIPE_TEST="rspec3"
+RUBY_FAKEGEM_GEMSPEC="${PN}.gemspec"
+
+inherit ruby-fakegem
+
+DESCRIPTION="A fast and very simple Ruby web server"
+HOMEPAGE="http://code.macournoyer.com/thin/"
+SRC_URI="https://github.com/macournoyer/thin/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Ruby"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc64 ~x86"
+IUSE="doc test"
+
+DEPEND="${DEPEND}
+	dev-util/ragel"
+RDEPEND="${RDEPEND}"
+
+# The runtime dependencies are used at build-time as well since the
+# Rakefile loads thin!
+mydeps=">=dev-ruby/daemons-1.0.9
+	>=dev-ruby/rack-1.0.0:* <dev-ruby/rack-3:*
+	>=dev-ruby/eventmachine-1.0.4:0
+	virtual/ruby-ssl"
+
+ruby_add_rdepend "${mydeps}"
+ruby_add_bdepend "${mydeps}
+	dev-ruby/rake-compiler"
+
+all_ruby_prepare() {
+	# Fix Ragel-based parser generation (uses a *very* old syntax that
+	# is not supported in Gentoo)
+	sed -i -e 's: | rlgen-cd::' Rakefile || die
+
+	# Fix specs' dependencies so that the extension is not rebuilt
+	# when running tests
+	rm tasks/spec.rake || die
+
+	# Fix rspec version to allow newer 2.x versions
+	sed -i -e '/gem "rspec"/ s/1.2.9/3.0/ ; 2igem "rack", "<3"' spec/spec_helper.rb || die
+
+	# Avoid CLEAN since it may not be available and we don't need it.
+	sed -i -e '/CLEAN/ s:^:#:' tasks/*.rake || die
+
+	# Disable a test that is known for freezing the testsuite,
+	# reported upstream. In thin 1.5.1 this just fails.
+	sed -i \
+		-e '/should force kill process in pid file/,/^  end/ s:^:#:' \
+		spec/daemonizing_spec.rb || die
+
+	sed -i \
+		-e '/tracing routines (with NO custom logger)/,/^  end/ s:^:#:'\
+		spec/logging_spec.rb || die
+
+	find spec/perf -name "*_spec.rb" -exec \
+		sed -i '/be_faster_then/ i \    skip' {} \;
+
+	sed -i -e "s/Spec::Runner/Rspec/" spec/spec_helper.rb || die
+	# nasty but too complex to fix up for now :(
+	use doc || rm tasks/rdoc.rake
+}
+
+each_ruby_compile() {
+	${RUBY} -S rake compile || die "rake compile failed"
+}
+
+all_ruby_install() {
+	all_fakegem_install
+
+	keepdir /etc/thin
+	newinitd "${FILESDIR}"/${PN}.initd-r4 ${PN}
+	newconfd "${FILESDIR}"/${PN}.confd-2 ${PN}
+
+	einfo
+	elog "Thin is now shipped with init scripts."
+	elog "The default script (/etc/init.d/thin) will start all servers that have"
+	elog "configuration files in /etc/thin/. You can symlink the init script to"
+	elog "files of the format 'thin.SERVER' to be able to start individual servers."
+	elog "See /etc/conf.d/thin for more configuration options."
+	einfo
+}
+
+each_ruby_install() {
+	each_fakegem_install
+
+	# Ensure that newer rubygems version see the extention as installed
+	ruby_fakegem_extensions_installed
+}
diff --git a/www-servers/thin/thin-2.0.0.ebuild b/www-servers/thin/thin-2.0.0.ebuild
new file mode 100644
index 000000000000..9203e43603da
--- /dev/null
+++ b/www-servers/thin/thin-2.0.0.ebuild
@@ -0,0 +1,95 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+USE_RUBY="ruby32"
+
+RUBY_FAKEGEM_RECIPE_TEST="rspec3"
+RUBY_FAKEGEM_GEMSPEC="${PN}.gemspec"
+
+inherit ruby-fakegem
+
+DESCRIPTION="A fast and very simple Ruby web server"
+HOMEPAGE="https://github.com/macournoyer/thin"
+SRC_URI="https://github.com/macournoyer/thin/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Ruby"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc64 ~x86"
+IUSE="doc test"
+
+DEPEND="dev-util/ragel"
+
+# The runtime dependencies are used at build-time as well since the
+# Rakefile loads thin!
+mydeps=">=dev-ruby/daemons-1.0.9
+	>=dev-ruby/rack-1.0.0:* <dev-ruby/rack-4:*
+	>=dev-ruby/eventmachine-1.0.4:0
+	virtual/ruby-ssl"
+
+ruby_add_rdepend "${mydeps}"
+ruby_add_bdepend "${mydeps}
+	dev-ruby/rake-compiler"
+
+all_ruby_prepare() {
+	# Fix Ragel-based parser generation (uses a *very* old syntax that
+	# is not supported in Gentoo)
+	sed -i -e 's: | rlgen-cd::' Rakefile || die
+
+	# Fix specs' dependencies so that the extension is not rebuilt
+	# when running tests
+	rm rakelib/spec.rake || die
+
+	# Fix rspec version to allow newer 2.x versions
+	sed -i -e '/gem "rspec"/ s/1.2.9/3.0/ ; 2igem "rack", "<4"' spec/spec_helper.rb || die
+
+	# Avoid CLEAN since it may not be available and we don't need it.
+	sed -i -e '/CLEAN/ s:^:#:' rakelib/*.rake || die
+
+	# Avoid a spec trying to change privileges which will not work in
+	# all Gentoo test cases.
+	sed -e '/should change privilege/ s/it/xit/' \
+		-i spec/daemonizing_spec.rb || die
+
+	sed -i \
+		-e '/tracing routines (with NO custom logger)/,/^  end/ s:^:#:'\
+		spec/logging_spec.rb || die
+
+	find spec/perf -name "*_spec.rb" -exec \
+		sed -i '/be_faster_then/ i \    skip' {} \;
+
+	sed -i -e "s/Spec::Runner/Rspec/" spec/spec_helper.rb || die
+	# nasty but too complex to fix up for now :(
+	use doc || rm rakelib/rdoc.rake
+
+	sed -e 's:_relative ": "./:' \
+		-i ${RUBY_FAKEGEM_GEMSPEC} || die
+}
+
+each_ruby_compile() {
+	${RUBY} -S rake compile || die "rake compile failed"
+}
+
+all_ruby_install() {
+	all_fakegem_install
+
+	keepdir /etc/thin
+	newinitd "${FILESDIR}"/${PN}.initd-r4 ${PN}
+	newconfd "${FILESDIR}"/${PN}.confd-2 ${PN}
+
+	einfo
+	elog "Thin is now shipped with init scripts."
+	elog "The default script (/etc/init.d/thin) will start all servers that have"
+	elog "configuration files in /etc/thin/. You can symlink the init script to"
+	elog "files of the format 'thin.SERVER' to be able to start individual servers."
+	elog "See /etc/conf.d/thin for more configuration options."
+	einfo
+}
+
+each_ruby_install() {
+	each_fakegem_install
+
+	# Ensure that newer rubygems version see the extention as installed
+	ruby_fakegem_extensions_installed
+}
diff --git a/www-servers/thin/thin-2.0.1.ebuild b/www-servers/thin/thin-2.0.1.ebuild
new file mode 100644
index 000000000000..1d1aad614359
--- /dev/null
+++ b/www-servers/thin/thin-2.0.1.ebuild
@@ -0,0 +1,95 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+USE_RUBY="ruby32"
+
+RUBY_FAKEGEM_RECIPE_TEST="rspec3"
+RUBY_FAKEGEM_GEMSPEC="${PN}.gemspec"
+
+inherit ruby-fakegem
+
+DESCRIPTION="A fast and very simple Ruby web server"
+HOMEPAGE="https://github.com/macournoyer/thin"
+SRC_URI="https://github.com/macournoyer/thin/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="|| ( GPL-2+ Ruby )"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc64 ~x86"
+IUSE="doc test"
+
+DEPEND="dev-util/ragel"
+
+# The runtime dependencies are used at build-time as well since the
+# Rakefile loads thin!
+mydeps=">=dev-ruby/daemons-1.0.9
+	>=dev-ruby/rack-1.0.0:* <dev-ruby/rack-4:*
+	>=dev-ruby/eventmachine-1.0.4:0
+	virtual/ruby-ssl"
+
+ruby_add_rdepend "${mydeps}"
+ruby_add_bdepend "${mydeps}
+	dev-ruby/rake-compiler"
+
+all_ruby_prepare() {
+	# Fix Ragel-based parser generation (uses a *very* old syntax that
+	# is not supported in Gentoo)
+	sed -i -e 's: | rlgen-cd::' Rakefile || die
+
+	# Fix specs' dependencies so that the extension is not rebuilt
+	# when running tests
+	rm rakelib/spec.rake || die
+
+	# Fix rspec version to allow newer 2.x versions
+	sed -i -e '/gem "rspec"/ s/1.2.9/3.0/ ; 2igem "rack", "<4"' spec/spec_helper.rb || die
+
+	# Avoid CLEAN since it may not be available and we don't need it.
+	sed -i -e '/CLEAN/ s:^:#:' rakelib/*.rake || die
+
+	# Avoid a spec trying to change privileges which will not work in
+	# all Gentoo test cases.
+	sed -e '/should change privilege/ s/it/xit/' \
+		-i spec/daemonizing_spec.rb || die
+
+	sed -i \
+		-e '/tracing routines (with NO custom logger)/,/^  end/ s:^:#:'\
+		spec/logging_spec.rb || die
+
+	find spec/perf -name "*_spec.rb" -exec \
+		sed -i '/be_faster_then/ i \    skip' {} \;
+
+	sed -i -e "s/Spec::Runner/Rspec/" spec/spec_helper.rb || die
+	# nasty but too complex to fix up for now :(
+	use doc || rm rakelib/rdoc.rake
+
+	sed -e 's:_relative ": "./:' \
+		-i ${RUBY_FAKEGEM_GEMSPEC} || die
+}
+
+each_ruby_compile() {
+	${RUBY} -S rake compile || die "rake compile failed"
+}
+
+all_ruby_install() {
+	all_fakegem_install
+
+	keepdir /etc/thin
+	newinitd "${FILESDIR}"/${PN}.initd-r4 ${PN}
+	newconfd "${FILESDIR}"/${PN}.confd-2 ${PN}
+
+	einfo
+	elog "Thin is now shipped with init scripts."
+	elog "The default script (/etc/init.d/thin) will start all servers that have"
+	elog "configuration files in /etc/thin/. You can symlink the init script to"
+	elog "files of the format 'thin.SERVER' to be able to start individual servers."
+	elog "See /etc/conf.d/thin for more configuration options."
+	einfo
+}
+
+each_ruby_install() {
+	each_fakegem_install
+
+	# Ensure that newer rubygems version see the extention as installed
+	ruby_fakegem_extensions_installed
+}
diff --git a/www-servers/tomcat/Manifest b/www-servers/tomcat/Manifest
new file mode 100644
index 000000000000..426fb2af2b6d
--- /dev/null
+++ b/www-servers/tomcat/Manifest
@@ -0,0 +1,12 @@
+DIST apache-tomcat-10.1.52-src.tar.gz 7304782 BLAKE2B b9ff4ff1116b205671b9240a9d7f2300463eb069cb554bfc4740c72e3006ab3a628d9bdc44e6772f276894fdf63709e1c46887f4844bdebd53171c68c51f871f SHA512 6da5d15282bf3785f0aed12e497b36bf38678631fc6aef134162b930136e6b32fa8b09c055c3d9bf7713c36f727db59338391a3876e811763b99dae362cba230
+DIST apache-tomcat-10.1.52-src.tar.gz.asc 833 BLAKE2B c2c2812ecad52669ed5892993cacdb48fddc353188341a0232ced6c9c4058b2d07c124138e4eeb194aecb60caee28785ca0dbedfc4bc4b8358805f2983486940 SHA512 f07c25b499c272d284cfc779fd9707349916d5f88fbb6b30a8507dad66c525c827771c15dc6edfed2cba9567c697c4dd0c5202a7c0b5136dd17efb77e2545f2a
+DIST apache-tomcat-10.1.55-src.tar.gz 7362901 BLAKE2B 2b2850347b576ad4473e0786e1b3abe0dbde702db0dceeb393500e03108669a4fd4141900ed1d610a7779917a60a4c20fc1292d60fc9400eaf79afe79a936ad5 SHA512 baa9f2ddd836725fef3d56542e67307c886353d340e0c3c2ccfaa0e1bb7eafc7a729624d2ba8bc03dd631367192b21afa9a825033d82d7a2fe5e54a5e9e3a9de
+DIST apache-tomcat-10.1.55-src.tar.gz.asc 833 BLAKE2B fb6b6cc647888d08fe9b29e07a9a8e4fe64f0ff68e813e957c70358415d20af2765e1cbc7531d157a89040ab09a456e537c03b737a40b0a51e447221483ccc8c SHA512 d6175f65b7e4edd267b47afcc14934f26e5a045d61f74f86f0c141a4a7616a4d1d747a55ef11f5de1f0c7bb5fae988c1314eebc3709a507f9ea7f25e6a2d4af4
+DIST apache-tomcat-11.0.18-src.tar.gz 7227123 BLAKE2B 0fc7fb24ef2b54dd1a1161752f721e7047aec135cf820c68ef1076d76ff5ae5bc77fa76801f7170f0123bf20a738323e13ef4b2fd9281aab234284e55331d110 SHA512 265e97669bc26fd4a52a65ee48da79c7d4a0cfb77a052d790fdd9e7858b8012938b5e7710fbfbbdb612beada73d4cafaf9954c1a8da6c02ed5911a2c16b4806e
+DIST apache-tomcat-11.0.18-src.tar.gz.asc 849 BLAKE2B 6ab95536529d81c27486607ca4042eb8bc953fbe18111972b629f17d05a99cb6f30b8679ec263144dacfa5207abb646bd7cd2e696552059fc6317b8ea4b15117 SHA512 0353d871404c0e6ccc002edc8140dfed72856e65856084dc76c8f6b811698450ff0a9ee0ccc7f2f3d66b73eb3b24be8ea79d434bd862f00b824939d66aa1fa9b
+DIST apache-tomcat-11.0.22-src.tar.gz 7289785 BLAKE2B a8417b0f6abb1f3f41bd6441d53f8701c8de1bbb525a19706bd270dddf1732c8e570adc086a5b152558ef32893018e6011c9c1c73fe808ae1e4c4823067e0161 SHA512 35867e670c89d9ead1a7e4545b26f708849de3c7b56f21e1f4c124fd83b3d3ec37d65e42dcf2a0adeda260436811de6f6b27199ff747ef099a62e11eab1f7cbc
+DIST apache-tomcat-11.0.22-src.tar.gz.asc 849 BLAKE2B bb6b08f1ed49391dcfbac75a57c7f91909b3ac48caed808808b06f9ab4715629fc84f15e80bd2c99d194c3992bdf5d9b7e7bacabd842bfdc8f6464f6685220ae SHA512 a1619100695da4f6a5c0fc62d2243619d5c11b0535ea557aea18a79fa7471a12ba16512745abbd43b552f93fdb1176c3ecd1541b2fa04710c10ebd069530d4e2
+DIST apache-tomcat-9.0.115-src.tar.gz 7446619 BLAKE2B 75ea2e298d871661a118d18d1d586f7df7724e0d72ece2e8f8f49e92df892003c0832998b5cfcac044a636b33b7e16b8fd48188bb68d3b7ea5a14b7302b5eab0 SHA512 cd975fbb8ff6187ca4697830bf01675b55e7e326f16ade8fb771d9f4cdab0976d20fea6f305180f93f124ecb6a7d1256a2e2bc3d50bb265d4a5aca5fc7351c48
+DIST apache-tomcat-9.0.115-src.tar.gz.asc 833 BLAKE2B c2392f66b09677b2ef42a7fa8cdf7b5e2aabc45ee556654360f4ed0d1840667a39dafb0812dde95b3a25da9a2f3325510d76cfebca24aac121223ad2bfd9b3ca SHA512 30e732959750bc5dae08a8ce2eded83ce45760bc8850177103342ed9d8541f44144d5a6c0d100ca1890defd456b1f002e19d6a22a254ba1d8183f82912cb010a
+DIST apache-tomcat-9.0.118-src.tar.gz 7506319 BLAKE2B f4a829a7479e21137fba9dc5f15f09ebfda3547d1b2c716dc2bddd5d91cb0002450d22d439019e6789d708f61aaa66f50153b3c4b25c2c153440cd70969f8b55 SHA512 021bb2fffce2a3ca163ddf01fd1cf6d5c5c5799bff773af32b2f767e40d2d5825ab295701e4c7cef947d98dea2f8d17d47b599237c70b55622aafbb054cefa4c
+DIST apache-tomcat-9.0.118-src.tar.gz.asc 833 BLAKE2B 1e877c130402ceabffc3aa96589a524439a97299d82ba8bd16c9d6782fec2513c1937c7dfcf62f16b1fe3d039f44d131486f137b6156f92b1e9ff2df27cc6e50 SHA512 6f08e9156760e01328411a1526b5d113793302820de1a7efaea235f2f0a05c426e17352dec62ae33627ff00633ad494597d119a28f212aac20357a04a4081e38
diff --git a/www-servers/tomcat/files/tomcat-10.1.20-do-not-copy.patch b/www-servers/tomcat/files/tomcat-10.1.20-do-not-copy.patch
new file mode 100644
index 000000000000..ade8527d11f1
--- /dev/null
+++ b/www-servers/tomcat/files/tomcat-10.1.20-do-not-copy.patch
@@ -0,0 +1,29 @@
+--- a/build.xml
++++ b/build.xml
+#<!-- we provide tomcat native as another package and we don't need commons-daemon
+@@ -1469,7 +1469,6 @@
+   <target name="deploy" depends="package,build-docs,build-tomcat-jdbc,compile-webapp-examples"
+           description="Default. Builds a working Tomcat instance">
+ 
+-    <copy tofile="${tomcat.build}/bin/commons-daemon.jar" file="${commons-daemon.jar}" />
+ 
+     <!-- Copy scripts -->
+     <copy todir="${tomcat.build}/bin">
+#<!-- we provide jdt jar externally
+@@ -1530,7 +1529,6 @@
+         <exclude name="${jdt.jar.filename}"/>
+       </fileset>
+     </delete>
+-    <copy file="${jdt.jar}" todir="${tomcat.build}/lib"/>
+ 
+     <!-- Delete all other versions of Tomcat Migration Tool for Jakarta EE and copy the current one -->
+     <local name="migration.jar.filename" />
+#<!-- we provide migration tool externally
+@@ -1541,7 +1539,6 @@
+         <exclude name="${migration-lib.jar.filename}"/>
+       </fileset>
+     </delete>
+-    <copy file="${migration-lib.jar}" todir="${tomcat.build}/lib"/>
+ 
+     <!-- Delete all other versions of OpenSSL support for Tomcat and copy the current one -->
+     <!-- After module release
diff --git a/www-servers/tomcat/files/tomcat-10.1.20-offline.patch b/www-servers/tomcat/files/tomcat-10.1.20-offline.patch
new file mode 100644
index 000000000000..94edd1c8b7e9
--- /dev/null
+++ b/www-servers/tomcat/files/tomcat-10.1.20-offline.patch
@@ -0,0 +1,12 @@
+--- a/build.xml
++++ b/build.xml
+# javadoc would fail without network access
+@@ -2413,8 +2410,6 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
+       <link href="../elapi"/>
+       <link href="../websocketapi"/>
+       <link href="../jaspicapi"/>
+-      <link href="https://docs.oracle.com/en/java/javase/11/docs/api/"/>
+-      <link href="https://jakarta.ee/specifications/platform/10/apidocs/"/>
+       <packageset dir="${tomcat.dist}/src/java/">
+         <include name="org/**"/>
+         <exclude name="org/apache/el/parser/**"/>
diff --git a/www-servers/tomcat/files/tomcat-11.0.0-offline.patch b/www-servers/tomcat/files/tomcat-11.0.0-offline.patch
new file mode 100644
index 000000000000..bd9010dcec39
--- /dev/null
+++ b/www-servers/tomcat/files/tomcat-11.0.0-offline.patch
@@ -0,0 +1,12 @@
+--- a/build.xml
++++ b/build.xml
+# javadoc would fail without network access
+@@ -2413,8 +2410,6 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
+       <link href="../elapi"/>
+       <link href="../websocketapi"/>
+       <link href="../jaspicapi"/>
+-      <link href="https://docs.oracle.com/en/java/javase/17/docs/api/"/>
+-      <link href="https://jakarta.ee/specifications/platform/11/apidocs/"/>
+       <packageset dir="${tomcat.dist}/src/java/">
+         <include name="org/**"/>
+         <exclude name="org/apache/el/parser/**"/>
diff --git a/www-servers/tomcat/files/tomcat-9.0.104-build.xml.patch b/www-servers/tomcat/files/tomcat-9.0.104-build.xml.patch
new file mode 100644
index 000000000000..753661661249
--- /dev/null
+++ b/www-servers/tomcat/files/tomcat-9.0.104-build.xml.patch
@@ -0,0 +1,31 @@
+1. we don't need commons-daemon
+2. jdt.jar is eclipse-ecj.jar which we provide as a separate package
+3. javadoc would fail without network access
+
+--- a/build.xml
++++ b/build.xml
+@@ -1496,7 +1496,6 @@
+   <target name="deploy" depends="package,build-docs,build-tomcat-jdbc,compile-webapp-examples"
+           description="Default. Builds a working Tomcat instance">
+ 
+-    <copy tofile="${tomcat.build}/bin/commons-daemon.jar" file="${commons-daemon.jar}" />
+ 
+     <!-- Copy scripts -->
+     <copy todir="${tomcat.build}/bin">
+@@ -1557,7 +1556,6 @@
+         <exclude name="${jdt.jar.filename}"/>
+       </fileset>
+     </delete>
+-    <copy file="${jdt.jar}" todir="${tomcat.build}/lib"/>
+ 
+     <!-- Add sources for examples -->
+     <antcall target="examples-sources" />
+@@ -2436,8 +2434,6 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
+       <link href="../elapi"/>
+       <link href="../websocketapi"/>
+       <link href="../jaspicapi"/>
+-      <link href="https://docs.oracle.com/en/java/javase/11/docs/api/"/>
+-      <link href="https://javaee.github.io/javaee-spec/javadocs/"/>
+       <packageset dir="${tomcat.dist}/src/java/">
+         <include name="org/**"/>
+         <exclude name="org/apache/el/parser/**"/>
diff --git a/www-servers/tomcat/files/tomcat-9.0.87-gentoo-bnd.patch b/www-servers/tomcat/files/tomcat-9.0.87-gentoo-bnd.patch
new file mode 100644
index 000000000000..1d9ef0b0d0e8
--- /dev/null
+++ b/www-servers/tomcat/files/tomcat-9.0.87-gentoo-bnd.patch
@@ -0,0 +1,35 @@
+Gentoo's dev-java/bnd is unbundled. We're adding the parts here:
+--- a/build.xml
++++ b/build.xml
+@@ -225,7 +225,16 @@
+ 
+   <!-- Classpaths -->
+   <path id="compile.classpath">
++    <pathelement location="${ant.jar}"/>
+     <pathelement location="${bnd.jar}"/>
++    <pathelement location="${bnd-annotation.jar}"/>
++    <pathelement location="${bnd-ant.jar}"/>
++    <pathelement location="${bnd-util.jar}"/>
++    <pathelement location="${bndlib.jar}"/>
++    <pathelement location="${libg.jar}"/>
++    <pathelement location="${osgi-cmpn.jar}"/>
++    <pathelement location="${osgi-core.jar}"/>
++    <pathelement location="${slf4j-api.jar}"/>
+     <pathelement location="${jdt.jar}"/>
+     <pathelement location="${jaxrpc-lib.jar}"/>
+     <pathelement location="${wsdl4j-lib.jar}"/>
+@@ -3924,6 +3933,14 @@ Read the Building page on the Apache Tomcat documentation site for details on ho
+     <!-- Add bnd tasks to project -->
+     <path id="bnd.classpath">
+       <fileset file="${bnd.jar}" />
++      <fileset file="${bnd-annotation.jar}" />
++      <fileset file="${bnd-ant.jar}" />
++      <fileset file="${bnd-util.jar}" />
++      <fileset file="${bndlib.jar}" />
++      <fileset file="${libg.jar}" />
++      <fileset file="${osgi-cmpn.jar}" />
++      <fileset file="${osgi-core.jar}" />
++      <fileset file="${slf4j-api.jar}" />
+     </path>
+ 
+     <taskdef resource="aQute/bnd/ant/taskdef.properties" classpathref="bnd.classpath" />
diff --git a/www-servers/tomcat/files/tomcat-instance-manager-r2.bash b/www-servers/tomcat/files/tomcat-instance-manager-r2.bash
new file mode 100644
index 000000000000..b3b1a0221bc3
--- /dev/null
+++ b/www-servers/tomcat/files/tomcat-instance-manager-r2.bash
@@ -0,0 +1,270 @@
+#!/bin/bash
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# Author: Ralph Sennhauser <sera@gentoo.org>
+
+die() {
+	echo "${@}"
+	exit 1
+}
+
+dir_is_empty() {
+	# usage:
+	#  dir_is_empty <some-dir>
+	#
+	# returns 2 if the dir does not even exist
+	# returns 1 if the dir is not empty
+	# returns 0 (success) if the dir exists and is empty
+
+	local dir=$1
+	local files
+
+	if [[ ! -e ${dir} ]] ; then
+		return 2
+	fi
+
+	shopt -s nullglob dotglob     # To include hidden files
+	files=( "${dir}"/* )
+	shopt -u nullglob dotglob
+
+	if [[ ${#files[@]} -eq 0 ]]; then
+		return 0
+	else
+		return 1
+	fi
+
+}
+
+usage() {
+	cat <<EOL
+Usage: ${BASH_SOURCE} <--create|--remove|--help> [--suffix s][--user u][--group g]
+
+  Options:
+    --help:
+      show this text.
+    --create:
+      create a new instance
+    --remove:
+      remove an existing instance.
+    --suffix SUFFIX:
+      a suffix for this instance. the suffix may not collide with an already
+      existing instance, defaults to empty.
+    --user USER:
+      the user for which to configure this instance for. The user needs to
+      exist already. defaults to tomcat.
+    --group GROUP:
+      the group for which to configure this instance for. The group needs to
+      exist already. defaults to tomcat.
+
+  Examples:
+    ${BASH_SOURCE} --create --suffix testing --user tacmot --group tacmot
+    ${BASH_SOURCE} --remove --suffix testing
+EOL
+}
+
+parse_argv() {
+	action="not specified"
+	instance_name="tomcat-@SLOT@"
+	instance_user="tomcat"
+	instance_group="tomcat"
+
+	while [[ -n $1 ]]; do
+		case $1 in
+			--help)
+				usage
+				exit 0;;
+			--suffix)
+				instance_name+="-$2"
+				shift; shift;;
+			--user)
+				instance_user="$2"
+				shift; shift;;
+			--group)
+				instance_group="$2"
+				shift; shift;;
+			--create)
+				action=create
+				shift;;
+			--remove)
+				action=remove
+				shift;;
+			--backup)
+				action=backup
+				shift;;
+			--restore)
+				action=restore
+				shift;;
+			--update)
+				action=update
+				shift;;
+			*)
+				echo "Invalid option '$1'"
+				usage
+				exit 2;;
+		esac
+	done
+
+	tomcat_home="/@GENTOO_PORTAGE_EPREFIX@usr/share/tomcat-@SLOT@"
+	instance_base="/@GENTOO_PORTAGE_EPREFIX@var/lib/${instance_name}"
+	instance_conf="/@GENTOO_PORTAGE_EPREFIX@etc/${instance_name}"
+	instance_logs="/@GENTOO_PORTAGE_EPREFIX@var/log/${instance_name}"
+	instance_temp="/@GENTOO_PORTAGE_EPREFIX@var/tmp/${instance_name}"
+
+	all_targets=(
+		"${instance_base}"
+		"${instance_logs}"
+		"${instance_temp}"
+		"/@GENTOO_PORTAGE_EPREFIX@etc/${instance_name}"
+		"/@GENTOO_PORTAGE_EPREFIX@etc/init.d/${instance_name}"
+		"/@GENTOO_PORTAGE_EPREFIX@etc/conf.d/${instance_name}"
+	)
+}
+	
+test_can_deploy() {
+	local no_deploy target
+	for target in "${all_targets[@]}"; do
+		if [[ -e "${target}" ]]; then
+			if ! dir_is_empty "${target}" ; then
+				echo "Error: '${target}' already exists and is not empty."
+				no_deploy=yes
+			fi
+		fi
+	done
+	if [[ -n "${no_deploy}" ]]; then
+		cat <<-EOL
+
+			To protect an existing installation no new instance was deployed. You can use
+			'${BASH_SOURCE} --remove'
+			to remove an existing instance first or run
+			'${BASH_SOURCE} --create --sufix <instance_suffix>'
+			to deploy an instance under a different name
+
+		EOL
+		usage
+		exit 1
+	fi
+
+	if ! getent passwd | cut -d: -f1 | grep -Fx "${instance_user}" > /dev/null; then
+		echo "Error: user '${instance_user}' doesn't exist."
+		exit 1
+	fi
+
+	if ! getent group | cut -d: -f1 | grep -Fx "${instance_group}" > /dev/null; then
+		echo "Error: group '${instance_group}' doesn't exist."
+		exit 1
+	fi
+}
+
+deploy_instance() {
+	test_can_deploy
+
+	mkdir -p "${instance_base}"/{work,webapps} || die
+	mkdir -p "${instance_logs}" || die
+	mkdir -p "${instance_temp}" || die
+	mkdir -p "${instance_conf}" || die
+
+	cp -r "${tomcat_home}"/webapps/ROOT "${instance_base}"/webapps || die
+
+	chown -R "${instance_user}":"${instance_group}" \
+		"${instance_base}" "${instance_logs}" "${instance_temp}" || die
+
+	find "${instance_base}"/webapps -type d -exec chmod 750 {} + || die
+	find "${instance_base}"/webapps -type f -exec chmod 640 {} + || die
+
+	# initial config #
+
+	cp -r "${tomcat_home}"/conf/* "${instance_conf}"/ || die
+
+	sed -i -e "s|\${catalina.base}/logs|${instance_logs}|" \
+		"${instance_conf}"/logging.properties || die
+	sed -i -e "s|directory=\"logs\"|directory=\"${instance_logs}\"|" \
+		"${instance_conf}"/server.xml || die
+
+	mkdir -p "${instance_conf}"/Catalina/localhost || die
+	cat > "${instance_conf}"/Catalina/localhost/host-manager.xml <<-'EOF'
+		<?xml version="1.0" encoding="UTF-8"?>
+		<Context docBase="${catalina.home}/webapps/host-manager"
+				antiResourceLocking="false" privileged="true" />
+	EOF
+
+	cat > "${instance_conf}"/Catalina/localhost/manager.xml <<-'EOF'
+		<?xml version="1.0" encoding="UTF-8"?>
+		<Context docBase="${catalina.home}/webapps/manager"
+				antiResourceLocking="false" privileged="true" />
+	EOF
+
+	if [[ -d "${tomcat_home}"/webapps/docs ]]; then
+		cat > "${instance_conf}"/Catalina/localhost/docs.xml <<-'EOF'
+			<?xml version="1.0" encoding="UTF-8"?>
+			<Context docBase="${catalina.home}/webapps/docs" />
+		EOF
+	fi
+
+	if [[ -d "${tomcat_home}"/webapps/examples ]]; then
+		cat > "${instance_conf}"/Catalina/localhost/examples.xml <<-'EOF'
+			<?xml version="1.0" encoding="UTF-8"?>
+			<Context docBase="${catalina.home}/webapps/examples" />
+		EOF
+	fi
+
+	chown -R "${instance_user}":"${instance_group}" "${instance_conf}" || die
+	find "${instance_conf}" -type d -exec chmod 750 {} + || die
+	find "${instance_conf}" -type f -exec chmod 640 {} + || die
+
+	# rc script #
+
+	cp "${tomcat_home}"/gentoo/tomcat.init \
+		"/@GENTOO_PORTAGE_EPREFIX@etc/init.d/${instance_name}" || die
+
+	sed -e "s|@INSTANCE_NAME@|${instance_name}|g" \
+		-e "s|@INSTANCE_USER@|${instance_user}|g" \
+		-e "s|@INSTANCE_GROUP@|${instance_group}|g" \
+		"${tomcat_home}"/gentoo/tomcat.conf \
+		> "/@GENTOO_PORTAGE_EPREFIX@etc/conf.d/${instance_name}" || die
+
+	# some symlinks for tomcat and netbeans #
+
+	ln -s "${instance_conf}" "${instance_base}"/conf || die
+	ln -s "${instance_temp}" "${instance_base}"/temp || die
+
+	# a note to update the default configuration #
+
+	cat <<-EOL
+		Successfully created instance '${instance_name}'
+		It's strongly recommended for production systems to go carefully through the
+		configuration files at '${instance_conf}'.
+		The generated initial configuration is close to upstreams default which
+		favours the demo aspect over hardening.
+	EOL
+}
+
+remove_instance() {
+	echo "The following files will be removed permanently:"
+	local target; for target in "${all_targets[@]}"; do
+		find ${target}
+	done
+
+	echo "Type 'yes' to continue"
+	read
+	if [[ ${REPLY} == yes ]]; then
+		rm -rv "${all_targets[@]}"
+	else 
+		echo "Aborting as requested ..."
+	fi
+}
+
+parse_argv "$@"
+
+if [[ ${action} == create ]]; then
+	deploy_instance
+elif [[ ${action} == remove ]]; then
+	remove_instance
+elif [[ ${action} == "not specified" ]]; then
+	echo "No action specified!"
+	usage
+	exit 1
+else
+	echo "${action} not yet implemented!"
+	usage
+	exit 1
+fi
diff --git a/www-servers/tomcat/files/tomcat-r1.init b/www-servers/tomcat/files/tomcat-r1.init
new file mode 100644
index 000000000000..13c3e548a2d4
--- /dev/null
+++ b/www-servers/tomcat/files/tomcat-r1.init
@@ -0,0 +1,110 @@
+#!/@GENTOO_PORTAGE_EPREFIX@sbin/openrc-run
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="forcestop"
+
+PIDFILE=/@GENTOO_PORTAGE_EPREFIX@var/run/${RC_SVCNAME}.pid
+
+: ${CATALINA_HOME:=/@GENTOO_PORTAGE_EPREFIX@usr/share/tomcat-@SLOT@}
+: ${CATALINA_BASE:=/@GENTOO_PORTAGE_EPREFIX@var/lib/${RC_SVCNAME}}
+: ${CATALINA_TMPDIR:=/@GENTOO_PORTAGE_EPREFIX@var/tmp/${RC_SVCNAME}}
+: ${CATALINA_USER:=tomcat}
+: ${CATALINA_GROUP:=tomcat}
+
+: ${TOMCAT_START:=start}
+
+: ${JPDA_TRANSPORT:="dt_socket"}
+: ${JPDA_ADDRESS:="8000"}
+: ${JPDA_OPTS="-Xdebug -Xrunjdwp:transport=${JPDA_TRANSPORT},address=${JPDA_ADDRESS},server=y,suspend=n"}
+
+export JAVA_HOME=`java-config ${TOMCAT_JVM:+--select-vm ${TOMCAT_JVM}} --jre-home`
+export CLASSPATH="${CATALINA_HOME}/bin/bootstrap.jar:${CATALINA_HOME}/bin/tomcat-juli.jar"
+
+depend() {
+	use dns logger net
+}
+
+start()	{
+	ebegin "Starting ${RC_SVCNAME}"
+
+	if [ ! -e "${CATALINA_TMPDIR}" ]; then
+		eerror "CATALINA_TMPDIR does not exist. Unable to start tomcat."
+		eerror "Please see /@GENTOO_PORTAGE_EPREFIX@etc/conf.d/${RC_SVCNAME} for more information."
+		eend 1
+	fi
+
+	local DEPEND=$(java-config --query DEPEND --package tomcat-@SLOT@):${TOMCAT_EXTRA_JARS}
+	DEPEND=${DEPEND%:}
+
+	local GCLASSPATH=$(java-config --with-dependencies --classpath "${DEPEND//:/,}"):${TOMCAT_EXTRA_CLASSPATH}
+	GCLASSPATH=${GCLASSPATH%:}
+
+	local cmd=java args=
+	if [ "${TOMCAT_START}" = "debug" ] || [ "${TOMCAT_START}" = "-security debug" ] ; then
+		cmd=jdb
+		args="${args} -sourcepath ${CATALINA_HOME}/../../jakarta-tomcat-catalina/catalina/src/share"
+	fi
+	if [ "${TOMCAT_START}" = "-security debug" ] || [ "${TOMCAT_START}" = "-security start" ]; then
+		args="${args} -Djava.security.manager"
+		args="${args} -Djava.security.policy=${CATALINA_BASE}/conf/catalina.policy"
+	fi
+	if [ "${TOMCAT_START}" = "jpda start" ] ; then
+		args="${args} ${JPDA_OPTS}"
+	fi
+	if [ -r "${CATALINA_HOME}"/bin/tomcat-juli.jar ]; then
+		args="${args} -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager \
+		-Djava.util.logging.config.file=${CATALINA_BASE}/conf/logging.properties"
+	fi
+
+	start-stop-daemon  --start \
+		--quiet --background \
+		--chdir "${CATALINA_TMPDIR}" \
+		--user ${CATALINA_USER}:${CATALINA_GROUP} \
+		--make-pidfile --pidfile ${PIDFILE} \
+		--exec ${JAVA_HOME}/bin/${cmd} \
+		-- \
+			${JAVA_OPTS} \
+			${args} \
+			-Dcatalina.base="${CATALINA_BASE}" \
+			-Dcatalina.home="${CATALINA_HOME}" \
+			-Djava.io.tmpdir="${CATALINA_TMPDIR}" \
+			-Dgentoo.classpath="${GCLASSPATH//:/,}" \
+			-classpath "${CLASSPATH}" \
+			org.apache.catalina.startup.Bootstrap \
+			${CATALINA_OPTS} \
+			${TOMCAT_START}
+
+	eend $?
+}
+
+stop()	{
+	ebegin "Stopping '${RC_SVCNAME}'"
+
+	start-stop-daemon --stop \
+		--quiet --retry=60 \
+		--pidfile ${PIDFILE} \
+		--exec ${JAVA_HOME}/bin/java \
+		-- \
+			${JAVA_OPTS} \
+			-classpath "${CLASSPATH}" \
+			${CATALINA_OPTS} \
+			stop ${STD_OUT}
+
+	eend $?
+}
+
+forcestop()	{
+	ebegin "Forcing '${RC_SVCNAME}' to stop"
+
+	start-stop-daemon --stop \
+		--quiet --retry=60 \
+		--pidfile ${PIDFILE} \
+		--signal=9
+
+	if service_started "${RC_SVCNAME}"; then
+		mark_service_stopped "${RC_SVCNAME}"
+	fi
+
+	eend $?
+}
diff --git a/www-servers/tomcat/files/tomcat.conf b/www-servers/tomcat/files/tomcat.conf
new file mode 100644
index 000000000000..376af44adef6
--- /dev/null
+++ b/www-servers/tomcat/files/tomcat.conf
@@ -0,0 +1,57 @@
+# Set the handle of the JVM to use. If unset uses the system-vm.
+# run 'eselect java-vm list' to get possible values.
+#
+#TOMCAT_JVM="icedtea-7"
+
+# Additional options to pass to the JVM.
+# Example to set library path for tomcat-native:
+#   JAVA_OPTS="-Djava.library.path=/usr/lib"
+#
+#JAVA_OPTS=""
+
+# Additional packages to put on the default classpath.
+# jakarta-jstl is needed for some of the examples.
+# Note: The extra jars listed here will be visible to webapps.
+# Example:
+#   TOMCAT_EXTRA_JARS="jakarta-jstl,xerces-2"
+#
+#TOMCAT_EXTRA_JARS=""
+
+# Additional paths to put on the default classpath.
+# These should be separated by the : character.
+# Note: The extra jars listed here will be visible to webapps.
+# Example:
+#   TOMCAT_EXTRA_CLASSPATH="/path/to/foo.jar:/path/to/bar.jar"
+#
+#TOMCAT_EXTRA_CLASSPATH=""
+
+# User/Group of this instance.
+CATALINA_USER=@INSTANCE_USER@
+CATALINA_GROUP=@INSTANCE_GROUP@
+
+# Directory path location of temporary directory the JVM should 
+# use (java.io.tmpdir).
+# Note: This directory must exist and be read/writable by tomcat.  
+# See #246362 as an example where /var/tmp was deleted on shutdown.
+#
+#CATALINA_TMPDIR="/@GENTOO_PORTAGE_EPREFIX@var/tmp/@INSTANCE_NAME@"
+
+# TOMCAT STARTUP
+# 	debug             Start Catalina in a debugger
+# 	-security debug   Debug Catalina with a security manager
+# 	jpda start        Start Catalina under JPDA debugger
+# 	start             Start Catalina in a separate window
+# 	-security start   Start in a separate window with security manager
+#
+#TOMCAT_START="start"
+
+# Java Platform Debugger Architecture (JPDA)
+# http://java.sun.com/products/jpda/
+# Override default JPDA address and transport for the "jpda start" command.
+#
+#JPDA_ADDRESS="8000"
+#JPDA_TRANSPORT="dt_socket"
+
+# Additional options to pass to catalina
+#
+#CATALINA_OPTS=""
diff --git a/www-servers/tomcat/metadata.xml b/www-servers/tomcat/metadata.xml
new file mode 100644
index 000000000000..655ae987c3c5
--- /dev/null
+++ b/www-servers/tomcat/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>java@gentoo.org</email>
+    <name>Java</name>
+  </maintainer>
+  <longdescription>
+	Tomcat is the servlet container that is used in the official Reference
+	Implementation for the Java Servlet and JavaServer Pages technologies.
+	The Java Servlet and JavaServer Pages specifications are developed by
+	Sun under the Java Community Process.
+	</longdescription>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:apache:tomcat</remote-id>
+  </upstream>
+  <use>
+    <flag name="extra-webapps">Build also the docs and examples webapp</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/tomcat/tomcat-10.1.52.ebuild b/www-servers/tomcat/tomcat-10.1.52.ebuild
new file mode 100644
index 000000000000..b93da10f421b
--- /dev/null
+++ b/www-servers/tomcat/tomcat-10.1.52.ebuild
@@ -0,0 +1,182 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+JAVA_PKG_IUSE="doc source test"
+
+inherit java-pkg-2 prefix verify-sig
+
+MY_P="apache-${P}-src"
+
+DESCRIPTION="Tomcat Servlet-6.0/JSP-3.1/EL-5.0/WebSocket-2.1/JASPIC-3.0 Container"
+HOMEPAGE="https://tomcat.apache.org/"
+SRC_URI="mirror://apache/${PN}/tomcat-10/v${PV}/src/${MY_P}.tar.gz
+	verify-sig? ( https://downloads.apache.org/tomcat/tomcat-$(ver_cut 1)/v${PV}/src/${MY_P}.tar.gz.asc )"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="10.1"
+KEYWORDS="amd64 ~arm64"
+IUSE="extra-webapps"
+
+RESTRICT="test" # can we run them on a production system?
+
+ECJ_SLOT="4.26"
+
+COMMON_DEP="
+	>=dev-java/ant-1.10.15:0
+	dev-java/bnd-annotation:0
+	dev-java/eclipse-ecj:${ECJ_SLOT}
+	dev-java/jax-rpc-api:0
+	>=dev-java/jakartaee-migration-1.0.9:0
+	dev-java/wsdl4j:0"
+RDEPEND="
+	${COMMON_DEP}
+	acct-group/tomcat
+	acct-user/tomcat
+	>=virtual/jre-11:*"
+DEPEND="
+	${COMMON_DEP}
+	app-admin/pwgen
+	dev-java/bnd:0
+	dev-java/bnd-ant:0
+	dev-java/bnd-util:0
+	dev-java/bndlib:0
+	dev-java/libg:0
+	dev-java/osgi-cmpn:8
+	dev-java/osgi-core:0
+	dev-java/slf4j-api:0
+	|| ( virtual/jdk:21 virtual/jdk:17 )
+	test? (
+		>=dev-java/ant-1.10.15:0[junit]
+		dev-java/easymock:3.2
+	)"
+
+BDEPEND="verify-sig? ( ~sec-keys/openpgp-keys-apache-tomcat-$(ver_cut 1) )"
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/tomcat-$(ver_cut 1).apache.org.asc"
+
+PATCHES=(
+	"${FILESDIR}/tomcat-10.1.20-do-not-copy.patch"
+	"${FILESDIR}/tomcat-10.1.20-offline.patch"
+	"${FILESDIR}/tomcat-9.0.87-gentoo-bnd.patch"
+)
+
+src_prepare() {
+	default #780585
+	java-pkg-2_src_prepare
+	java-pkg_clean
+
+	cat > build.properties <<-EOF || die
+		compile.debug=false
+		execute.download=false
+		exist=true # skip target="downloadfile-2"
+		version=${PV}-gentoo
+		version.number=${PV}
+		ant.jar=$(java-pkg_getjar --build-only ant ant.jar)
+		bnd-annotation.jar=$(java-pkg_getjars bnd-annotation)
+		bnd-ant.jar=$(java-pkg_getjars --build-only bnd-ant)
+		bnd-util.jar=$(java-pkg_getjars --build-only bnd-util)
+		bnd.jar=$(java-pkg_getjars --build-only bnd)
+		bndlib.jar=$(java-pkg_getjars --build-only bndlib)
+		jaxrpc-lib.jar=$(java-pkg_getjars jax-rpc-api)
+		jdt.jar=$(java-pkg_getjars eclipse-ecj-${ECJ_SLOT})
+		libg.jar=$(java-pkg_getjars --build-only libg)
+		migration-lib.jar=$(java-pkg_getjars jakartaee-migration)
+		osgi-cmpn.jar=$(java-pkg_getjars --build-only osgi-cmpn-8)
+		osgi-core.jar=$(java-pkg_getjars --build-only osgi-core)
+		slf4j-api.jar=$(java-pkg_getjars --build-only slf4j-api)
+		wsdl4j-lib.jar=$(java-pkg_getjars wsdl4j)
+	EOF
+	if use test; then
+		echo "easymock.jar=$(java-pkg_getjars --build-only easymock-3.2)" \
+			>> build.properties || die "easymock"
+	fi
+
+	# For use of catalina.sh in netbeans
+	sed -i -e "/^# ----- Execute The Requested Command/ a\
+		CLASSPATH=\`java-config --with-dependencies --classpath ${PN}-${SLOT}\`" \
+		bin/catalina.sh || die
+}
+
+# revisions of the scripts
+IM_REV="-r2"
+INIT_REV="-r1"
+
+src_compile() {
+	LC_ALL=C eant
+	use doc && LC_ALL=C eant javadoc
+}
+
+src_test() {
+	eant test
+}
+
+src_install() {
+	local dest="/usr/share/${PN}-${SLOT}"
+
+	java-pkg_jarinto "${dest}"/bin
+	java-pkg_dojar output/build/bin/*.jar
+	exeinto "${dest}"/bin
+	doexe output/build/bin/*.sh
+
+	java-pkg_jarinto "${dest}"/lib
+	java-pkg_dojar output/build/lib/*.jar
+
+	dodoc RELEASE-NOTES RUNNING.txt
+	use doc && java-pkg_dojavadoc output/dist/webapps/docs/api
+	use source && java-pkg_dosrc java/*
+
+	### Webapps ###
+
+	# add missing docBase
+	local apps="host-manager manager"
+	for app in ${apps}; do
+		sed -i -e "s|=\"true\" >|=\"true\" docBase=\"\$\{catalina.home\}/webapps/${app}\" >|" \
+			output/build/webapps/${app}/META-INF/context.xml || die
+	done
+
+	insinto "${dest}"/webapps
+	doins -r output/build/webapps/{host-manager,manager,ROOT}
+	use extra-webapps && doins -r output/build/webapps/{docs,examples}
+
+	### Config ###
+
+	# create "logs" directory in $CATALINA_BASE
+	# and set correct perms, see #458890
+	dodir "${dest}"/logs
+	fperms 0750 "${dest}"/logs
+
+	# replace the default pw with a random one, see #92281
+	local randpw="$(pwgen -s -B 15 1)"
+	sed -i -e "s|SHUTDOWN|${randpw}|" output/build/conf/server.xml || die
+
+	# prepend gentoo.classpath to common.loader, see #453212
+	sed -i -e 's/^common\.loader=/\0${gentoo.classpath},/' output/build/conf/catalina.properties || die
+
+	insinto "${dest}"
+	doins -r output/build/conf
+
+	### rc ###
+
+	cp "${FILESDIR}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} "${T}" || die
+	eprefixify "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash}
+	sed -i -e "s|@SLOT@|${SLOT}|g" "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} || die
+
+	insinto "${dest}"/gentoo
+	doins "${T}"/tomcat.conf
+	exeinto "${dest}"/gentoo
+	newexe "${T}"/tomcat${INIT_REV}.init tomcat.init
+	newexe "${T}"/tomcat-instance-manager${IM_REV}.bash tomcat-instance-manager.bash
+}
+
+pkg_postinst() {
+	einfo "Ebuilds of Tomcat support running multiple instances. To manage Tomcat instances, run:"
+	einfo "  ${EPREFIX}/usr/share/${PN}-${SLOT}/gentoo/tomcat-instance-manager.bash --help"
+
+	ewarn "Please note that since version 10 the primary package for all implemented APIs"
+	ewarn "has changed from javax.* to jakarta.*. This will almost certainly require code"
+	ewarn "changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later."
+
+	einfo "Please read https://wiki.gentoo.org/wiki/Apache_Tomcat"
+}
diff --git a/www-servers/tomcat/tomcat-10.1.55.ebuild b/www-servers/tomcat/tomcat-10.1.55.ebuild
new file mode 100644
index 000000000000..7c9277cc2f39
--- /dev/null
+++ b/www-servers/tomcat/tomcat-10.1.55.ebuild
@@ -0,0 +1,186 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+JAVA_PKG_IUSE="doc source test"
+
+inherit java-pkg-2 prefix verify-sig
+
+MY_P="apache-${P}-src"
+
+DESCRIPTION="Tomcat Servlet-6.0/JSP-3.1/EL-5.0/WebSocket-2.1/JASPIC-3.0 Container"
+HOMEPAGE="https://tomcat.apache.org/"
+SRC_URI="mirror://apache/${PN}/tomcat-10/v${PV}/src/${MY_P}.tar.gz
+	verify-sig? ( https://downloads.apache.org/tomcat/tomcat-$(ver_cut 1)/v${PV}/src/${MY_P}.tar.gz.asc )"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="10.1"
+KEYWORDS="~amd64 ~arm64"
+IUSE="extra-webapps"
+
+RESTRICT="test" # can we run them on a production system?
+
+BND_MIN="7.2.3"
+ECJ_SLOT="4.26"
+
+COMMON_DEP="
+	>=dev-java/ant-1.10.15-r1:0
+	>=dev-java/bnd-annotation-${BND_MIN}:0
+	dev-java/eclipse-ecj:${ECJ_SLOT}
+	dev-java/jax-rpc-api:0
+	>=dev-java/jakartaee-migration-1.0.10:0
+	>=dev-java/wsdl4j-1.6.3-r1:0"
+
+# jre-17:* because of line 1081, build.xml
+# <filter token="target.jdk" value="${compile.release}"/>
+RDEPEND="
+	${COMMON_DEP}
+	acct-group/tomcat
+	acct-user/tomcat
+	>=virtual/jre-11:*"
+DEPEND="
+	${COMMON_DEP}
+	app-admin/pwgen
+	>=dev-java/bnd-${BND_MIN}:0
+	>=dev-java/bnd-ant-${BND_MIN}:0
+	>=dev-java/bnd-util-${BND_MIN}:0
+	>=dev-java/bndlib-${BND_MIN}:0
+	>=dev-java/libg-${BND_MIN}:0
+	dev-java/osgi-cmpn:8
+	dev-java/osgi-core:0
+	dev-java/slf4j-api:0
+	|| ( virtual/jdk:21 virtual/jdk:17 )
+	test? (
+		>=dev-java/ant-1.10.15:0[junit]
+		dev-java/easymock:3.2
+	)"
+
+BDEPEND="verify-sig? ( ~sec-keys/openpgp-keys-apache-tomcat-$(ver_cut 1) )"
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/tomcat-$(ver_cut 1).apache.org.asc"
+
+PATCHES=(
+	"${FILESDIR}/tomcat-10.1.20-do-not-copy.patch"
+	"${FILESDIR}/tomcat-10.1.20-offline.patch"
+	"${FILESDIR}/tomcat-9.0.87-gentoo-bnd.patch"
+)
+
+src_prepare() {
+	default #780585
+	java-pkg-2_src_prepare
+	java-pkg_clean
+
+	cat > build.properties <<-EOF || die
+		compile.debug=false
+		execute.download=false
+		exist=true # skip target="downloadfile-2"
+		version=${PV}-gentoo
+		version.number=${PV}
+		ant.jar=$(java-pkg_getjar --build-only ant ant.jar)
+		bnd-annotation.jar=$(java-pkg_getjars bnd-annotation)
+		bnd-ant.jar=$(java-pkg_getjars --build-only bnd-ant)
+		bnd-util.jar=$(java-pkg_getjars --build-only bnd-util)
+		bnd.jar=$(java-pkg_getjars --build-only bnd)
+		bndlib.jar=$(java-pkg_getjars --build-only bndlib)
+		jaxrpc-lib.jar=$(java-pkg_getjars jax-rpc-api)
+		jdt.jar=$(java-pkg_getjars eclipse-ecj-${ECJ_SLOT})
+		libg.jar=$(java-pkg_getjars --build-only libg)
+		migration-lib.jar=$(java-pkg_getjars jakartaee-migration)
+		osgi-cmpn.jar=$(java-pkg_getjars --build-only osgi-cmpn-8)
+		osgi-core.jar=$(java-pkg_getjars --build-only osgi-core)
+		slf4j-api.jar=$(java-pkg_getjars --build-only slf4j-api)
+		wsdl4j-lib.jar=$(java-pkg_getjars wsdl4j)
+	EOF
+	if use test; then
+		echo "easymock.jar=$(java-pkg_getjars --build-only easymock-3.2)" \
+			>> build.properties || die "easymock"
+	fi
+
+	# For use of catalina.sh in netbeans
+	sed -i -e "/^# ----- Execute The Requested Command/ a\
+		CLASSPATH=\`java-config --with-dependencies --classpath ${PN}-${SLOT}\`" \
+		bin/catalina.sh || die
+}
+
+# revisions of the scripts
+IM_REV="-r2"
+INIT_REV="-r1"
+
+src_compile() {
+	LC_ALL=C eant
+	use doc && LC_ALL=C eant javadoc
+}
+
+src_test() {
+	eant test
+}
+
+src_install() {
+	local dest="/usr/share/${PN}-${SLOT}"
+
+	java-pkg_jarinto "${dest}"/bin
+	java-pkg_dojar output/build/bin/*.jar
+	exeinto "${dest}"/bin
+	doexe output/build/bin/*.sh
+
+	java-pkg_jarinto "${dest}"/lib
+	java-pkg_dojar output/build/lib/*.jar
+
+	dodoc RELEASE-NOTES RUNNING.txt
+	use doc && java-pkg_dojavadoc output/dist/webapps/docs/api
+	use source && java-pkg_dosrc java/*
+
+	### Webapps ###
+
+	# add missing docBase
+	local apps="host-manager manager"
+	for app in ${apps}; do
+		sed -i -e "s|=\"true\" >|=\"true\" docBase=\"\$\{catalina.home\}/webapps/${app}\" >|" \
+			output/build/webapps/${app}/META-INF/context.xml || die
+	done
+
+	insinto "${dest}"/webapps
+	doins -r output/build/webapps/{host-manager,manager,ROOT}
+	use extra-webapps && doins -r output/build/webapps/{docs,examples}
+
+	### Config ###
+
+	# create "logs" directory in $CATALINA_BASE
+	# and set correct perms, see #458890
+	dodir "${dest}"/logs
+	fperms 0750 "${dest}"/logs
+
+	# replace the default pw with a random one, see #92281
+	local randpw="$(pwgen -s -B 15 1)"
+	sed -i -e "s|SHUTDOWN|${randpw}|" output/build/conf/server.xml || die
+
+	# prepend gentoo.classpath to common.loader, see #453212
+	sed -i -e 's/^common\.loader=/\0${gentoo.classpath},/' output/build/conf/catalina.properties || die
+
+	insinto "${dest}"
+	doins -r output/build/conf
+
+	### rc ###
+
+	cp "${FILESDIR}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} "${T}" || die
+	eprefixify "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash}
+	sed -i -e "s|@SLOT@|${SLOT}|g" "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} || die
+
+	insinto "${dest}"/gentoo
+	doins "${T}"/tomcat.conf
+	exeinto "${dest}"/gentoo
+	newexe "${T}"/tomcat${INIT_REV}.init tomcat.init
+	newexe "${T}"/tomcat-instance-manager${IM_REV}.bash tomcat-instance-manager.bash
+}
+
+pkg_postinst() {
+	einfo "Ebuilds of Tomcat support running multiple instances. To manage Tomcat instances, run:"
+	einfo "  ${EPREFIX}/usr/share/${PN}-${SLOT}/gentoo/tomcat-instance-manager.bash --help"
+
+	ewarn "Please note that since version 10 the primary package for all implemented APIs"
+	ewarn "has changed from javax.* to jakarta.*. This will almost certainly require code"
+	ewarn "changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later."
+
+	einfo "Please read https://wiki.gentoo.org/wiki/Apache_Tomcat"
+}
diff --git a/www-servers/tomcat/tomcat-11.0.18.ebuild b/www-servers/tomcat/tomcat-11.0.18.ebuild
new file mode 100644
index 000000000000..0f1c578a1469
--- /dev/null
+++ b/www-servers/tomcat/tomcat-11.0.18.ebuild
@@ -0,0 +1,186 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+JAVA_PKG_IUSE="doc source test"
+
+inherit java-pkg-2 prefix verify-sig
+
+MY_P="apache-${P}-src"
+
+DESCRIPTION="Tomcat Servlet-6.1/JSP-4.0/EL-6.0/WebSocket-2.2/JASPIC-3.1 Container"
+HOMEPAGE="https://tomcat.apache.org/"
+SRC_URI="mirror://apache/${PN}/tomcat-$(ver_cut 1)/v${PV}/src/${MY_P}.tar.gz
+	verify-sig? ( https://downloads.apache.org/tomcat/tomcat-$(ver_cut 1)/v${PV}/src/${MY_P}.tar.gz.asc )"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="11"
+
+KEYWORDS="amd64 ~arm64"
+IUSE="extra-webapps"
+
+RESTRICT="test" # can we run them on a production system?
+
+ECJ_SLOT="4.38"
+
+COMMON_DEP="
+	>=dev-java/ant-1.10.15:0
+	dev-java/bnd-annotation:0
+	dev-java/eclipse-ecj:${ECJ_SLOT}
+	dev-java/jax-rpc-api:0
+	>=dev-java/jakartaee-migration-1.0.9:0
+	dev-java/wsdl4j:0"
+
+# jre-17:* because of line 1081, build.xml
+# <filter token="target.jdk" value="${compile.release}"/>
+RDEPEND="
+	${COMMON_DEP}
+	acct-group/tomcat
+	acct-user/tomcat
+	>=virtual/jre-17:*"
+DEPEND="
+	${COMMON_DEP}
+	app-admin/pwgen
+	dev-java/bnd:0
+	dev-java/bnd-ant:0
+	dev-java/bnd-util:0
+	dev-java/bndlib:0
+	dev-java/libg:0
+	dev-java/osgi-cmpn:8
+	dev-java/osgi-core:0
+	dev-java/slf4j-api:0
+	|| ( virtual/jdk:21 virtual/jdk:17 )
+	test? (
+		>=dev-java/ant-1.10.15:0[junit]
+		dev-java/easymock:3.2
+	)"
+
+BDEPEND="verify-sig? ( ~sec-keys/openpgp-keys-apache-tomcat-$(ver_cut 1) )"
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/tomcat-$(ver_cut 1).apache.org.asc"
+
+PATCHES=(
+	"${FILESDIR}/tomcat-10.1.20-do-not-copy.patch"
+	"${FILESDIR}/tomcat-11.0.0-offline.patch"
+	"${FILESDIR}/tomcat-9.0.87-gentoo-bnd.patch"
+)
+
+src_prepare() {
+	default #780585
+	java-pkg-2_src_prepare
+	java-pkg_clean
+
+	cat > build.properties <<-EOF || die
+		compile.debug=false
+		execute.download=false
+		exist=true # skip target="downloadfile-2"
+		version=${PV}-gentoo
+		version.number=${PV}
+		ant.jar=$(java-pkg_getjar --build-only ant ant.jar)
+		bnd-annotation.jar=$(java-pkg_getjars bnd-annotation)
+		bnd-ant.jar=$(java-pkg_getjars --build-only bnd-ant)
+		bnd-util.jar=$(java-pkg_getjars --build-only bnd-util)
+		bnd.jar=$(java-pkg_getjars --build-only bnd)
+		bndlib.jar=$(java-pkg_getjars --build-only bndlib)
+		jaxrpc-lib.jar=$(java-pkg_getjars --build-only jax-rpc-api)
+		jdt.jar=$(java-pkg_getjars eclipse-ecj-${ECJ_SLOT})
+		libg.jar=$(java-pkg_getjars --build-only libg)
+		migration-lib.jar=$(java-pkg_getjars jakartaee-migration)
+		osgi-cmpn.jar=$(java-pkg_getjars --build-only osgi-cmpn-8)
+		osgi-core.jar=$(java-pkg_getjars --build-only osgi-core)
+		slf4j-api.jar=$(java-pkg_getjars --build-only slf4j-api)
+		wsdl4j-lib.jar=$(java-pkg_getjars --build-only wsdl4j)
+	EOF
+	if use test; then
+		echo "easymock.jar=$(java-pkg_getjars --build-only easymock-3.2)" \
+			>> build.properties || die "easymock"
+	fi
+
+	# For use of catalina.sh in netbeans
+	sed -i -e "/^# ----- Execute The Requested Command/ a\
+		CLASSPATH=\`java-config --with-dependencies --classpath ${PN}-${SLOT}\`" \
+		bin/catalina.sh || die
+}
+
+# revisions of the scripts
+IM_REV="-r2"
+INIT_REV="-r1"
+
+src_compile() {
+	LC_ALL=C eant
+	use doc && LC_ALL=C eant javadoc
+}
+
+src_test() {
+	eant test
+}
+
+src_install() {
+	local dest="/usr/share/${PN}-${SLOT}"
+
+	java-pkg_jarinto "${dest}"/bin
+	java-pkg_dojar output/build/bin/*.jar
+	exeinto "${dest}"/bin
+	doexe output/build/bin/*.sh
+
+	java-pkg_jarinto "${dest}"/lib
+	java-pkg_dojar output/build/lib/*.jar
+
+	dodoc RELEASE-NOTES RUNNING.txt
+	use doc && java-pkg_dojavadoc output/dist/webapps/docs/api
+	use source && java-pkg_dosrc java/*
+
+	### Webapps ###
+
+	# add missing docBase
+	local apps="host-manager manager"
+	for app in ${apps}; do
+		sed -i -e "s|=\"true\" >|=\"true\" docBase=\"\$\{catalina.home\}/webapps/${app}\" >|" \
+			output/build/webapps/${app}/META-INF/context.xml || die
+	done
+
+	insinto "${dest}"/webapps
+	doins -r output/build/webapps/{host-manager,manager,ROOT}
+	use extra-webapps && doins -r output/build/webapps/{docs,examples}
+
+	### Config ###
+
+	# create "logs" directory in $CATALINA_BASE
+	# and set correct perms, see #458890
+	dodir "${dest}"/logs
+	fperms 0750 "${dest}"/logs
+
+	# replace the default pw with a random one, see #92281
+	local randpw="$(pwgen -s -B 15 1)"
+	sed -i -e "s|SHUTDOWN|${randpw}|" output/build/conf/server.xml || die
+
+	# prepend gentoo.classpath to common.loader, see #453212
+	sed -i -e 's/^common\.loader=/\0${gentoo.classpath},/' output/build/conf/catalina.properties || die
+
+	insinto "${dest}"
+	doins -r output/build/conf
+
+	### rc ###
+
+	cp "${FILESDIR}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} "${T}" || die
+	eprefixify "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash}
+	sed -i -e "s|@SLOT@|${SLOT}|g" "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} || die
+
+	insinto "${dest}"/gentoo
+	doins "${T}"/tomcat.conf
+	exeinto "${dest}"/gentoo
+	newexe "${T}"/tomcat${INIT_REV}.init tomcat.init
+	newexe "${T}"/tomcat-instance-manager${IM_REV}.bash tomcat-instance-manager.bash
+}
+
+pkg_postinst() {
+	einfo "Ebuilds of Tomcat support running multiple instances. To manage Tomcat instances, run:"
+	einfo "  ${EPREFIX}/usr/share/${PN}-${SLOT}/gentoo/tomcat-instance-manager.bash --help"
+
+	ewarn "Please note that since version 10 the primary package for all implemented APIs"
+	ewarn "has changed from javax.* to jakarta.*. This will almost certainly require code"
+	ewarn "changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later."
+
+	einfo "Please read https://wiki.gentoo.org/wiki/Apache_Tomcat"
+}
diff --git a/www-servers/tomcat/tomcat-11.0.22.ebuild b/www-servers/tomcat/tomcat-11.0.22.ebuild
new file mode 100644
index 000000000000..77a24f417f9a
--- /dev/null
+++ b/www-servers/tomcat/tomcat-11.0.22.ebuild
@@ -0,0 +1,187 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+JAVA_PKG_IUSE="doc source test"
+
+inherit java-pkg-2 prefix verify-sig
+
+MY_P="apache-${P}-src"
+
+DESCRIPTION="Tomcat Servlet-6.1/JSP-4.0/EL-6.0/WebSocket-2.2/JASPIC-3.1 Container"
+HOMEPAGE="https://tomcat.apache.org/"
+SRC_URI="mirror://apache/${PN}/tomcat-$(ver_cut 1)/v${PV}/src/${MY_P}.tar.gz
+	verify-sig? ( https://downloads.apache.org/tomcat/tomcat-$(ver_cut 1)/v${PV}/src/${MY_P}.tar.gz.asc )"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="11"
+
+KEYWORDS="~amd64 ~arm64"
+IUSE="extra-webapps"
+
+RESTRICT="test" # can we run them on a production system?
+
+BND_MIN="7.2.3"
+ECJ_SLOT="4.39"
+
+COMMON_DEP="
+	>=dev-java/ant-1.10.15-r1:0
+	>=dev-java/bnd-annotation-${BND_MIN}:0
+	dev-java/eclipse-ecj:${ECJ_SLOT}
+	dev-java/jax-rpc-api:0
+	>=dev-java/jakartaee-migration-1.0.10:0
+	>=dev-java/wsdl4j-1.6.3-r1:0"
+
+# jre-17:* because of line 1081, build.xml
+# <filter token="target.jdk" value="${compile.release}"/>
+RDEPEND="
+	${COMMON_DEP}
+	acct-group/tomcat
+	acct-user/tomcat
+	>=virtual/jre-17:*"
+DEPEND="
+	${COMMON_DEP}
+	app-admin/pwgen
+	>=dev-java/bnd-${BND_MIN}:0
+	>=dev-java/bnd-ant-${BND_MIN}:0
+	>=dev-java/bnd-util-${BND_MIN}:0
+	>=dev-java/bndlib-${BND_MIN}:0
+	>=dev-java/libg-${BND_MIN}:0
+	dev-java/osgi-cmpn:8
+	dev-java/osgi-core:0
+	dev-java/slf4j-api:0
+	|| ( virtual/jdk:21 virtual/jdk:17 )
+	test? (
+		>=dev-java/ant-1.10.15-r1:0[junit]
+		dev-java/easymock:3.2
+	)"
+
+BDEPEND="verify-sig? ( ~sec-keys/openpgp-keys-apache-tomcat-$(ver_cut 1) )"
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/tomcat-$(ver_cut 1).apache.org.asc"
+
+PATCHES=(
+	"${FILESDIR}/tomcat-10.1.20-do-not-copy.patch"
+	"${FILESDIR}/tomcat-11.0.0-offline.patch"
+	"${FILESDIR}/tomcat-9.0.87-gentoo-bnd.patch"
+)
+
+src_prepare() {
+	default #780585
+	java-pkg-2_src_prepare
+	java-pkg_clean
+
+	cat > build.properties <<-EOF || die
+		compile.debug=false
+		execute.download=false
+		exist=true # skip target="downloadfile-2"
+		version=${PV}-gentoo
+		version.number=${PV}
+		ant.jar=$(java-pkg_getjar --build-only ant ant.jar)
+		bnd-annotation.jar=$(java-pkg_getjars bnd-annotation)
+		bnd-ant.jar=$(java-pkg_getjars --build-only bnd-ant)
+		bnd-util.jar=$(java-pkg_getjars --build-only bnd-util)
+		bnd.jar=$(java-pkg_getjars --build-only bnd)
+		bndlib.jar=$(java-pkg_getjars --build-only bndlib)
+		jaxrpc-lib.jar=$(java-pkg_getjars --build-only jax-rpc-api)
+		jdt.jar=$(java-pkg_getjars eclipse-ecj-${ECJ_SLOT})
+		libg.jar=$(java-pkg_getjars --build-only libg)
+		migration-lib.jar=$(java-pkg_getjars jakartaee-migration)
+		osgi-cmpn.jar=$(java-pkg_getjars --build-only osgi-cmpn-8)
+		osgi-core.jar=$(java-pkg_getjars --build-only osgi-core)
+		slf4j-api.jar=$(java-pkg_getjars --build-only slf4j-api)
+		wsdl4j-lib.jar=$(java-pkg_getjars --build-only wsdl4j)
+	EOF
+	if use test; then
+		echo "easymock.jar=$(java-pkg_getjars --build-only easymock-3.2)" \
+			>> build.properties || die "easymock"
+	fi
+
+	# For use of catalina.sh in netbeans
+	sed -i -e "/^# ----- Execute The Requested Command/ a\
+		CLASSPATH=\`java-config --with-dependencies --classpath ${PN}-${SLOT}\`" \
+		bin/catalina.sh || die
+}
+
+# revisions of the scripts
+IM_REV="-r2"
+INIT_REV="-r1"
+
+src_compile() {
+	LC_ALL=C eant
+	use doc && LC_ALL=C eant javadoc
+}
+
+src_test() {
+	eant test
+}
+
+src_install() {
+	local dest="/usr/share/${PN}-${SLOT}"
+
+	java-pkg_jarinto "${dest}"/bin
+	java-pkg_dojar output/build/bin/*.jar
+	exeinto "${dest}"/bin
+	doexe output/build/bin/*.sh
+
+	java-pkg_jarinto "${dest}"/lib
+	java-pkg_dojar output/build/lib/*.jar
+
+	dodoc RELEASE-NOTES RUNNING.txt
+	use doc && java-pkg_dojavadoc output/dist/webapps/docs/api
+	use source && java-pkg_dosrc java/*
+
+	### Webapps ###
+
+	# add missing docBase
+	local apps="host-manager manager"
+	for app in ${apps}; do
+		sed -i -e "s|=\"true\" >|=\"true\" docBase=\"\$\{catalina.home\}/webapps/${app}\" >|" \
+			output/build/webapps/${app}/META-INF/context.xml || die
+	done
+
+	insinto "${dest}"/webapps
+	doins -r output/build/webapps/{host-manager,manager,ROOT}
+	use extra-webapps && doins -r output/build/webapps/{docs,examples}
+
+	### Config ###
+
+	# create "logs" directory in $CATALINA_BASE
+	# and set correct perms, see #458890
+	dodir "${dest}"/logs
+	fperms 0750 "${dest}"/logs
+
+	# replace the default pw with a random one, see #92281
+	local randpw="$(pwgen -s -B 15 1)"
+	sed -i -e "s|SHUTDOWN|${randpw}|" output/build/conf/server.xml || die
+
+	# prepend gentoo.classpath to common.loader, see #453212
+	sed -i -e 's/^common\.loader=/\0${gentoo.classpath},/' output/build/conf/catalina.properties || die
+
+	insinto "${dest}"
+	doins -r output/build/conf
+
+	### rc ###
+
+	cp "${FILESDIR}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} "${T}" || die
+	eprefixify "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash}
+	sed -i -e "s|@SLOT@|${SLOT}|g" "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} || die
+
+	insinto "${dest}"/gentoo
+	doins "${T}"/tomcat.conf
+	exeinto "${dest}"/gentoo
+	newexe "${T}"/tomcat${INIT_REV}.init tomcat.init
+	newexe "${T}"/tomcat-instance-manager${IM_REV}.bash tomcat-instance-manager.bash
+}
+
+pkg_postinst() {
+	einfo "Ebuilds of Tomcat support running multiple instances. To manage Tomcat instances, run:"
+	einfo "  ${EPREFIX}/usr/share/${PN}-${SLOT}/gentoo/tomcat-instance-manager.bash --help"
+
+	ewarn "Please note that since version 10 the primary package for all implemented APIs"
+	ewarn "has changed from javax.* to jakarta.*. This will almost certainly require code"
+	ewarn "changes to enable applications to migrate from Tomcat 9 and earlier to Tomcat 10 and later."
+
+	einfo "Please read https://wiki.gentoo.org/wiki/Apache_Tomcat"
+}
diff --git a/www-servers/tomcat/tomcat-9.0.115.ebuild b/www-servers/tomcat/tomcat-9.0.115.ebuild
new file mode 100644
index 000000000000..8b473f540f59
--- /dev/null
+++ b/www-servers/tomcat/tomcat-9.0.115.ebuild
@@ -0,0 +1,181 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+JAVA_PKG_IUSE="doc source test"
+
+inherit java-pkg-2 prefix verify-sig
+
+MY_P="apache-${P}-src"
+
+DESCRIPTION="Tomcat Servlet-4.0/JSP-2.3/EL-3.0/WebSocket-1.1/JASPIC-1.1 Container"
+HOMEPAGE="https://tomcat.apache.org/"
+SRC_URI="mirror://apache/${PN}/tomcat-9/v${PV}/src/${MY_P}.tar.gz
+	verify-sig? ( https://downloads.apache.org/tomcat/tomcat-$(ver_cut 1)/v${PV}/src/${MY_P}.tar.gz.asc )"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="9"
+KEYWORDS="amd64 ~arm64"
+IUSE="extra-webapps"
+
+RESTRICT="test" # can we run them on a production system?
+
+ECJ_SLOT="4.20"
+
+COMMON_DEP="
+	dev-java/bnd-annotation:0
+	dev-java/eclipse-ecj:${ECJ_SLOT}
+	dev-java/jax-rpc-api:0
+	dev-java/wsdl4j:0
+"
+
+RDEPEND="
+	${COMMON_DEP}
+	acct-group/tomcat
+	acct-user/tomcat
+	dev-java/javax-persistence-api:0
+	>=virtual/jre-1.8:*
+"
+
+DEPEND="
+	${COMMON_DEP}
+	app-admin/pwgen
+	>=dev-java/ant-1.10.15:0
+	dev-java/bnd:0
+	dev-java/bnd-ant:0
+	dev-java/bnd-util:0
+	dev-java/bndlib:0
+	dev-java/libg:0
+	dev-java/osgi-cmpn:8
+	dev-java/osgi-core:0
+	dev-java/slf4j-api:0
+	|| ( virtual/jdk:21 virtual/jdk:17 )
+	test? (
+		>=dev-java/ant-1.10.15:0[junit]
+		dev-java/easymock:3.2
+	)
+"
+
+BDEPEND="verify-sig? ( ~sec-keys/openpgp-keys-apache-tomcat-$(ver_cut 1) )"
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/tomcat-$(ver_cut 1).apache.org.asc"
+
+PATCHES=(
+	"${FILESDIR}/tomcat-9.0.104-build.xml.patch"
+	"${FILESDIR}/tomcat-9.0.87-gentoo-bnd.patch"
+)
+
+src_prepare() {
+	default #780585
+	java-pkg-2_src_prepare
+	java-pkg_clean
+
+	cat > build.properties <<-EOF || die
+		compile.debug=false
+		execute.download=false
+		exist=true # skip target="downloadfile-2"
+		version=${PV}-gentoo
+		version.number=${PV}
+		ant.jar=$(java-pkg_getjar --build-only ant ant.jar)
+		bnd-annotation.jar=$(java-pkg_getjars bnd-annotation)
+		bnd-ant.jar=$(java-pkg_getjars --build-only bnd-ant)
+		bnd-util.jar=$(java-pkg_getjars --build-only bnd-util)
+		bnd.jar=$(java-pkg_getjars --build-only bnd)
+		bndlib.jar=$(java-pkg_getjars --build-only bndlib)
+		jaxrpc-lib.jar=$(java-pkg_getjars jax-rpc-api)
+		jdt.jar=$(java-pkg_getjars eclipse-ecj-${ECJ_SLOT})
+		libg.jar=$(java-pkg_getjars --build-only libg)
+		osgi-cmpn.jar=$(java-pkg_getjars --build-only osgi-cmpn-8)
+		osgi-core.jar=$(java-pkg_getjars --build-only osgi-core)
+		slf4j-api.jar=$(java-pkg_getjars --build-only slf4j-api)
+		wsdl4j-lib.jar=$(java-pkg_getjars wsdl4j)
+	EOF
+	if use test; then
+		echo "easymock.jar=$(java-pkg_getjars --build-only easymock-3.2)" \
+			>> build.properties || die "easymock"
+	fi
+
+	# For use of catalina.sh in netbeans
+	sed -i -e "/^# ----- Execute The Requested Command/ a\
+		CLASSPATH=\`java-config --with-dependencies --classpath ${PN}-${SLOT}\`" \
+		bin/catalina.sh || die
+}
+
+# revisions of the scripts
+IM_REV="-r2"
+INIT_REV="-r1"
+
+src_compile() {
+	LC_ALL=C eant
+	use doc && LC_ALL=C eant javadoc
+}
+
+src_test() {
+	eant test
+}
+
+src_install() {
+	local dest="/usr/share/${PN}-${SLOT}"
+
+	java-pkg_jarinto "${dest}"/bin
+	java-pkg_dojar output/build/bin/*.jar
+	exeinto "${dest}"/bin
+	doexe output/build/bin/*.sh
+
+	java-pkg_jarinto "${dest}"/lib
+	java-pkg_dojar output/build/lib/*.jar
+
+	dodoc RELEASE-NOTES RUNNING.txt
+	use doc && java-pkg_dojavadoc output/dist/webapps/docs/api
+	use source && java-pkg_dosrc java/*
+
+	### Webapps ###
+
+	# add missing docBase
+	local apps="host-manager manager"
+	for app in ${apps}; do
+		sed -i -e "s|=\"true\" >|=\"true\" docBase=\"\$\{catalina.home\}/webapps/${app}\" >|" \
+			output/build/webapps/${app}/META-INF/context.xml || die
+	done
+
+	insinto "${dest}"/webapps
+	doins -r output/build/webapps/{host-manager,manager,ROOT}
+	use extra-webapps && doins -r output/build/webapps/{docs,examples}
+
+	### Config ###
+
+	# create "logs" directory in $CATALINA_BASE
+	# and set correct perms, see #458890
+	dodir "${dest}"/logs
+	fperms 0750 "${dest}"/logs
+
+	# replace the default pw with a random one, see #92281
+	local randpw="$(pwgen -s -B 15 1)"
+	sed -i -e "s|SHUTDOWN|${randpw}|" output/build/conf/server.xml || die
+
+	# prepend gentoo.classpath to common.loader, see #453212
+	sed -i -e 's/^common\.loader=/\0${gentoo.classpath},/' output/build/conf/catalina.properties || die
+
+	insinto "${dest}"
+	doins -r output/build/conf
+
+	### rc ###
+
+	cp "${FILESDIR}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} "${T}" || die
+	eprefixify "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash}
+	sed -i -e "s|@SLOT@|${SLOT}|g" "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} || die
+
+	insinto "${dest}"/gentoo
+	doins "${T}"/tomcat.conf
+	exeinto "${dest}"/gentoo
+	newexe "${T}"/tomcat${INIT_REV}.init tomcat.init
+	newexe "${T}"/tomcat-instance-manager${IM_REV}.bash tomcat-instance-manager.bash
+}
+
+pkg_postinst() {
+	einfo "Ebuilds of Tomcat support running multiple instances. To manage Tomcat instances, run:"
+	einfo "  ${EPREFIX}/usr/share/${PN}-${SLOT}/gentoo/tomcat-instance-manager.bash --help"
+
+	einfo "Please read https://wiki.gentoo.org/wiki/Apache_Tomcat"
+}
diff --git a/www-servers/tomcat/tomcat-9.0.118.ebuild b/www-servers/tomcat/tomcat-9.0.118.ebuild
new file mode 100644
index 000000000000..1d5bb7fdeec5
--- /dev/null
+++ b/www-servers/tomcat/tomcat-9.0.118.ebuild
@@ -0,0 +1,182 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+JAVA_PKG_IUSE="doc source test"
+
+inherit java-pkg-2 prefix verify-sig
+
+MY_P="apache-${P}-src"
+
+DESCRIPTION="Tomcat Servlet-4.0/JSP-2.3/EL-3.0/WebSocket-1.1/JASPIC-1.1 Container"
+HOMEPAGE="https://tomcat.apache.org/"
+SRC_URI="mirror://apache/${PN}/tomcat-9/v${PV}/src/${MY_P}.tar.gz
+	verify-sig? ( https://downloads.apache.org/tomcat/tomcat-$(ver_cut 1)/v${PV}/src/${MY_P}.tar.gz.asc )"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="9"
+KEYWORDS="~amd64 ~arm64"
+IUSE="extra-webapps"
+
+RESTRICT="test" # can we run them on a production system?
+
+BND_MIN="7.2.3"
+ECJ_SLOT="4.20"
+
+COMMON_DEP="
+	>=dev-java/bnd-annotation-${BND_MIN}:0
+	dev-java/eclipse-ecj:${ECJ_SLOT}
+	dev-java/jax-rpc-api:0
+	>=dev-java/wsdl4j-1.6.3-r1:0
+"
+
+RDEPEND="
+	${COMMON_DEP}
+	acct-group/tomcat
+	acct-user/tomcat
+	dev-java/javax-persistence-api:0
+	>=virtual/jre-1.8:*
+"
+
+DEPEND="
+	${COMMON_DEP}
+	app-admin/pwgen
+	>=dev-java/ant-1.10.15:0
+	>=dev-java/bnd-${BND_MIN}:0
+	>=dev-java/bnd-ant-${BND_MIN}:0
+	>=dev-java/bnd-util-${BND_MIN}:0
+	>=dev-java/bndlib-${BND_MIN}:0
+	>=dev-java/libg-${BND_MIN}:0
+	dev-java/osgi-cmpn:8
+	dev-java/osgi-core:0
+	dev-java/slf4j-api:0
+	|| ( virtual/jdk:21 virtual/jdk:17 )
+	test? (
+		>=dev-java/ant-1.10.15-r1:0[junit]
+		dev-java/easymock:3.2
+	)
+"
+
+BDEPEND="verify-sig? ( ~sec-keys/openpgp-keys-apache-tomcat-$(ver_cut 1) )"
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/tomcat-$(ver_cut 1).apache.org.asc"
+
+PATCHES=(
+	"${FILESDIR}/tomcat-9.0.104-build.xml.patch"
+	"${FILESDIR}/tomcat-9.0.87-gentoo-bnd.patch"
+)
+
+src_prepare() {
+	default #780585
+	java-pkg-2_src_prepare
+	java-pkg_clean
+
+	cat > build.properties <<-EOF || die
+		compile.debug=false
+		execute.download=false
+		exist=true # skip target="downloadfile-2"
+		version=${PV}-gentoo
+		version.number=${PV}
+		ant.jar=$(java-pkg_getjar --build-only ant ant.jar)
+		bnd-annotation.jar=$(java-pkg_getjars bnd-annotation)
+		bnd-ant.jar=$(java-pkg_getjars --build-only bnd-ant)
+		bnd-util.jar=$(java-pkg_getjars --build-only bnd-util)
+		bnd.jar=$(java-pkg_getjars --build-only bnd)
+		bndlib.jar=$(java-pkg_getjars --build-only bndlib)
+		jaxrpc-lib.jar=$(java-pkg_getjars jax-rpc-api)
+		jdt.jar=$(java-pkg_getjars eclipse-ecj-${ECJ_SLOT})
+		libg.jar=$(java-pkg_getjars --build-only libg)
+		osgi-cmpn.jar=$(java-pkg_getjars --build-only osgi-cmpn-8)
+		osgi-core.jar=$(java-pkg_getjars --build-only osgi-core)
+		slf4j-api.jar=$(java-pkg_getjars --build-only slf4j-api)
+		wsdl4j-lib.jar=$(java-pkg_getjars wsdl4j)
+	EOF
+	if use test; then
+		echo "easymock.jar=$(java-pkg_getjars --build-only easymock-3.2)" \
+			>> build.properties || die "easymock"
+	fi
+
+	# For use of catalina.sh in netbeans
+	sed -i -e "/^# ----- Execute The Requested Command/ a\
+		CLASSPATH=\`java-config --with-dependencies --classpath ${PN}-${SLOT}\`" \
+		bin/catalina.sh || die
+}
+
+# revisions of the scripts
+IM_REV="-r2"
+INIT_REV="-r1"
+
+src_compile() {
+	LC_ALL=C eant
+	use doc && LC_ALL=C eant javadoc
+}
+
+src_test() {
+	eant test
+}
+
+src_install() {
+	local dest="/usr/share/${PN}-${SLOT}"
+
+	java-pkg_jarinto "${dest}"/bin
+	java-pkg_dojar output/build/bin/*.jar
+	exeinto "${dest}"/bin
+	doexe output/build/bin/*.sh
+
+	java-pkg_jarinto "${dest}"/lib
+	java-pkg_dojar output/build/lib/*.jar
+
+	dodoc RELEASE-NOTES RUNNING.txt
+	use doc && java-pkg_dojavadoc output/dist/webapps/docs/api
+	use source && java-pkg_dosrc java/*
+
+	### Webapps ###
+
+	# add missing docBase
+	local apps="host-manager manager"
+	for app in ${apps}; do
+		sed -i -e "s|=\"true\" >|=\"true\" docBase=\"\$\{catalina.home\}/webapps/${app}\" >|" \
+			output/build/webapps/${app}/META-INF/context.xml || die
+	done
+
+	insinto "${dest}"/webapps
+	doins -r output/build/webapps/{host-manager,manager,ROOT}
+	use extra-webapps && doins -r output/build/webapps/{docs,examples}
+
+	### Config ###
+
+	# create "logs" directory in $CATALINA_BASE
+	# and set correct perms, see #458890
+	dodir "${dest}"/logs
+	fperms 0750 "${dest}"/logs
+
+	# replace the default pw with a random one, see #92281
+	local randpw="$(pwgen -s -B 15 1)"
+	sed -i -e "s|SHUTDOWN|${randpw}|" output/build/conf/server.xml || die
+
+	# prepend gentoo.classpath to common.loader, see #453212
+	sed -i -e 's/^common\.loader=/\0${gentoo.classpath},/' output/build/conf/catalina.properties || die
+
+	insinto "${dest}"
+	doins -r output/build/conf
+
+	### rc ###
+
+	cp "${FILESDIR}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} "${T}" || die
+	eprefixify "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash}
+	sed -i -e "s|@SLOT@|${SLOT}|g" "${T}"/tomcat{.conf,${INIT_REV}.init,-instance-manager${IM_REV}.bash} || die
+
+	insinto "${dest}"/gentoo
+	doins "${T}"/tomcat.conf
+	exeinto "${dest}"/gentoo
+	newexe "${T}"/tomcat${INIT_REV}.init tomcat.init
+	newexe "${T}"/tomcat-instance-manager${IM_REV}.bash tomcat-instance-manager.bash
+}
+
+pkg_postinst() {
+	einfo "Ebuilds of Tomcat support running multiple instances. To manage Tomcat instances, run:"
+	einfo "  ${EPREFIX}/usr/share/${PN}-${SLOT}/gentoo/tomcat-instance-manager.bash --help"
+
+	einfo "Please read https://wiki.gentoo.org/wiki/Apache_Tomcat"
+}
diff --git a/www-servers/uwsgi/Manifest b/www-servers/uwsgi/Manifest
new file mode 100644
index 000000000000..bcf1b93dcfc0
--- /dev/null
+++ b/www-servers/uwsgi/Manifest
@@ -0,0 +1,3 @@
+DIST uwsgi-2.0.23.tar.gz 810116 BLAKE2B be4353ac71a5282233b0a996e74e49bff66f4c460eb2640058c7028cfeae41214661785de78cdd4aa35415bcc4595e1e340ba48db87bee413754b13d8b24a7d8 SHA512 4060dd66f8c6309497b52a961c36a58fe2b3b3afc7e11b97cfa464757c614d1d44ccc561b18500a394b5d95e5660eae48759003a30ec07379a6f079f63f3899b
+DIST uwsgi-2.0.27.tar.gz 815302 BLAKE2B 6e1aab8a896405f0ab87fdb33bb14117cfd8473da61008e3ecf6b0d2664e7fd29acc12ba322c40772f015adb99ba79c3edcb40b87051fba918c162740d53f241 SHA512 78de6b8aa401ca5e27204cc68dec540617407dc9a0dad2c785a7eadc449889aad4eb516d4d8d257dc46e5b91b6c2d85be5953b19e0897375a7f0fecaa298d066
+DIST uwsgi-2.0.31.tar.gz 822440 BLAKE2B dd2d8b7d3b2293fb2f4ae587862b107238e5b8b4fbd9953a5de52b41329f3895609fe98f8476603d1f5e3f209d490cc5fa46a43cfb7d2b046c22bbddf55236b2 SHA512 d4d327f36455438e165298cb5a7d483c951f4acd3d834b46ceeda105bd3664792ead226b02e06db62e92c210544778119bf75a55d9d4f30f8fba896c7de51e6d
diff --git a/www-servers/uwsgi/files/gentoo.buildconf b/www-servers/uwsgi/files/gentoo.buildconf
new file mode 100644
index 000000000000..e0c60bc6a5b8
--- /dev/null
+++ b/www-servers/uwsgi/files/gentoo.buildconf
@@ -0,0 +1,30 @@
+[uwsgi]
+xml = VAR_XML
+yaml = VAR_YAML
+json = VAR_JSON
+ssl = VAR_SSL
+pcre = VAR_PCRE
+zeromq = VAR_ZMQ
+routing = VAR_ROUTING
+debug = VAR_DEBUG
+unbit = false
+malloc_implementation = VAR_MALLOC
+extras =
+plugins = VAR_PLUGINS
+bin_name = uwsgi
+append_version =
+plugin_dir = VAR_PLUGIN_DIR
+plugin_build_dir = VAR_BUILD_DIR
+embedded_plugins = VAR_EMBEDDED
+as_shared_library = false
+
+locking = auto
+event = auto
+timer = auto
+filemonitor = auto
+
+blacklist =
+whitelist =
+
+embed_files =
+embed_config =
diff --git a/www-servers/uwsgi/files/uwsgi-2.0.21-libphp-version.patch b/www-servers/uwsgi/files/uwsgi-2.0.21-libphp-version.patch
new file mode 100644
index 000000000000..8b0276c3cb89
--- /dev/null
+++ b/www-servers/uwsgi/files/uwsgi-2.0.21-libphp-version.patch
@@ -0,0 +1,13 @@
+https://bugs.gentoo.org/904664
+--- a/plugins/php/uwsgiplugin.py
++++ b/plugins/php/uwsgiplugin.py
+@@ -14,6 +14,9 @@
+ 
+ php_version = os.popen(PHPPATH + ' --version').read().rstrip().split('.')[0]
+ 
++if php_version == '8' :
++    php_version = ''
++
+ CFLAGS = [os.popen(PHPPATH + ' --includes').read().rstrip(), '-Wno-sign-compare']
+ LDFLAGS = os.popen(PHPPATH + ' --ldflags').read().rstrip().split()
+ 
diff --git a/www-servers/uwsgi/files/uwsgi.confd-r4 b/www-servers/uwsgi/files/uwsgi.confd-r4
new file mode 100644
index 000000000000..5469c7b875f9
--- /dev/null
+++ b/www-servers/uwsgi/files/uwsgi.confd-r4
@@ -0,0 +1,68 @@
+# Distributed under the terms of the GNU General Public License v2
+
+# YOU SHOULD ONLY MODIFY THIS FILE IF YOU USE THE UWSGI EMPEROR MODE!
+# IF YOU WANT TO RUN A SINGLE APP INSTANCE, CREATE A COPY AND MODIFY THAT INSTEAD!
+
+# Path (or name) of UNIX/TCP socket to bind to
+# Example : UWSGI_SOCKET=127.0.0.1:1234
+UWSGI_SOCKET=
+
+# Enable threads? (1 = yes, 0 = no). The default is 0
+#
+UWSGI_THREADS=0
+
+# The path to your uWSGI application.
+#
+UWSGI_PROGRAM=
+
+# The path to your uWSGI xml config file.
+#
+UWSGI_XML_CONFIG=
+
+# The number of child processes to spawn. The default is 1.
+#
+UWSGI_PROCESSES=1
+
+# The log file path. If empty, log only errors
+#
+UWSGI_LOG_FILE=
+
+# If you want to run your application inside a chroot then specify the
+# directory here. Leave this blank otherwise.
+#
+UWSGI_CHROOT=
+
+# If you want to run your application from a specific directiory specify
+# it here. Leave this blank otherwise.
+#
+UWSGI_DIR=
+
+# PIDPATH folder mode (/run/uwsgi_${PROGNAME})
+UWSGI_PIDPATH_MODE=0750
+
+# The user to run your application as. If you do not specify these,
+# the application will be run as user root.
+#
+UWSGI_USER=
+
+# The group to run your application as. If you do not specify these,
+# the application will be run as group root.
+#
+UWSGI_GROUP=
+
+# Run the uwsgi emperor which loads vassals dynamically from this PATH
+# see http://projects.unbit.it/uwsgi/wiki/Emperor
+# The advised Gentoo folder is /etc/uwsgi.d/
+UWSGI_EMPEROR_PATH=
+
+# Emperor PIDPATH folder mode (/run/uwsgi)
+UWSGI_EMPEROR_PIDPATH_MODE=0770
+
+# The group the emperor should run as. This is different from the UWSGI_GROUP
+# as you could want your apps share some sockets with other processes such as
+# www servers while preserving your emperor logs from being accessible by them.
+UWSGI_EMPEROR_GROUP=
+
+# Additional options you might want to pass to uWSGI
+#
+UWSGI_EXTRA_OPTIONS=
diff --git a/www-servers/uwsgi/files/uwsgi.initd-r7 b/www-servers/uwsgi/files/uwsgi.initd-r7
new file mode 100644
index 000000000000..a6b99edf1b38
--- /dev/null
+++ b/www-servers/uwsgi/files/uwsgi.initd-r7
@@ -0,0 +1,146 @@
+#!/sbin/openrc-run
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+PROGNAME=${SVCNAME#*.}
+
+UWSGI_EXEC=/usr/bin/uwsgi
+if [ "${SVCNAME}" = "uwsgi" ]; then
+	PIDPATH=/run/uwsgi
+else
+	PIDPATH="/run/uwsgi_${PROGNAME}"
+fi
+PIDFILE="${PIDPATH}/${PROGNAME}.pid"
+
+extra_started_commands="${opts} reload stats"
+
+depend() {
+	need net
+}
+
+start_emperor() {
+	local OPTIONS
+	OPTIONS="--daemonize"
+
+	if [ -n "${UWSGI_LOG_FILE}" ]; then
+		OPTIONS="${OPTIONS} ${UWSGI_LOG_FILE}"
+	else
+		OPTIONS="${OPTIONS} /dev/null --disable-logging"
+	fi
+
+	[ -z "${UWSGI_DIR}" ] && UWSGI_DIR="/"
+	[ -z "${UWSGI_USER}" ] && UWSGI_USER="root"
+	[ -z "${UWSGI_GROUP}" ] && UWSGI_GROUP="root"
+	[ -z "${UWSGI_EMPEROR_PIDPATH_MODE}" ] && UWSGI_EMPEROR_PIDPATH_MODE=0770
+
+	if [ -n "${UWSGI_EXTRA_OPTIONS}" ]; then
+		OPTIONS="${OPTIONS} ${UWSGI_EXTRA_OPTIONS}"
+	fi
+
+	ebegin "Starting uWSGI emperor"
+	checkpath -d -m ${UWSGI_EMPEROR_PIDPATH_MODE} -o "${UWSGI_USER}":"${UWSGI_EMPEROR_GROUP:-${UWSGI_GROUP}}" "${PIDPATH}"
+
+	cd "${UWSGI_DIR}" && \
+	start-stop-daemon --start --user "${UWSGI_USER}" --exec "${UWSGI_EXEC}" \
+		--group ${UWSGI_EMPEROR_GROUP:-${UWSGI_GROUP}} \
+		-- --emperor "${UWSGI_EMPEROR_PATH}" ${OPTIONS} --pidfile "${PIDFILE}"
+	return $?
+}
+
+start_app() {
+	local OPTIONS
+	OPTIONS="--master --daemonize"
+
+	if [ -n "${UWSGI_LOG_FILE}" ]; then
+		OPTIONS="${OPTIONS} ${UWSGI_LOG_FILE}"
+	else
+		OPTIONS="${OPTIONS} /dev/null --disable-logging"
+	fi
+
+	[ -z "${UWSGI_DIR}" ] && UWSGI_DIR="/"
+	[ -z "${UWSGI_USER}" ] && UWSGI_USER="root"
+	[ -z "${UWSGI_GROUP}" ] && UWSGI_GROUP="root"
+	[ -z "${UWSGI_PIDPATH_MODE}" ] && UWSGI_PIDPATH_MODE=0750
+
+	if [ -n "${UWSGI_EXTRA_OPTIONS}" ]; then
+		OPTIONS="${OPTIONS} ${UWSGI_EXTRA_OPTIONS}"
+	fi
+
+	if [ "${UWSGI_THREADS}" = "1" ]; then
+		OPTIONS="${OPTIONS} --enable-threads"
+	fi
+
+	if [ -n "${UWSGI_SOCKET}" ]; then
+		OPTIONS="${OPTIONS} --socket ${UWSGI_SOCKET}"
+	fi
+
+	if [ -n "${UWSGI_PROCESSES}" ]; then
+		OPTIONS="${OPTIONS} --processes ${UWSGI_PROCESSES}"
+	fi
+
+	if [ -n "${UWSGI_CHROOT}" ]; then
+		OPTIONS="${OPTIONS} --chroot ${UWSGI_CHROOT}"
+	fi
+
+	if [ -n "${UWSGI_PROGRAM}" ]; then
+		OPTIONS="${OPTIONS} --fileserve-mode ${UWSGI_PROGRAM}"
+	fi
+
+	if [ -n "${UWSGI_XML_CONFIG}" ]; then
+		OPTIONS="${OPTIONS} --xmlconfig ${UWSGI_XML_CONFIG}"
+	fi
+
+	ebegin "Starting uWSGI application ${PROGNAME}"
+	checkpath -d -m ${UWSGI_PIDPATH_MODE} -o "${UWSGI_USER}":"${UWSGI_GROUP}" "${PIDPATH}"
+
+	cd "${UWSGI_DIR}" && \
+	start-stop-daemon --start --user "${UWSGI_USER}" --group "${UWSGI_GROUP}" \
+		--exec "${UWSGI_EXEC}" -- ${OPTIONS} --pidfile "${PIDFILE}"
+	return $?
+}
+
+start() {
+	if [ -n "${UWSGI_EMPEROR_PATH}" ]; then
+		start_emperor
+		eend $?
+	else
+		if [ "${SVCNAME}" = "uwsgi" ]; then
+			eerror "You are not supposed to run this script directly unless you"
+			eerror "want to run in Emperor mode. In that case please set the UWSGI_EMPEROR_PATH."
+			eerror "Otherwise create a symlink for the uwsgi application you want to run as well as"
+			eerror "a copy of the configuration file and modify it appropriately like so..."
+			eerror
+			eerror "  ln -s uwsgi /etc/init.d/uwsgi.trac"
+			eerror "  cp /etc/conf.d/uwsgi /etc/conf.d/uwsgi.trac"
+			eerror "  nano /etc/conf.d/uwsgi.trac"
+			eerror
+			return 1
+		else
+			start_app
+			eend $?
+		fi
+	fi
+}
+
+stop() {
+	if [ -n "${UWSGI_EMPEROR_PATH}" ]; then
+		ebegin "Stopping uWSGI emperor"
+	else
+		ebegin "Stopping uWSGI application ${PROGNAME}"
+	fi
+	# retry should be set higher than uwsgi worker-reload-mercy (default 60)
+	start-stop-daemon --stop --signal QUIT --retry 90 --pidfile "${PIDFILE}"
+	eend $?
+}
+
+reload() {
+	ebegin "Reloading uWSGI"
+	start-stop-daemon --signal HUP --pidfile "${PIDFILE}"
+	eend $?
+}
+
+stats() {
+	ebegin "Logging uWSGI statistics"
+	start-stop-daemon --signal USR1 --pidfile "${PIDFILE}"
+	eend $?
+}
diff --git a/www-servers/uwsgi/metadata.xml b/www-servers/uwsgi/metadata.xml
new file mode 100644
index 000000000000..6ae7d74c206a
--- /dev/null
+++ b/www-servers/uwsgi/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <use>
+    <flag name="embedded">Embed plugins instead of building them as real plugins. When disabling this USE flag make sure you specify all used plugins in your uWSGI configuration. Note: Language plugins will always be built as real plugins.</flag>
+    <flag name="go">Build the gccgo plugin to run Go applications.</flag>
+    <flag name="json">Support json as a configuration file format.</flag>
+    <flag name="routing">Enable routing support</flag>
+    <flag name="yaml">Support yaml as a configuration file format.</flag>
+    <flag name="yajl">Use <pkg>dev-libs/yajl</pkg> instead of <pkg>dev-libs/jansson</pkg> for parsing JSON configuration files (if USe=json is set)</flag>
+    <flag name="zeromq">Enable logging and deployment via ZeroMQ.</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/uwsgi/uwsgi-2.0.23-r1.ebuild b/www-servers/uwsgi/uwsgi-2.0.23-r1.ebuild
new file mode 100644
index 000000000000..50d39f2cedc4
--- /dev/null
+++ b/www-servers/uwsgi/uwsgi-2.0.23-r1.ebuild
@@ -0,0 +1,378 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Check the upstream uwsgi-2.0 branch, not master, for backports
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+PYTHON_COMPAT=( python3_{11..12} )
+PYTHON_REQ_USE="threads(+)"
+
+RUBY_OPTIONAL="yes"
+USE_RUBY="ruby31 ruby32"
+
+PHP_EXT_INI="no"
+PHP_EXT_NAME="dummy"
+PHP_EXT_OPTIONAL_USE="php"
+USE_PHP="php8-2" # deps must be registered separately below
+
+POSTGRES_COMPAT=( 13 14 15 )
+
+MY_P="${P/_/-}"
+
+inherit lua-single multiprocessing pax-utils php-ext-source-r3 postgres python-r1 ruby-ng
+
+DESCRIPTION="uWSGI server for Python web applications"
+HOMEPAGE="https://uwsgi-docs.readthedocs.io/en/latest/"
+SRC_URI="https://github.com/unbit/uwsgi/archive/${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 arm arm64 x86"
+
+UWSGI_PLUGINS_STD=(
+	ping cache carbon nagios rpc rrdtool
+	http ugreen signal syslog rsyslog
+	router_{uwsgi,redirect,basicauth,rewrite,http,cache,static,memcached,redis,hash,expires,metrics}
+	{core,fast,raw,ssl}router
+	redislog mongodblog log{file,socket}
+	spooler cheaper_busyness symcall
+	transformation_{chunked,gzip,offload,tofile}
+	zergpool
+)
+UWSGI_PLUGINS_OPT=(
+	alarm_{curl,xmpp} clock_{monotonic,realtime} curl_cron
+	dumbloop echo emperor_{amqp,pg,zeromq} forkptyrouter
+	geoip graylog2 legion_cache_fetch ldap log{crypto,pipe} notfound pam
+	rados router_{access,radius,spnego,xmldir}
+	sqlite ssi stats_pusher_statsd
+	systemd_logger transformation_toupper tuntap webdav xattr xslt zabbix
+)
+
+LANG_SUPPORT_SIMPLE=( cgi mono perl ) # plugins which can be built in the main build process
+LANG_SUPPORT_EXTENDED=( go lua php python ruby )
+
+# plugins to be ignored (for now):
+# cheaper_backlog2: example plugin
+# coroae: TODO
+# cplusplus: partially example code, needs explicit class
+# dummy: no idea
+# example: example plugin
+# exception_log: example plugin
+# *java*: TODO
+# v8: TODO
+# matheval: TODO
+IUSE="apache2 +caps debug +embedded expat jemalloc json +pcre +routing selinux +ssl +xml yajl yaml zeromq"
+
+for plugin in ${UWSGI_PLUGINS_STD[@]}; do IUSE="${IUSE} +uwsgi_plugins_${plugin}"; done
+for plugin in ${UWSGI_PLUGINS_OPT[@]}; do IUSE="${IUSE} uwsgi_plugins_${plugin}"; done
+IUSE="${IUSE} ${LANG_SUPPORT_SIMPLE[@]} ${LANG_SUPPORT_EXTENDED[@]}"
+
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	|| ( ${LANG_SUPPORT_SIMPLE[@]} ${LANG_SUPPORT_EXTENDED[@]} )
+	uwsgi_plugins_logcrypto? ( ssl )
+	uwsgi_plugins_sslrouter? ( ssl )
+	routing? ( pcre )
+	uwsgi_plugins_emperor_pg? ( ${POSTGRES_REQ_USE} )
+	uwsgi_plugins_emperor_zeromq? ( zeromq )
+	uwsgi_plugins_forkptyrouter? ( uwsgi_plugins_corerouter )
+	uwsgi_plugins_router_xmldir? ( xml !expat )
+	lua? ( ${LUA_REQUIRED_USE} )
+	python? ( ${PYTHON_REQUIRED_USE} )
+	expat? ( xml )
+"
+
+# Dependency notes:
+# - util-linux is required for libuuid when requesting zeromq support
+# - sys-devel/gcc[go] is needed for libgo.so
+#
+# Order:
+# 1. Unconditional
+# 2. General features
+# 3. Plugins
+# 4. Language/app support
+CDEPEND="
+	virtual/zlib:=
+	virtual/libcrypt:=
+	caps? ( sys-libs/libcap )
+	json? (
+		!yajl? ( dev-libs/jansson:= )
+		yajl? ( dev-libs/yajl )
+	)
+	pcre? ( dev-libs/libpcre:3 )
+	ssl? ( dev-libs/openssl:= )
+	xml? (
+		!expat? ( dev-libs/libxml2:= )
+		expat? ( dev-libs/expat )
+	)
+	yaml? ( dev-libs/libyaml )
+	zeromq? (
+		net-libs/zeromq
+		sys-apps/util-linux
+	)
+	uwsgi_plugins_alarm_curl? ( net-misc/curl )
+	uwsgi_plugins_alarm_xmpp? ( net-libs/gloox )
+	uwsgi_plugins_curl_cron? ( net-misc/curl )
+	uwsgi_plugins_emperor_pg? ( ${POSTGRES_DEP} )
+	uwsgi_plugins_geoip? ( dev-libs/geoip )
+	uwsgi_plugins_ldap? ( net-nds/openldap:= )
+	uwsgi_plugins_pam? ( sys-libs/pam )
+	uwsgi_plugins_sqlite? ( dev-db/sqlite:3 )
+	uwsgi_plugins_rados? ( sys-cluster/ceph )
+	uwsgi_plugins_router_access? ( sys-apps/tcp-wrappers )
+	uwsgi_plugins_router_spnego? ( virtual/krb5 )
+	uwsgi_plugins_systemd_logger? ( sys-apps/systemd )
+	uwsgi_plugins_webdav? ( dev-libs/libxml2:= )
+	uwsgi_plugins_xslt? ( dev-libs/libxslt )
+	go? ( sys-devel/gcc:=[go] )
+	lua? ( ${LUA_DEPS} )
+	mono? ( dev-lang/mono:= )
+	perl? ( dev-lang/perl:= )
+	php? (
+		php_targets_php8-2? ( dev-lang/php:8.2[embed] )
+	)
+	python? ( ${PYTHON_DEPS} )
+	ruby? ( $(ruby_implementations_depend) )
+"
+DEPEND="${CDEPEND}"
+RDEPEND="
+	${CDEPEND}
+	selinux? ( sec-policy/selinux-uwsgi )
+	uwsgi_plugins_rrdtool? ( net-analyzer/rrdtool )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.0.21-libphp-version.patch
+)
+
+pkg_setup() {
+	python_setup
+	use lua && lua-single_pkg_setup
+	use ruby && ruby-ng_pkg_setup
+	use uwsgi_plugins_emperor_pg && postgres_pkg_setup
+}
+
+src_unpack() {
+	default
+}
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e "s|'-O2', ||" \
+		-e "s|'-Werror', ||" \
+		-e "s|uc.get('plugin_dir')|uc.get('plugin_build_dir')|" \
+		uwsgiconfig.py || die "sed failed"
+
+	sed -i \
+		-e "s|/lib|/$(get_libdir)|" \
+		plugins/php/uwsgiplugin.py || die "sed failed"
+}
+
+src_configure() {
+	local embedded_plugins=()
+	local plugins=()
+	local malloc_impl="libc"
+	local json="false"
+	local xml="false"
+
+	local p
+	for p in ${UWSGI_PLUGINS_STD[@]} ${UWSGI_PLUGINS_OPT[@]} ; do
+		use uwsgi_plugins_${p} && embedded_plugins+=("${p}")
+	done
+	for p in ${LANG_SUPPORT_SIMPLE[@]} ; do
+		use ${p} && plugins+=("${p}")
+	done
+
+	# do not embed any plugins
+	if ! use embedded; then
+		plugins=( ${plugins[@]} ${embedded_plugins[@]} )
+		embedded_plugins=()
+	fi
+
+	# flatten the arrays
+	plugins=${plugins[@]}
+	embedded_plugins=${embedded_plugins[@]}
+
+	# rename some of the use flags, language plugins are always real plugins
+	plugins="${plugins/perl/psgi}"
+	plugins="${plugins/sqlite/sqlite3}"
+	embedded_plugins="${embedded_plugins/sqlite/sqlite3}"
+
+	# override defaults as requested by the user
+	if use xml; then
+		use expat && xml="expat" || xml="libxml2"
+	fi
+	if use json; then
+		use yajl && json="yajl" || json="jansson"
+	fi
+	use jemalloc && malloc_impl="jemalloc"
+
+	# prepare the buildconf for gentoo
+	cp "${FILESDIR}"/gentoo.buildconf buildconf/gentoo.ini || die
+	sed -i \
+		-e "s|VAR_XML|${xml}|" \
+		-e "s|VAR_YAML|$(usex yaml libyaml true)|" \
+		-e "s|VAR_JSON|${json}|" \
+		-e "s|VAR_SSL|$(usex ssl true false)|" \
+		-e "s|VAR_PCRE|$(usex pcre true false)|" \
+		-e "s|VAR_ZMQ|$(usex zeromq true false)|" \
+		-e "s|VAR_ROUTING|$(usex routing true false)|" \
+		-e "s|VAR_DEBUG|$(usex debug true false)|" \
+		-e "s|VAR_MALLOC|${malloc_impl}|" \
+		-e "s|VAR_PLUGINS|${plugins// /, }|" \
+		-e "s|VAR_PLUGIN_DIR|${EPREFIX}/usr/$(get_libdir)/uwsgi|" \
+		-e "s|VAR_BUILD_DIR|${T}/plugins|" \
+		-e "s|VAR_EMBEDDED|${embedded_plugins// /, }|" \
+		buildconf/gentoo.ini || die "sed failed"
+
+	if ! use caps; then
+		sed -i -e 's|sys/capability.h|DISABLED|' uwsgiconfig.py || die "sed failed"
+	fi
+
+	if ! use zeromq; then
+		sed -i -e 's|uuid/uuid.h|DISABLED|' uwsgiconfig.py || die "sed failed"
+	fi
+
+	if use uwsgi_plugins_emperor_pg ; then
+		sed -i \
+			-e "s|pg_config|${PG_CONFIG}|" \
+			plugins/emperor_pg/uwsgiplugin.py || die "sed failed"
+	fi
+}
+
+each_ruby_compile() {
+	cd "${WORKDIR}/${MY_P}" || die "sed failed"
+
+	UWSGICONFIG_RUBYPATH="${RUBY}" ${EPYTHON} uwsgiconfig.py --plugin plugins/rack gentoo rack_${RUBY##*/} || die "building plugin for ${RUBY} failed"
+	UWSGICONFIG_RUBYPATH="${RUBY}" ${EPYTHON} uwsgiconfig.py --plugin plugins/fiber gentoo fiber_${RUBY##*/}|| die "building fiber plugin for ${RUBY} failed"
+	UWSGICONFIG_RUBYPATH="${RUBY}" ${EPYTHON} uwsgiconfig.py --plugin plugins/rbthreads gentoo rbthreads_${RUBY##*/}|| die "building rbthreads plugin for ${RUBY} failed"
+}
+
+python_compile_plugins() {
+	local EPYV
+	local PYV
+	EPYV=${EPYTHON/.}
+	PYV=${EPYV/python}
+
+	${EPYTHON} uwsgiconfig.py --plugin plugins/python gentoo ${EPYV} || die "building plugin for ${EPYTHON} failed"
+	${EPYTHON} uwsgiconfig.py --plugin plugins/asyncio gentoo asyncio${PYV} || die "building plugin for asyncio-support in ${EPYTHON} failed"
+}
+
+python_install_symlinks() {
+	dosym uwsgi /usr/bin/uwsgi_${EPYTHON/.}
+}
+
+src_compile() {
+	mkdir -p "${T}/plugins" || die
+
+	export CPUCOUNT="$(makeopts_jobs)"
+
+	${EPYTHON} uwsgiconfig.py --build gentoo || die "building uwsgi failed"
+
+	if use go ; then
+		${EPYTHON} uwsgiconfig.py --plugin plugins/gccgo gentoo || die "building plugin for go failed"
+	fi
+
+	if use lua ; then
+		# setting the name for the pkg-config file to lua, since that is the name
+		# provided by the wrapper from Lua eclasses
+		UWSGICONFIG_LUAPC="lua" ${EPYTHON} uwsgiconfig.py --plugin plugins/lua gentoo || die "building plugin for lua failed"
+	fi
+
+	if use php ; then
+		for s in $(php_get_slots); do
+			UWSGICONFIG_PHPDIR="/usr/$(get_libdir)/${s}" ${EPYTHON} uwsgiconfig.py --plugin plugins/php gentoo ${s/.} || die "building plugin for ${s} failed"
+		done
+	fi
+
+	if use python ; then
+		python_foreach_impl python_compile_plugins
+	fi
+
+	if use ruby ; then
+		ruby-ng_src_compile
+	fi
+}
+
+src_install() {
+	dobin uwsgi
+	pax-mark m "${D}"/usr/bin/uwsgi
+
+	insinto /usr/$(get_libdir)/uwsgi
+	doins "${T}/plugins"/*.so
+
+	use cgi && dosym uwsgi /usr/bin/uwsgi_cgi
+	use go && dosym uwsgi /usr/bin/uwsgi_go
+	use lua && dosym uwsgi /usr/bin/uwsgi_lua
+	use mono && dosym uwsgi /usr/bin/uwsgi_mono
+	use perl && dosym uwsgi /usr/bin/uwsgi_psgi
+
+	if use php ; then
+		local s
+		for s in $(php_get_slots); do
+			dosym uwsgi /usr/bin/uwsgi_${s/.}
+		done
+	fi
+
+	if use python ; then
+		python_foreach_impl python_install_symlinks
+		python_foreach_impl python_domodule uwsgidecorators.py
+	fi
+
+	newinitd "${FILESDIR}"/uwsgi.initd-r7 uwsgi
+	newconfd "${FILESDIR}"/uwsgi.confd-r4 uwsgi
+	keepdir /etc/"${PN}".d
+	use uwsgi_plugins_spooler && keepdir /var/spool/"${PN}"
+}
+
+pkg_postinst() {
+	if use apache2 ; then
+		ewarn "As reported on bug #650776 [1], Apache module mod_proxy_uwsgi"
+		ewarn "is being transferred to upstream Apache since 2.4.30, see [2]."
+		ewarn "We therefore do not build them any more."
+		ewarn "    [1] https://bugs.gentoo.org/650776"
+		ewarn "    [2] https://github.com/unbit/uwsgi/issues/1636"
+	fi
+
+	elog "Append the following options to the uwsgi call to load the respective language plugin:"
+	use cgi    && elog "  '--plugins cgi' for cgi"
+	use lua    && elog "  '--plugins lua' for lua"
+	use mono   && elog "  '--plugins mono' for mono"
+	use perl   && elog "  '--plugins psgi' for perl"
+
+	if use php ; then
+		for s in $(php_get_slots); do
+			elog "  '--plugins ${s/.}' for ${s}"
+		done
+	fi
+
+	python_pkg_postinst() {
+		local EPYV
+		local PYV
+		EPYV=${EPYTHON/.}
+		PYV=${EPYV/python}
+
+		elog " "
+		elog "  '--plugins ${EPYV}' for ${EPYTHON}"
+		elog "  '--plugins ${EPYV},asyncio${PYV}' for asyncio support in ${EPYTHON}"
+	}
+
+	use python && python_foreach_impl python_pkg_postinst
+
+	if use ruby ; then
+		for ruby in $(ruby_get_use_implementations) ; do
+			elog "  '--plugins rack_${ruby/.}' for ${ruby}"
+			elog "  '--plugins fiber_${ruby/.}' for ${ruby} fibers"
+			elog "  '--plugins rbthreads_${ruby/.}' for ${ruby} rbthreads"
+		done
+	fi
+}
diff --git a/www-servers/uwsgi/uwsgi-2.0.27-r1.ebuild b/www-servers/uwsgi/uwsgi-2.0.27-r1.ebuild
new file mode 100644
index 000000000000..1d4c1b1826b1
--- /dev/null
+++ b/www-servers/uwsgi/uwsgi-2.0.27-r1.ebuild
@@ -0,0 +1,379 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Check the upstream uwsgi-2.0 branch, not master, for backports
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="threads(+)"
+
+RUBY_OPTIONAL="yes"
+USE_RUBY="ruby31 ruby32"
+
+PHP_EXT_INI="no"
+PHP_EXT_NAME="dummy"
+PHP_EXT_OPTIONAL_USE="php"
+USE_PHP="php8-2" # deps must be registered separately below
+
+POSTGRES_COMPAT=( 13 14 15 16 17 )
+
+MY_P="${P/_/-}"
+
+inherit flag-o-matic lua-single multiprocessing pax-utils php-ext-source-r3
+inherit postgres python-r1 ruby-ng
+
+DESCRIPTION="uWSGI server for Python web applications"
+HOMEPAGE="https://uwsgi-docs.readthedocs.io/en/latest/"
+SRC_URI="https://github.com/unbit/uwsgi/archive/${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 arm arm64 ~loong ~ppc ~ppc64 x86"
+
+UWSGI_PLUGINS_STD=(
+	ping cache carbon nagios rpc rrdtool
+	http ugreen signal syslog rsyslog
+	router_{uwsgi,redirect,basicauth,rewrite,http,cache,static,memcached,redis,hash,expires,metrics}
+	{core,fast,raw,ssl}router
+	redislog mongodblog log{file,socket}
+	spooler cheaper_busyness symcall
+	transformation_{chunked,gzip,offload,tofile}
+	zergpool
+)
+UWSGI_PLUGINS_OPT=(
+	alarm_{curl,xmpp} clock_{monotonic,realtime} curl_cron
+	dumbloop echo emperor_{amqp,pg,zeromq} forkptyrouter
+	geoip graylog2 legion_cache_fetch ldap log{crypto,pipe} notfound pam
+	rados router_{access,radius,spnego,xmldir}
+	sqlite ssi stats_pusher_statsd
+	systemd_logger transformation_toupper tuntap webdav xattr xslt zabbix
+)
+
+LANG_SUPPORT_SIMPLE=( cgi mono perl ) # plugins which can be built in the main build process
+LANG_SUPPORT_EXTENDED=( go lua php python ruby )
+
+# plugins to be ignored (for now):
+# cheaper_backlog2: example plugin
+# coroae: TODO
+# cplusplus: partially example code, needs explicit class
+# dummy: no idea
+# example: example plugin
+# exception_log: example plugin
+# *java*: TODO
+# v8: TODO
+# matheval: TODO
+IUSE="apache2 +caps debug +embedded expat jemalloc json +pcre +routing selinux +ssl +xml yajl yaml zeromq"
+
+for plugin in ${UWSGI_PLUGINS_STD[@]}; do IUSE="${IUSE} +uwsgi_plugins_${plugin}"; done
+for plugin in ${UWSGI_PLUGINS_OPT[@]}; do IUSE="${IUSE} uwsgi_plugins_${plugin}"; done
+IUSE="${IUSE} ${LANG_SUPPORT_SIMPLE[@]} ${LANG_SUPPORT_EXTENDED[@]}"
+
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	|| ( ${LANG_SUPPORT_SIMPLE[@]} ${LANG_SUPPORT_EXTENDED[@]} )
+	uwsgi_plugins_logcrypto? ( ssl )
+	uwsgi_plugins_sslrouter? ( ssl )
+	routing? ( pcre )
+	uwsgi_plugins_emperor_pg? ( ${POSTGRES_REQ_USE} )
+	uwsgi_plugins_emperor_zeromq? ( zeromq )
+	uwsgi_plugins_forkptyrouter? ( uwsgi_plugins_corerouter )
+	uwsgi_plugins_router_xmldir? ( xml !expat )
+	lua? ( ${LUA_REQUIRED_USE} )
+	python? ( ${PYTHON_REQUIRED_USE} )
+	expat? ( xml )
+"
+
+# Dependency notes:
+# - util-linux is required for libuuid when requesting zeromq support
+# - sys-devel/gcc[go] is needed for libgo.so
+#
+# Order:
+# 1. Unconditional
+# 2. General features
+# 3. Plugins
+# 4. Language/app support
+CDEPEND="
+	virtual/zlib:=
+	virtual/libcrypt:=
+	caps? ( sys-libs/libcap )
+	json? (
+		!yajl? ( dev-libs/jansson:= )
+		yajl? ( dev-libs/yajl )
+	)
+	pcre? ( dev-libs/libpcre2 )
+	ssl? ( dev-libs/openssl:= )
+	xml? (
+		!expat? ( dev-libs/libxml2:= )
+		expat? ( dev-libs/expat )
+	)
+	yaml? ( dev-libs/libyaml )
+	zeromq? (
+		net-libs/zeromq
+		sys-apps/util-linux
+	)
+	uwsgi_plugins_alarm_curl? ( net-misc/curl )
+	uwsgi_plugins_alarm_xmpp? ( net-libs/gloox )
+	uwsgi_plugins_curl_cron? ( net-misc/curl )
+	uwsgi_plugins_emperor_pg? ( ${POSTGRES_DEP} )
+	uwsgi_plugins_geoip? ( dev-libs/geoip )
+	uwsgi_plugins_ldap? ( net-nds/openldap:= )
+	uwsgi_plugins_pam? ( sys-libs/pam )
+	uwsgi_plugins_sqlite? ( dev-db/sqlite:3 )
+	uwsgi_plugins_rados? ( sys-cluster/ceph )
+	uwsgi_plugins_router_access? ( sys-apps/tcp-wrappers )
+	uwsgi_plugins_router_spnego? ( virtual/krb5 )
+	uwsgi_plugins_systemd_logger? ( sys-apps/systemd )
+	uwsgi_plugins_webdav? ( dev-libs/libxml2:= )
+	uwsgi_plugins_xslt? ( dev-libs/libxslt )
+	go? ( sys-devel/gcc:=[go] )
+	lua? ( ${LUA_DEPS} )
+	mono? ( dev-lang/mono:= )
+	perl? ( dev-lang/perl:= )
+	php? (
+		php_targets_php8-2? ( dev-lang/php:8.2[embed] )
+	)
+	python? ( ${PYTHON_DEPS} )
+	ruby? ( $(ruby_implementations_depend) )
+"
+DEPEND="${CDEPEND}"
+RDEPEND="
+	${CDEPEND}
+	selinux? ( sec-policy/selinux-uwsgi )
+	uwsgi_plugins_rrdtool? ( net-analyzer/rrdtool )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+pkg_setup() {
+	python_setup
+	use lua && lua-single_pkg_setup
+	use ruby && ruby-ng_pkg_setup
+	use uwsgi_plugins_emperor_pg && postgres_pkg_setup
+}
+
+src_unpack() {
+	default
+}
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e "s|'-O2', ||" \
+		-e "s|'-Werror', ||" \
+		-e "s|uc.get('plugin_dir')|uc.get('plugin_build_dir')|" \
+		uwsgiconfig.py || die "sed failed"
+
+	sed -i \
+		-e "s|/lib|/$(get_libdir)|" \
+		plugins/php/uwsgiplugin.py || die "sed failed"
+}
+
+src_configure() {
+	local embedded_plugins=()
+	local plugins=()
+	local malloc_impl="libc"
+	local json="false"
+	local xml="false"
+
+	local p
+	for p in ${UWSGI_PLUGINS_STD[@]} ${UWSGI_PLUGINS_OPT[@]} ; do
+		use uwsgi_plugins_${p} && embedded_plugins+=("${p}")
+	done
+	for p in ${LANG_SUPPORT_SIMPLE[@]} ; do
+		use ${p} && plugins+=("${p}")
+	done
+
+	# do not embed any plugins
+	if ! use embedded; then
+		plugins=( ${plugins[@]} ${embedded_plugins[@]} )
+		embedded_plugins=()
+	fi
+
+	# flatten the arrays
+	plugins=${plugins[@]}
+	embedded_plugins=${embedded_plugins[@]}
+
+	# rename some of the use flags, language plugins are always real plugins
+	plugins="${plugins/perl/psgi}"
+	plugins="${plugins/sqlite/sqlite3}"
+	embedded_plugins="${embedded_plugins/sqlite/sqlite3}"
+
+	# override defaults as requested by the user
+	if use xml; then
+		use expat && xml="expat" || xml="libxml2"
+	fi
+	if use json; then
+		use yajl && json="yajl" || json="jansson"
+	fi
+	use jemalloc && malloc_impl="jemalloc"
+
+	# Incompatible w/ C23 prototypes
+	append-cflags -std=gnu17
+
+	# prepare the buildconf for gentoo
+	cp "${FILESDIR}"/gentoo.buildconf buildconf/gentoo.ini || die
+	sed -i \
+		-e "s|VAR_XML|${xml}|" \
+		-e "s|VAR_YAML|$(usex yaml libyaml true)|" \
+		-e "s|VAR_JSON|${json}|" \
+		-e "s|VAR_SSL|$(usex ssl true false)|" \
+		-e "s|VAR_PCRE|$(usex pcre true false)|" \
+		-e "s|VAR_PCRE2|$(usex pcre true false)|" \
+		-e "s|VAR_ZMQ|$(usex zeromq true false)|" \
+		-e "s|VAR_ROUTING|$(usex routing true false)|" \
+		-e "s|VAR_DEBUG|$(usex debug true false)|" \
+		-e "s|VAR_MALLOC|${malloc_impl}|" \
+		-e "s|VAR_PLUGINS|${plugins// /, }|" \
+		-e "s|VAR_PLUGIN_DIR|${EPREFIX}/usr/$(get_libdir)/uwsgi|" \
+		-e "s|VAR_BUILD_DIR|${T}/plugins|" \
+		-e "s|VAR_EMBEDDED|${embedded_plugins// /, }|" \
+		buildconf/gentoo.ini || die "sed failed"
+
+	if ! use caps; then
+		sed -i -e 's|sys/capability.h|DISABLED|' uwsgiconfig.py || die "sed failed"
+	fi
+
+	if ! use zeromq; then
+		sed -i -e 's|uuid/uuid.h|DISABLED|' uwsgiconfig.py || die "sed failed"
+	fi
+
+	if use uwsgi_plugins_emperor_pg ; then
+		sed -i \
+			-e "s|pg_config|${PG_CONFIG}|" \
+			plugins/emperor_pg/uwsgiplugin.py || die "sed failed"
+	fi
+}
+
+each_ruby_compile() {
+	cd "${WORKDIR}/${MY_P}" || die "sed failed"
+
+	UWSGICONFIG_RUBYPATH="${RUBY}" ${EPYTHON} uwsgiconfig.py --plugin plugins/rack gentoo rack_${RUBY##*/} || die "building plugin for ${RUBY} failed"
+	UWSGICONFIG_RUBYPATH="${RUBY}" ${EPYTHON} uwsgiconfig.py --plugin plugins/fiber gentoo fiber_${RUBY##*/}|| die "building fiber plugin for ${RUBY} failed"
+	UWSGICONFIG_RUBYPATH="${RUBY}" ${EPYTHON} uwsgiconfig.py --plugin plugins/rbthreads gentoo rbthreads_${RUBY##*/}|| die "building rbthreads plugin for ${RUBY} failed"
+}
+
+python_compile_plugins() {
+	local EPYV
+	local PYV
+	EPYV=${EPYTHON/.}
+	PYV=${EPYV/python}
+
+	${EPYTHON} uwsgiconfig.py --plugin plugins/python gentoo ${EPYV} || die "building plugin for ${EPYTHON} failed"
+	${EPYTHON} uwsgiconfig.py --plugin plugins/asyncio gentoo asyncio${PYV} || die "building plugin for asyncio-support in ${EPYTHON} failed"
+}
+
+python_install_symlinks() {
+	dosym uwsgi /usr/bin/uwsgi_${EPYTHON/.}
+}
+
+src_compile() {
+	mkdir -p "${T}/plugins" || die
+
+	export CPUCOUNT="$(makeopts_jobs)"
+
+	${EPYTHON} uwsgiconfig.py --build gentoo || die "building uwsgi failed"
+
+	if use go ; then
+		${EPYTHON} uwsgiconfig.py --plugin plugins/gccgo gentoo || die "building plugin for go failed"
+	fi
+
+	if use lua ; then
+		# setting the name for the pkg-config file to lua, since that is the name
+		# provided by the wrapper from Lua eclasses
+		UWSGICONFIG_LUAPC="lua" ${EPYTHON} uwsgiconfig.py --plugin plugins/lua gentoo || die "building plugin for lua failed"
+	fi
+
+	if use php ; then
+		for s in $(php_get_slots); do
+			UWSGICONFIG_PHPDIR="/usr/$(get_libdir)/${s}" ${EPYTHON} uwsgiconfig.py --plugin plugins/php gentoo ${s/.} || die "building plugin for ${s} failed"
+		done
+	fi
+
+	if use python ; then
+		python_foreach_impl python_compile_plugins
+	fi
+
+	if use ruby ; then
+		ruby-ng_src_compile
+	fi
+}
+
+src_install() {
+	dobin uwsgi
+	pax-mark m "${D}"/usr/bin/uwsgi
+
+	insinto /usr/$(get_libdir)/uwsgi
+	doins "${T}/plugins"/*.so
+
+	use cgi && dosym uwsgi /usr/bin/uwsgi_cgi
+	use go && dosym uwsgi /usr/bin/uwsgi_go
+	use lua && dosym uwsgi /usr/bin/uwsgi_lua
+	use mono && dosym uwsgi /usr/bin/uwsgi_mono
+	use perl && dosym uwsgi /usr/bin/uwsgi_psgi
+
+	if use php ; then
+		local s
+		for s in $(php_get_slots); do
+			dosym uwsgi /usr/bin/uwsgi_${s/.}
+		done
+	fi
+
+	if use python ; then
+		python_foreach_impl python_install_symlinks
+		python_foreach_impl python_domodule uwsgidecorators.py
+	fi
+
+	newinitd "${FILESDIR}"/uwsgi.initd-r7 uwsgi
+	newconfd "${FILESDIR}"/uwsgi.confd-r4 uwsgi
+	keepdir /etc/"${PN}".d
+	use uwsgi_plugins_spooler && keepdir /var/spool/"${PN}"
+}
+
+pkg_postinst() {
+	if use apache2 ; then
+		ewarn "As reported on bug #650776 [1], Apache module mod_proxy_uwsgi"
+		ewarn "is being transferred to upstream Apache since 2.4.30, see [2]."
+		ewarn "We therefore do not build them any more."
+		ewarn "    [1] https://bugs.gentoo.org/650776"
+		ewarn "    [2] https://github.com/unbit/uwsgi/issues/1636"
+	fi
+
+	elog "Append the following options to the uwsgi call to load the respective language plugin:"
+	use cgi    && elog "  '--plugins cgi' for cgi"
+	use lua    && elog "  '--plugins lua' for lua"
+	use mono   && elog "  '--plugins mono' for mono"
+	use perl   && elog "  '--plugins psgi' for perl"
+
+	if use php ; then
+		for s in $(php_get_slots); do
+			elog "  '--plugins ${s/.}' for ${s}"
+		done
+	fi
+
+	python_pkg_postinst() {
+		local EPYV
+		local PYV
+		EPYV=${EPYTHON/.}
+		PYV=${EPYV/python}
+
+		elog " "
+		elog "  '--plugins ${EPYV}' for ${EPYTHON}"
+		elog "  '--plugins ${EPYV},asyncio${PYV}' for asyncio support in ${EPYTHON}"
+	}
+
+	use python && python_foreach_impl python_pkg_postinst
+
+	if use ruby ; then
+		for ruby in $(ruby_get_use_implementations) ; do
+			elog "  '--plugins rack_${ruby/.}' for ${ruby}"
+			elog "  '--plugins fiber_${ruby/.}' for ${ruby} fibers"
+			elog "  '--plugins rbthreads_${ruby/.}' for ${ruby} rbthreads"
+		done
+	fi
+}
diff --git a/www-servers/uwsgi/uwsgi-2.0.31.ebuild b/www-servers/uwsgi/uwsgi-2.0.31.ebuild
new file mode 100644
index 000000000000..ff12df917880
--- /dev/null
+++ b/www-servers/uwsgi/uwsgi-2.0.31.ebuild
@@ -0,0 +1,381 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Check the upstream uwsgi-2.0 branch, not master, for backports
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+PYTHON_COMPAT=( python3_{11..14} )
+PYTHON_REQ_USE="threads(+)"
+
+RUBY_OPTIONAL="yes"
+USE_RUBY="ruby32 ruby33 ruby34"
+
+PHP_EXT_INI="no"
+PHP_EXT_NAME="dummy"
+PHP_EXT_OPTIONAL_USE="php"
+USE_PHP="php8-2 php8-3 php8-4 php8-5" # deps must be registered separately below
+
+POSTGRES_COMPAT=( 13 14 15 16 17 )
+
+MY_P="${P/_/-}"
+
+inherit lua-single multiprocessing pax-utils php-ext-source-r3
+inherit postgres python-r1 ruby-ng
+
+DESCRIPTION="uWSGI server for Python web applications"
+HOMEPAGE="https://uwsgi-docs.readthedocs.io/en/latest/"
+SRC_URI="https://github.com/unbit/uwsgi/archive/${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 x86"
+
+UWSGI_PLUGINS_STD=(
+	ping cache carbon nagios rpc rrdtool
+	http ugreen signal syslog rsyslog
+	router_{uwsgi,redirect,basicauth,rewrite,http,cache,static,memcached,redis,hash,expires,metrics}
+	{core,fast,raw,ssl}router
+	redislog mongodblog log{file,socket}
+	spooler cheaper_busyness symcall
+	transformation_{chunked,gzip,offload,tofile}
+	zergpool
+)
+UWSGI_PLUGINS_OPT=(
+	alarm_{curl,xmpp} clock_{monotonic,realtime} curl_cron
+	dumbloop echo emperor_{amqp,pg,zeromq} forkptyrouter
+	geoip graylog2 legion_cache_fetch ldap log{crypto,pipe} notfound pam
+	rados router_{access,radius,spnego,xmldir}
+	sqlite ssi stats_pusher_statsd
+	systemd_logger transformation_toupper tuntap webdav xattr xslt zabbix
+)
+
+LANG_SUPPORT_SIMPLE=( cgi mono perl ) # plugins which can be built in the main build process
+LANG_SUPPORT_EXTENDED=( go lua php python ruby )
+
+# plugins to be ignored (for now):
+# cheaper_backlog2: example plugin
+# coroae: TODO
+# cplusplus: partially example code, needs explicit class
+# dummy: no idea
+# example: example plugin
+# exception_log: example plugin
+# *java*: TODO
+# v8: TODO
+# matheval: TODO
+IUSE="apache2 +caps debug +embedded expat json +pcre +routing selinux +ssl +xml yajl yaml zeromq"
+
+for plugin in ${UWSGI_PLUGINS_STD[@]}; do IUSE="${IUSE} +uwsgi_plugins_${plugin}"; done
+for plugin in ${UWSGI_PLUGINS_OPT[@]}; do IUSE="${IUSE} uwsgi_plugins_${plugin}"; done
+IUSE="${IUSE} ${LANG_SUPPORT_SIMPLE[@]} ${LANG_SUPPORT_EXTENDED[@]}"
+
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	|| ( ${LANG_SUPPORT_SIMPLE[@]} ${LANG_SUPPORT_EXTENDED[@]} )
+	uwsgi_plugins_logcrypto? ( ssl )
+	uwsgi_plugins_sslrouter? ( ssl )
+	routing? ( pcre )
+	uwsgi_plugins_emperor_pg? ( ${POSTGRES_REQ_USE} )
+	uwsgi_plugins_emperor_zeromq? ( zeromq )
+	uwsgi_plugins_forkptyrouter? ( uwsgi_plugins_corerouter )
+	uwsgi_plugins_router_xmldir? ( xml !expat )
+	lua? ( ${LUA_REQUIRED_USE} )
+	python? ( ${PYTHON_REQUIRED_USE} )
+	expat? ( xml )
+"
+
+# Dependency notes:
+# - util-linux is required for libuuid when requesting zeromq support
+# - sys-devel/gcc[go] is needed for libgo.so
+#
+# Order:
+# 1. Unconditional
+# 2. General features
+# 3. Plugins
+# 4. Language/app support
+CDEPEND="
+	virtual/zlib:=
+	virtual/libcrypt:=
+	caps? ( sys-libs/libcap )
+	json? (
+		!yajl? ( dev-libs/jansson:= )
+		yajl? ( dev-libs/yajl )
+	)
+	pcre? ( dev-libs/libpcre2 )
+	ssl? ( dev-libs/openssl:= )
+	xml? (
+		!expat? ( dev-libs/libxml2:= )
+		expat? ( dev-libs/expat )
+	)
+	yaml? ( dev-libs/libyaml )
+	zeromq? (
+		net-libs/zeromq
+		sys-apps/util-linux
+	)
+	uwsgi_plugins_alarm_curl? ( net-misc/curl )
+	uwsgi_plugins_alarm_xmpp? ( net-libs/gloox )
+	uwsgi_plugins_curl_cron? ( net-misc/curl )
+	uwsgi_plugins_emperor_pg? ( ${POSTGRES_DEP} )
+	uwsgi_plugins_geoip? ( dev-libs/geoip )
+	uwsgi_plugins_ldap? ( net-nds/openldap:= )
+	uwsgi_plugins_pam? ( sys-libs/pam )
+	uwsgi_plugins_sqlite? ( dev-db/sqlite:3 )
+	uwsgi_plugins_rados? ( sys-cluster/ceph )
+	uwsgi_plugins_router_access? ( sys-apps/tcp-wrappers )
+	uwsgi_plugins_router_spnego? ( virtual/krb5 )
+	uwsgi_plugins_systemd_logger? ( sys-apps/systemd )
+	uwsgi_plugins_webdav? ( dev-libs/libxml2:= )
+	uwsgi_plugins_xslt? ( dev-libs/libxslt )
+	go? ( sys-devel/gcc:=[go] )
+	lua? ( ${LUA_DEPS} )
+	mono? ( dev-lang/mono:= )
+	perl? ( dev-lang/perl:= )
+	php? (
+		php_targets_php8-2? ( dev-lang/php:8.2[embed] )
+		php_targets_php8-3? ( dev-lang/php:8.3[embed] )
+		php_targets_php8-4? ( dev-lang/php:8.4[embed] )
+		php_targets_php8-5? ( dev-lang/php:8.5[embed] )
+	)
+	python? ( ${PYTHON_DEPS} )
+	ruby? ( $(ruby_implementations_depend) )
+"
+DEPEND="${CDEPEND}"
+RDEPEND="
+	${CDEPEND}
+	selinux? ( sec-policy/selinux-uwsgi )
+	uwsgi_plugins_rrdtool? ( net-analyzer/rrdtool )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+pkg_setup() {
+	python_setup
+	use lua && lua-single_pkg_setup
+	use ruby && ruby-ng_pkg_setup
+	use uwsgi_plugins_emperor_pg && postgres_pkg_setup
+}
+
+src_unpack() {
+	default
+}
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e "s|'-O2', ||" \
+		-e "s|'-Werror', ||" \
+		-e "s|uc.get('plugin_dir')|uc.get('plugin_build_dir')|" \
+		uwsgiconfig.py || die "sed failed"
+
+	sed -i \
+		-e "s|/lib|/$(get_libdir)|" \
+		plugins/php/uwsgiplugin.py || die "sed failed"
+}
+
+src_configure() {
+	local embedded_plugins=()
+	local plugins=()
+	local malloc_impl="libc"
+	local json="false"
+	local xml="false"
+
+	local p
+	for p in ${UWSGI_PLUGINS_STD[@]} ${UWSGI_PLUGINS_OPT[@]} ; do
+		use uwsgi_plugins_${p} && embedded_plugins+=("${p}")
+	done
+	for p in ${LANG_SUPPORT_SIMPLE[@]} ; do
+		use ${p} && plugins+=("${p}")
+	done
+
+	# do not embed any plugins
+	if ! use embedded; then
+		plugins=( ${plugins[@]} ${embedded_plugins[@]} )
+		embedded_plugins=()
+	fi
+
+	# flatten the arrays
+	plugins=${plugins[@]}
+	embedded_plugins=${embedded_plugins[@]}
+
+	# rename some of the use flags, language plugins are always real plugins
+	plugins="${plugins/perl/psgi}"
+	plugins="${plugins/sqlite/sqlite3}"
+	embedded_plugins="${embedded_plugins/sqlite/sqlite3}"
+
+	# override defaults as requested by the user
+	if use xml; then
+		use expat && xml="expat" || xml="libxml2"
+	fi
+	if use json; then
+		use yajl && json="yajl" || json="jansson"
+	fi
+
+	# prepare the buildconf for gentoo
+	cp "${FILESDIR}"/gentoo.buildconf buildconf/gentoo.ini || die
+	sed -i \
+		-e "s|VAR_XML|${xml}|" \
+		-e "s|VAR_YAML|$(usex yaml libyaml true)|" \
+		-e "s|VAR_JSON|${json}|" \
+		-e "s|VAR_SSL|$(usex ssl true false)|" \
+		-e "s|VAR_PCRE|$(usex pcre true false)|" \
+		-e "s|VAR_PCRE2|$(usex pcre true false)|" \
+		-e "s|VAR_ZMQ|$(usex zeromq true false)|" \
+		-e "s|VAR_ROUTING|$(usex routing true false)|" \
+		-e "s|VAR_DEBUG|$(usex debug true false)|" \
+		-e "s|VAR_MALLOC|${malloc_impl}|" \
+		-e "s|VAR_PLUGINS|${plugins// /, }|" \
+		-e "s|VAR_PLUGIN_DIR|${EPREFIX}/usr/$(get_libdir)/uwsgi|" \
+		-e "s|VAR_BUILD_DIR|${T}/plugins|" \
+		-e "s|VAR_EMBEDDED|${embedded_plugins// /, }|" \
+		buildconf/gentoo.ini || die "sed failed"
+
+	if ! use caps; then
+		sed -i -e 's|sys/capability.h|DISABLED|' uwsgiconfig.py || die "sed failed"
+	fi
+
+	if ! use zeromq; then
+		sed -i -e 's|uuid/uuid.h|DISABLED|' uwsgiconfig.py || die "sed failed"
+	fi
+
+	if use uwsgi_plugins_emperor_pg ; then
+		sed -i \
+			-e "s|pg_config|${PG_CONFIG}|" \
+			plugins/emperor_pg/uwsgiplugin.py || die "sed failed"
+	fi
+}
+
+each_ruby_compile() {
+	cd "${WORKDIR}/${MY_P}" || die "sed failed"
+
+	UWSGICONFIG_RUBYPATH="${RUBY}" ${EPYTHON} uwsgiconfig.py --plugin plugins/rack gentoo rack_${RUBY##*/} || die "building plugin for ${RUBY} failed"
+	UWSGICONFIG_RUBYPATH="${RUBY}" ${EPYTHON} uwsgiconfig.py --plugin plugins/fiber gentoo fiber_${RUBY##*/}|| die "building fiber plugin for ${RUBY} failed"
+	UWSGICONFIG_RUBYPATH="${RUBY}" ${EPYTHON} uwsgiconfig.py --plugin plugins/rbthreads gentoo rbthreads_${RUBY##*/}|| die "building rbthreads plugin for ${RUBY} failed"
+}
+
+python_compile_plugins() {
+	local EPYV
+	local PYV
+	EPYV=${EPYTHON/.}
+	PYV=${EPYV/python}
+
+	${EPYTHON} uwsgiconfig.py --plugin plugins/python gentoo ${EPYV} || die "building plugin for ${EPYTHON} failed"
+	${EPYTHON} uwsgiconfig.py --plugin plugins/asyncio gentoo asyncio${PYV} || die "building plugin for asyncio-support in ${EPYTHON} failed"
+}
+
+python_install_symlinks() {
+	dosym uwsgi /usr/bin/uwsgi_${EPYTHON/.}
+}
+
+src_compile() {
+	mkdir -p "${T}/plugins" || die
+
+	export CPUCOUNT="$(makeopts_jobs)"
+
+	${EPYTHON} uwsgiconfig.py --build gentoo || die "building uwsgi failed"
+
+	if use go ; then
+		${EPYTHON} uwsgiconfig.py --plugin plugins/gccgo gentoo || die "building plugin for go failed"
+	fi
+
+	if use lua ; then
+		# setting the name for the pkg-config file to lua, since that is the name
+		# provided by the wrapper from Lua eclasses
+		UWSGICONFIG_LUAPC="lua" ${EPYTHON} uwsgiconfig.py --plugin plugins/lua gentoo || die "building plugin for lua failed"
+	fi
+
+	if use php ; then
+		local s
+		for s in $(php_get_slots); do
+			UWSGICONFIG_PHPDIR="/usr/$(get_libdir)/${s}" ${EPYTHON} uwsgiconfig.py --plugin plugins/php gentoo ${s/.} || die "building plugin for ${s} failed"
+		done
+	fi
+
+	if use python ; then
+		python_foreach_impl python_compile_plugins
+	fi
+
+	if use ruby ; then
+		ruby-ng_src_compile
+	fi
+}
+
+src_install() {
+	dobin uwsgi
+	pax-mark m "${D}"/usr/bin/uwsgi
+
+	insinto /usr/$(get_libdir)/uwsgi
+	doins "${T}/plugins"/*.so
+
+	use cgi && dosym uwsgi /usr/bin/uwsgi_cgi
+	use go && dosym uwsgi /usr/bin/uwsgi_go
+	use lua && dosym uwsgi /usr/bin/uwsgi_lua
+	use mono && dosym uwsgi /usr/bin/uwsgi_mono
+	use perl && dosym uwsgi /usr/bin/uwsgi_psgi
+
+	if use php ; then
+		local s
+		for s in $(php_get_slots); do
+			dosym uwsgi /usr/bin/uwsgi_${s/.}
+		done
+	fi
+
+	if use python ; then
+		python_foreach_impl python_install_symlinks
+		python_foreach_impl python_domodule uwsgidecorators.py
+	fi
+
+	newinitd "${FILESDIR}"/uwsgi.initd-r7 uwsgi
+	newconfd "${FILESDIR}"/uwsgi.confd-r4 uwsgi
+	keepdir /etc/"${PN}".d
+	use uwsgi_plugins_spooler && keepdir /var/spool/"${PN}"
+}
+
+pkg_postinst() {
+	if use apache2 ; then
+		ewarn "As reported on bug #650776 [1], Apache module mod_proxy_uwsgi"
+		ewarn "is being transferred to upstream Apache since 2.4.30, see [2]."
+		ewarn "We therefore do not build them any more."
+		ewarn "    [1] https://bugs.gentoo.org/650776"
+		ewarn "    [2] https://github.com/unbit/uwsgi/issues/1636"
+	fi
+
+	elog "Append the following options to the uwsgi call to load the respective language plugin:"
+	use cgi    && elog "  '--plugins cgi' for cgi"
+	use lua    && elog "  '--plugins lua' for lua"
+	use mono   && elog "  '--plugins mono' for mono"
+	use perl   && elog "  '--plugins psgi' for perl"
+
+	if use php ; then
+		local s
+		for s in $(php_get_slots); do
+			elog "  '--plugins ${s/.}' for ${s}"
+		done
+	fi
+
+	python_pkg_postinst() {
+		local EPYV
+		local PYV
+		EPYV=${EPYTHON/.}
+		PYV=${EPYV/python}
+
+		elog " "
+		elog "  '--plugins ${EPYV}' for ${EPYTHON}"
+		elog "  '--plugins ${EPYV},asyncio${PYV}' for asyncio support in ${EPYTHON}"
+	}
+
+	use python && python_foreach_impl python_pkg_postinst
+
+	if use ruby ; then
+		local ruby
+		for ruby in $(ruby_get_use_implementations) ; do
+			elog "  '--plugins rack_${ruby/.}' for ${ruby}"
+			elog "  '--plugins fiber_${ruby/.}' for ${ruby} fibers"
+			elog "  '--plugins rbthreads_${ruby/.}' for ${ruby} rbthreads"
+		done
+	fi
+}
diff --git a/www-servers/vinyl-cache/Manifest b/www-servers/vinyl-cache/Manifest
new file mode 100644
index 000000000000..8dcf2a278be0
--- /dev/null
+++ b/www-servers/vinyl-cache/Manifest
@@ -0,0 +1,4 @@
+DIST varnish-8.0.1.tgz 4309436 BLAKE2B 802368affb3706968d2a5538bcf560d5875e9856046fb2a0e6cd2d110394ec6e2efd111d0284eb5f40b09eaac9686e249ae9a140b8ddea06e3e188db1842a0ec SHA512 6ca63160e068d4ae6aca9c7f2e848aabc5fe327bae18b3a008e573a27c0ed2ac958740fe129477cb384dded94b1c93cbd54efec5fd6f17098c23263d11ffc9ff
+DIST varnish-8.0.2.tgz 4314061 BLAKE2B df9505c54815ae86d07e997ead7af5608969dccd3b91bf154fa6fa0591a3deee94b7cf4446c4c0d1e77ed5d2cb02d9ec812046f1f6db65a9df46cde911088fd4 SHA512 2eaac96d7121a750e6f18a271728d1fc7f7e8f079af38d450c8d395d6653942ac8cf970fa3c64f2ee7ea056617ebb5092cfe58b255dece6e948ce1308f602065
+DIST vinyl-cache-9.0.0.tgz 6353519 BLAKE2B 6cf36a66e74037a9b11d5048e0797fa2b4d6665d9463363d7d9816854d2a58744c00f684f6e274600459e8c124cfeff8405015e378c7ce12497ba65051331adb SHA512 c7be55b13609a0842bb938af39203b77a1ed17257e18f7ea29b89760687317c135dee48b8b2936561c00aeabe321e503b209b5b9af876588dd824c6c6847d17e
+DIST vinyl-cache-9.0.1.tgz 6355153 BLAKE2B 4bb7b6003197be7e6363ae8e7523bc5242802a6a8b84a0782f7e4bea929ec8fb6c8ac5e849a717b650844a30ef446f07b3b83fca981af9c7a3a83d79eacb7ad4 SHA512 6aaa936e3bce6e195d469642949bf35a76cd04e6bcdc6ff1bc608ce2b37c871cab50f779918331658aefb853e78a71336ac5cf95e49524807a2929337940ab8e
diff --git a/www-servers/vinyl-cache/files/varnish-8.0.0-configure-make-python-output-match-autotools.patch b/www-servers/vinyl-cache/files/varnish-8.0.0-configure-make-python-output-match-autotools.patch
new file mode 100644
index 000000000000..abbfe79d8214
--- /dev/null
+++ b/www-servers/vinyl-cache/files/varnish-8.0.0-configure-make-python-output-match-autotools.patch
@@ -0,0 +1,45 @@
+# https://bugs.gentoo.org/882725
+# https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/pulls/4451
+
+From 3565765b8b2fbc854432fa0ce7b5ca2facc0a7b8 Mon Sep 17 00:00:00 2001
+From: Brett A C Sheffield <bacs@librecast.net>
+Date: Mon, 16 Feb 2026 19:50:32 +0100
+Subject: [PATCH] configure: make python output match autotools
+
+When calling out from configure to python to check compiler flags, make
+output from wflags.py consistent with the rest of autotools output
+rather than printing scary compiler errors.
+---
+ wflags.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/wflags.py b/wflags.py
+index 1c1da40d0..da799f9cd 100644
+--- a/wflags.py
++++ b/wflags.py
+@@ -108,19 +108,19 @@ def main():
+ 
+     use_flags = []
+     for i in DESIRABLE_OPTIONS + DESIRABLE_WFLAGS + UNDESIRABLE_WFLAGS:
++        sys.stderr.write("checking whether C compiler accepts " + i + "... ")
+         j = cc(compiler, i, obj_file.name, src_file.name)
+         if not j:
+             use_flags.append(i)
++            sys.stderr.write("yes\n")
+         else:
+-            sys.stderr.write(compiler + " cannot " + i + '\n')
++            sys.stderr.write(" no\n")
+             if b'error: unrecognized command line option' in j:
+                 # LLVM
+                 pass
+             elif b'warning: unknown warning option' in j:
+                 # GCC
+                 pass
+-            else:
+-                sys.stderr.write("\n\t" + j.decode('utf8') + '\n')
+     print(" ".join(use_flags))
+ 
+ if __name__ == "__main__":
+-- 
+2.52.0
+
diff --git a/www-servers/vinyl-cache/files/varnishd.confd-r4 b/www-servers/vinyl-cache/files/varnishd.confd-r4
new file mode 100644
index 000000000000..1a18b648541a
--- /dev/null
+++ b/www-servers/vinyl-cache/files/varnishd.confd-r4
@@ -0,0 +1,18 @@
+# /etc/conf.d/varnishd
+
+VARNISHD="/usr/sbin/varnishd"
+VARNISHADM="/usr/bin/varnishadm"
+
+#CONFIGFILES="/etc/varnish/${SVCNAME}.vcl"
+CONFIGFILE="/etc/varnish/default.vcl"
+
+# Listen on 127.0.0.1:8080 and connect to backend 127.0.0.1:80
+#VARNISHD_OPTS="-a 127.0.0.1:8080 -a 127.0.0.1:8080"
+
+# Alternatively, don't listen to a backend
+VARNISHD_OPTS="-a 127.0.0.1:8080"
+
+# You may need to increase the number of open files (-n)
+# and the maximum amount off locked memory (-l)
+# See bug #459142
+#rc_ulimit="-n 32786 -l 82000"
diff --git a/www-servers/vinyl-cache/files/varnishd.initd-r4 b/www-servers/vinyl-cache/files/varnishd.initd-r4
new file mode 100644
index 000000000000..4bc5061d2356
--- /dev/null
+++ b/www-servers/vinyl-cache/files/varnishd.initd-r4
@@ -0,0 +1,77 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+VARNISHD_PID=${VARNISHD_PID:-/run/${SVCNAME}.pid}
+CONFIGFILES="${CONFIGFILE:-/etc/varnish/default.vcl}"
+
+command="${VARNISHD:-/usr/sbin/varnishd}"
+command_args="-j unix,user=varnish -P ${VARNISHD_PID} -f ${CONFIGFILE} ${VARNISHD_OPTS}"
+pidfile="${VARNISHD_PID}"
+
+extra_commands="configtest"
+extra_started_commands="reload"
+
+description_configtest="Run syntax tests for configuration files."
+description_reload="Reloads the configuration."
+
+depend() {
+	need net
+}
+
+configtest() {
+	ebegin "Checking ${SVCNAME} configuration"
+	checkconfig
+	eend $?
+}
+
+checkconfig() {
+	${VARNISHD} -C -f ${CONFIGFILE} >/dev/null 2>&1
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eerror "${SVCNAME} has detected an error in your setup:"
+		${VARNISHD} -C -f ${CONFIGFILE}
+	fi
+
+	return $ret
+}
+
+start_pre() {
+	checkconfig || return 1
+}
+
+stop_pre() {
+	if [ "${RC_CMD}" = "restart" ]; then
+		checkconfig || return 1
+	fi
+}
+
+reload() {
+	checkconfig || return 1
+
+	ebegin "Reloading varnish"
+
+	$VARNISHADM vcl.list >/dev/null 2>&1
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eerror "${SVCNAME} cannot list configuration"
+		return 1
+	fi
+
+	new_config="reload_$(date +%FT%H:%M:%S)"
+	$VARNISHADM vcl.load $new_config $CONFIGFILE >/dev/null 2>&1
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eerror "${SVCNAME} cannot load configuration"
+		return 1
+	fi
+
+	$VARNISHADM vcl.use $new_config >/dev/null 2>&1
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eerror "${SVCNAME} cannot switch configuration"
+		return 1
+	fi
+
+	eend 0
+}
diff --git a/www-servers/vinyl-cache/files/varnishd.logrotate-r2 b/www-servers/vinyl-cache/files/varnishd.logrotate-r2
new file mode 100644
index 000000000000..e697e428f3dd
--- /dev/null
+++ b/www-servers/vinyl-cache/files/varnishd.logrotate-r2
@@ -0,0 +1,31 @@
+/var/log/varnish/varnishncsa.log {
+	daily
+	rotate 31
+	copytruncate
+	dateext
+	dateyesterday
+	delaycompress
+	compress
+	notifempty
+	missingok
+
+	prerotate
+		/etc/init.d/varnishncsa -q status && /etc/init.d/varnishncsa -q flush
+	endscript
+}
+
+/var/log/varnish/varnishlog.log {
+	daily
+	rotate 31
+	copytruncate
+	dateext
+	dateyesterday
+	delaycompress
+	compress
+	notifempty
+	missingok
+
+	prerotate
+		/etc/init.d/varnishlog -q status && /etc/init.d/varnishlog -q flush
+	endscript
+}
diff --git a/www-servers/vinyl-cache/files/varnishd.service b/www-servers/vinyl-cache/files/varnishd.service
new file mode 100644
index 000000000000..a45f1e247839
--- /dev/null
+++ b/www-servers/vinyl-cache/files/varnishd.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Varnish is a high-performance HTTP accelerator
+After=network.target
+
+[Service]
+Type=forking
+LimitNOFILE=32786
+LimitMEMLOCK=82000
+PIDFile=/var/run/varnishd.pid
+ExecStart=/usr/sbin/varnishd -a 0.0.0.0:80 -P /var/run/varnishd.pid
+
+#If you wish to use a config file, then use the following ExecStart line
+#ExecStart=/usr/sbin/varnishd -a 0.0.0.0:80 -f /etc/varnish/default.vcl -P /var/run/varnishd.pid
+
+[Install]
+WantedBy=multi-user.target
diff --git a/www-servers/vinyl-cache/files/varnishlog.confd b/www-servers/vinyl-cache/files/varnishlog.confd
new file mode 100644
index 000000000000..d7358b1dc898
--- /dev/null
+++ b/www-servers/vinyl-cache/files/varnishlog.confd
@@ -0,0 +1,3 @@
+# /etc/conf.d/varnishlog
+
+VARNISHLOG_OPTS="-a -w /var/log/varnish/varnishlog.log"
diff --git a/www-servers/vinyl-cache/files/varnishlog.initd b/www-servers/vinyl-cache/files/varnishlog.initd
new file mode 100644
index 000000000000..ebbf52ec4da3
--- /dev/null
+++ b/www-servers/vinyl-cache/files/varnishlog.initd
@@ -0,0 +1,31 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+VARNISHLOG_PID=${VARNISHLOG_PID:-/run/${SVCNAME}.pid}
+
+command="${VARNISHLOG:-/usr/bin/varnishlog}"
+command_args="-D -P ${VARNISHLOG_PID} ${VARNISHLOG_OPTS}"
+pidfile="${VARNISHLOG_PID}"
+
+extra_started_commands="reload rotate flush"
+
+description_rotate="Rotate the log file"
+description_flush="Flush any outstanding transactions"
+
+rotate() {
+	ebegin "Rotating log file"
+	start-stop-daemon -p ${VARNISHLOG_PID} -s SIGHUP
+	eend $?
+}
+
+flush() {
+	ebegin "Flushing any outstanding transactions"
+	start-stop-daemon -p ${VARNISHLOG_PID} -s SIGUSR1
+	eend $?
+}
+
+reload() {
+	flush
+	rotate
+}
diff --git a/www-servers/vinyl-cache/files/varnishncsa.confd b/www-servers/vinyl-cache/files/varnishncsa.confd
new file mode 100644
index 000000000000..f3112fdd532a
--- /dev/null
+++ b/www-servers/vinyl-cache/files/varnishncsa.confd
@@ -0,0 +1,3 @@
+# /etc/conf.d/varnishncsa
+
+VARNISHNCSA_OPTS="-a -w /var/log/varnish/${SVCNAME}.log"
diff --git a/www-servers/vinyl-cache/files/varnishncsa.initd b/www-servers/vinyl-cache/files/varnishncsa.initd
new file mode 100644
index 000000000000..e9c0001736eb
--- /dev/null
+++ b/www-servers/vinyl-cache/files/varnishncsa.initd
@@ -0,0 +1,31 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+VARNISHNCSA_PID=${VARNISHNCSA_PID:-/run/${SVCNAME}.pid}
+
+command="${VARNISHNCSA:-/usr/bin/varnishncsa}"
+command_args="-D -P ${VARNISHNCSA_PID} ${VARNISHNCSA_OPTS}"
+pidfile="${VARNISHNCSA_PID}"
+
+extra_started_commands="reload rotate flush"
+
+description_rotate="Rotate the log file"
+description_flush="Flush any outstanding transactions"
+
+rotate() {
+	ebegin "Rotating log file"
+	start-stop-daemon -p ${VARNISHNCSA_PID} -s SIGHUP
+	eend $?
+}
+
+flush() {
+	ebegin "Flushing any outstanding transactions"
+	start-stop-daemon -p ${VARNISHNCSA_PID} -s SIGUSR1
+	eend $?
+}
+
+reload() {
+	flush
+	rotate
+}
diff --git a/www-servers/vinyl-cache/files/vinyld.confd b/www-servers/vinyl-cache/files/vinyld.confd
new file mode 100644
index 000000000000..d50f21d041a5
--- /dev/null
+++ b/www-servers/vinyl-cache/files/vinyld.confd
@@ -0,0 +1,20 @@
+# /etc/conf.d/vinyld
+
+VINYLD="/usr/sbin/vinyld"
+VINYLADM="/usr/bin/vinyladm"
+
+CONFIGFILE="/etc/vinyl-cache/default.vcl"
+
+# Listen on localhost:8080 and connect to backend localhost:80
+#VINYLD_OPTS="-a localhost:8080 -a localhost:8080"
+
+# Alternatively, don't listen to a backend
+VINYLD_OPTS="-a localhost:8080"
+
+# Listen on all interfaces
+#VINYLD_OPTS="-a [::]:8080"
+
+# You may need to increase the number of open files (-n)
+# and the maximum amount off locked memory (-l)
+# See bug #459142
+#rc_ulimit="-n 32786 -l 82000"
diff --git a/www-servers/vinyl-cache/files/vinyld.initd b/www-servers/vinyl-cache/files/vinyld.initd
new file mode 100644
index 000000000000..81b18dec5883
--- /dev/null
+++ b/www-servers/vinyl-cache/files/vinyld.initd
@@ -0,0 +1,77 @@
+#!/sbin/openrc-run
+# Copyright 1999-2026 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+VINYLD_PID=${VINYLD_PID:-/run/${SVCNAME}.pid}
+CONFIGFILES="${CONFIGFILE:-/etc/vinyl/default.vcl}"
+
+command="${VINYLD:-/usr/sbin/vinyld}"
+command_args="-j unix,user=vinyl -P ${VINYLD_PID} -f ${CONFIGFILE} ${VINYLD_OPTS}"
+pidfile="${VINYLD_PID}"
+
+extra_commands="configtest"
+extra_started_commands="reload"
+
+description_configtest="Run syntax tests for configuration files."
+description_reload="Reloads the configuration."
+
+depend() {
+	need net
+}
+
+configtest() {
+	ebegin "Checking ${SVCNAME} configuration"
+	checkconfig
+	eend $?
+}
+
+checkconfig() {
+	${VINYLD} -C -f ${CONFIGFILE} >/dev/null 2>&1
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eerror "${SVCNAME} has detected an error in your setup:"
+		${VINYLD} -C -f ${CONFIGFILE}
+	fi
+
+	return $ret
+}
+
+start_pre() {
+	checkconfig || return 1
+}
+
+stop_pre() {
+	if [ "${RC_CMD}" = "restart" ]; then
+		checkconfig || return 1
+	fi
+}
+
+reload() {
+	checkconfig || return 1
+
+	ebegin "Reloading vinyl"
+
+	$VINYLADM vcl.list >/dev/null 2>&1
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eerror "${SVCNAME} cannot list configuration"
+		return 1
+	fi
+
+	new_config="reload_$(date +%FT%H:%M:%S)"
+	$VINYLADM vcl.load $new_config $CONFIGFILE >/dev/null 2>&1
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eerror "${SVCNAME} cannot load configuration"
+		return 1
+	fi
+
+	$VINYLADM vcl.use $new_config >/dev/null 2>&1
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eerror "${SVCNAME} cannot switch configuration"
+		return 1
+	fi
+
+	eend 0
+}
diff --git a/www-servers/vinyl-cache/files/vinyld.logrotate b/www-servers/vinyl-cache/files/vinyld.logrotate
new file mode 100644
index 000000000000..863d62766937
--- /dev/null
+++ b/www-servers/vinyl-cache/files/vinyld.logrotate
@@ -0,0 +1,31 @@
+/var/log/vinyl/vinylncsa.log {
+	daily
+	rotate 31
+	copytruncate
+	dateext
+	dateyesterday
+	delaycompress
+	compress
+	notifempty
+	missingok
+
+	prerotate
+		/etc/init.d/vinylncsa -q status && /etc/init.d/vinylncsa -q flush
+	endscript
+}
+
+/var/log/vinyl/vinyllog.log {
+	daily
+	rotate 31
+	copytruncate
+	dateext
+	dateyesterday
+	delaycompress
+	compress
+	notifempty
+	missingok
+
+	prerotate
+		/etc/init.d/vinyllog -q status && /etc/init.d/vinyllog -q flush
+	endscript
+}
diff --git a/www-servers/vinyl-cache/files/vinyld.service b/www-servers/vinyl-cache/files/vinyld.service
new file mode 100644
index 000000000000..e7fdaa503b2d
--- /dev/null
+++ b/www-servers/vinyl-cache/files/vinyld.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=A high-performance caching HTTP reverse proxy
+After=network.target
+
+[Service]
+Type=forking
+LimitNOFILE=32786
+LimitMEMLOCK=82000
+PIDFile=/var/run/vinyld.pid
+ExecStart=/usr/sbin/vinyld -a 0.0.0.0:80 -P /var/run/vinyld.pid
+
+#If you wish to use a config file, then use the following ExecStart line
+#ExecStart=/usr/sbin/vinyld -a 0.0.0.0:80 -f /etc/vinyl-cache/default.vcl -P /var/run/vinyld.pid
+
+[Install]
+WantedBy=multi-user.target
diff --git a/www-servers/vinyl-cache/files/vinyllog.confd b/www-servers/vinyl-cache/files/vinyllog.confd
new file mode 100644
index 000000000000..047bc3a0c47d
--- /dev/null
+++ b/www-servers/vinyl-cache/files/vinyllog.confd
@@ -0,0 +1,3 @@
+# /etc/conf.d/vinyllog
+
+VINYLLOG_OPTS="-a -w /var/log/vinyl/vinyllog.log"
diff --git a/www-servers/vinyl-cache/files/vinyllog.initd b/www-servers/vinyl-cache/files/vinyllog.initd
new file mode 100644
index 000000000000..850664a36558
--- /dev/null
+++ b/www-servers/vinyl-cache/files/vinyllog.initd
@@ -0,0 +1,31 @@
+#!/sbin/openrc-run
+# Copyright 1999-2026 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+VINYLLOG_PID=${VINYLLOG_PID:-/run/${SVCNAME}.pid}
+
+command="${VINYLLOG:-/usr/bin/vinyllog}"
+command_args="-D -P ${VINYLLOG_PID} ${VINYLLOG_OPTS}"
+pidfile="${VINYLLOG_PID}"
+
+extra_started_commands="reload rotate flush"
+
+description_rotate="Rotate the log file"
+description_flush="Flush any outstanding transactions"
+
+rotate() {
+	ebegin "Rotating log file"
+	start-stop-daemon -p ${VINYLLOG_PID} -s SIGHUP
+	eend $?
+}
+
+flush() {
+	ebegin "Flushing any outstanding transactions"
+	start-stop-daemon -p ${VINYLLOG_PID} -s SIGUSR1
+	eend $?
+}
+
+reload() {
+	flush
+	rotate
+}
diff --git a/www-servers/vinyl-cache/files/vinylncsa.confd b/www-servers/vinyl-cache/files/vinylncsa.confd
new file mode 100644
index 000000000000..16ca8654b360
--- /dev/null
+++ b/www-servers/vinyl-cache/files/vinylncsa.confd
@@ -0,0 +1,3 @@
+# /etc/conf.d/vinylncsa
+
+VINYLNCSA_OPTS="-a -w /var/log/vinyl/${SVCNAME}.log"
diff --git a/www-servers/vinyl-cache/files/vinylncsa.initd b/www-servers/vinyl-cache/files/vinylncsa.initd
new file mode 100644
index 000000000000..2bf3e62b45f5
--- /dev/null
+++ b/www-servers/vinyl-cache/files/vinylncsa.initd
@@ -0,0 +1,31 @@
+#!/sbin/openrc-run
+# Copyright 1999-2026 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+VINYLNCSA_PID=${VINYLNCSA_PID:-/run/${SVCNAME}.pid}
+
+command="${VINYLNCSA:-/usr/bin/vinylncsa}"
+command_args="-D -P ${VINYLNCSA_PID} ${VINYLNCSA_OPTS}"
+pidfile="${VINYLNCSA_PID}"
+
+extra_started_commands="reload rotate flush"
+
+description_rotate="Rotate the log file"
+description_flush="Flush any outstanding transactions"
+
+rotate() {
+	ebegin "Rotating log file"
+	start-stop-daemon -p ${VINYLNCSA_PID} -s SIGHUP
+	eend $?
+}
+
+flush() {
+	ebegin "Flushing any outstanding transactions"
+	start-stop-daemon -p ${VINYLNCSA_PID} -s SIGUSR1
+	eend $?
+}
+
+reload() {
+	flush
+	rotate
+}
diff --git a/www-servers/vinyl-cache/metadata.xml b/www-servers/vinyl-cache/metadata.xml
new file mode 100644
index 000000000000..14b398c1dd21
--- /dev/null
+++ b/www-servers/vinyl-cache/metadata.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>bacs@librecast.net</email>
+    <name>Brett A C Sheffield</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription lang="en">
+		Vinyl Cache (formerly known as “Varnish Cache”) is a web application
+		accelerator also known as a caching HTTP reverse proxy. You install it
+		in front of any server that speaks HTTP and configure it to cache the
+		contents. Vinyl Cache is really, really fast. It typically speeds up
+		delivery with a factor of 300-1000×, depending on your architecture.
+	</longdescription>
+  <slots>
+    <subslots>Reflect ABI compatibility for libvinylapi.so.</subslots>
+  </slots>
+  <upstream>
+    <bugs-to>https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/issues</bugs-to>
+    <changelog>https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/src/branch/main/doc/changes.rst</changelog>
+    <doc>https://vinyl-cache.org/docs/index.html</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/vinyl-cache/vinyl-cache-8.0.1.ebuild b/www-servers/vinyl-cache/vinyl-cache-8.0.1.ebuild
new file mode 100644
index 000000000000..5d1f85b5899f
--- /dev/null
+++ b/www-servers/vinyl-cache/vinyl-cache-8.0.1.ebuild
@@ -0,0 +1,134 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit autotools systemd python-r1
+
+DESCRIPTION="Varnish is a state-of-the-art, high-performance HTTP accelerator"
+HOMEPAGE="https://vinyl-cache.org/"
+SRC_URI="https://vinyl-cache.org/downloads/varnish-${PV}.tgz"
+S="${WORKDIR}/varnish-${PV}"
+
+LICENSE="BSD-2 GPL-2"
+SLOT="0/2"
+KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 ~riscv x86"
+IUSE="jit selinux static-libs unwind"
+
+COMMON_DEPEND="
+	sys-libs/readline:=
+	dev-libs/libedit
+	dev-libs/libpcre2[jit?]
+	sys-libs/ncurses:=
+	unwind? ( sys-libs/libunwind:= )
+"
+
+# varnish compiles stuff at run time
+RDEPEND="
+	${PYTHON_DEPS}
+	${COMMON_DEPEND}
+	acct-user/varnish
+	acct-group/varnish
+	sys-devel/gcc
+	selinux? ( sec-policy/selinux-varnishd )
+"
+DEPEND="
+	${COMMON_DEPEND}
+	dev-python/docutils
+	dev-python/sphinx
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+PATCHES=(
+	"${FILESDIR}/varnish-8.0.0-configure-make-python-output-match-autotools.patch" # Bug: 882725
+)
+
+# Upstream acknowledge that a small number of tests fail sporadically, including on their
+# test boxes. We SKIP problematic tests here.  Check https://vinyl-cache.org/vtest/
+SKIP_TESTS=(
+	"u00021.vtc" # Commit: 83d9fbb2961c
+	"r02686.vtc" # Bug: 880627
+	"r02990.vtc" # Bug: 880627
+	"u00008.vtc" # Bug: 880627
+	"u00009.vtc" # Bug: 880627
+	"t02014.vtc" # Bug: 964041
+)
+
+src_prepare() {
+	default
+
+	# Fix python shebangs for python-exec[-native-symlinks], #909330
+	# skip vmodtool, as that gets installed by python_replicate_script later
+	local shebangs=($(grep -rl "#!/usr/bin/env python3"|grep -v vmodtool || die))
+	python_setup
+	python_fix_shebang -q ${shebangs[*]}
+
+	# SKIP unreliable tests
+	local t
+	for t in ${SKIP_TESTS[*]}; do
+		sed -i -e '/^varnishtest.*$/a feature cmd false' bin/varnishtest/tests/${t} || die
+	done
+
+	# Remove -Werror bug #528354
+	sed -i -e 's/-Werror\([^=]\)/\1/g' configure.ac || die
+
+	# Upstream doesn't put varnish.m4 in the m4/ directory
+	# We link because the Makefiles look for the file in
+	# the original location
+	ln -sf ../varnish.m4 m4/varnish.m4 || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--with-contrib
+		$(use_enable static-libs static)
+		$(use_enable jit pcre2-jit)
+		$(use_with unwind)
+		--without-jemalloc
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	python_replicate_script "${D}/usr/share/varnish/vmodtool.py"
+
+	newinitd "${FILESDIR}"/varnishlog.initd varnishlog
+	newconfd "${FILESDIR}"/varnishlog.confd varnishlog
+
+	newinitd "${FILESDIR}"/varnishncsa.initd varnishncsa
+	newconfd "${FILESDIR}"/varnishncsa.confd varnishncsa
+
+	newinitd "${FILESDIR}"/varnishd.initd-r4 varnishd
+	newconfd "${FILESDIR}"/varnishd.confd-r4 varnishd
+
+	insinto /etc/logrotate.d/
+	newins "${FILESDIR}/varnishd.logrotate-r2" varnishd
+
+	diropts -m750
+
+	keepdir /var/lib/varnish
+	keepdir /var/log/varnish
+
+	systemd_dounit "${FILESDIR}/varnishd.service"
+
+	insinto /etc/varnish/
+	doins vmod/vmod_*.vcc
+	doins etc/example.vcl
+
+	dodoc README.rst
+	dodoc doc/changes.rst
+
+	fowners root:varnish /etc/varnish/
+	fowners varnish:varnish /var/lib/varnish/
+	fperms 0750 /var/lib/varnish/ /etc/varnish/
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/www-servers/vinyl-cache/vinyl-cache-8.0.2.ebuild b/www-servers/vinyl-cache/vinyl-cache-8.0.2.ebuild
new file mode 100644
index 000000000000..2a74e09e850d
--- /dev/null
+++ b/www-servers/vinyl-cache/vinyl-cache-8.0.2.ebuild
@@ -0,0 +1,130 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit autotools systemd python-r1
+
+DESCRIPTION="Varnish is a state-of-the-art, high-performance HTTP accelerator"
+HOMEPAGE="https://vinyl-cache.org/"
+SRC_URI="https://vinyl-cache.org/downloads/varnish-${PV}.tgz"
+S="${WORKDIR}/varnish-${PV}"
+
+LICENSE="BSD-2 GPL-2"
+SLOT="0/2"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+IUSE="jit selinux static-libs unwind"
+
+COMMON_DEPEND="
+	sys-libs/readline:=
+	dev-libs/libedit
+	dev-libs/libpcre2[jit?]
+	sys-libs/ncurses:=
+	unwind? ( sys-libs/libunwind:= )
+"
+
+# varnish compiles stuff at run time
+RDEPEND="
+	${PYTHON_DEPS}
+	${COMMON_DEPEND}
+	acct-user/varnish
+	acct-group/varnish
+	sys-devel/gcc
+	selinux? ( sec-policy/selinux-varnishd )
+"
+DEPEND="
+	${COMMON_DEPEND}
+	dev-python/docutils
+	dev-python/sphinx
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+# Upstream acknowledge that a small number of tests fail sporadically, including on their
+# test boxes. We SKIP problematic tests here.  Check https://vinyl-cache.org/vtest/
+SKIP_TESTS=(
+	"u00021.vtc" # Commit: 83d9fbb2961c
+	"r02686.vtc" # Bug: 880627
+	"r02990.vtc" # Bug: 880627
+	"u00008.vtc" # Bug: 880627
+	"u00009.vtc" # Bug: 880627
+	"t02014.vtc" # Bug: 964041
+)
+
+src_prepare() {
+	default
+
+	# Fix python shebangs for python-exec[-native-symlinks], #909330
+	# skip vmodtool, as that gets installed by python_replicate_script later
+	local shebangs=($(grep -rl "#!/usr/bin/env python3"|grep -v vmodtool || die))
+	python_setup
+	python_fix_shebang -q ${shebangs[*]}
+
+	# SKIP unreliable tests
+	local t
+	for t in ${SKIP_TESTS[*]}; do
+		sed -i -e '/^varnishtest.*$/a feature cmd false' bin/varnishtest/tests/${t} || die
+	done
+
+	# Remove -Werror bug #528354
+	sed -i -e 's/-Werror\([^=]\)/\1/g' configure.ac || die
+
+	# Upstream doesn't put varnish.m4 in the m4/ directory
+	# We link because the Makefiles look for the file in
+	# the original location
+	ln -sf ../varnish.m4 m4/varnish.m4 || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--with-contrib
+		$(use_enable static-libs static)
+		$(use_enable jit pcre2-jit)
+		$(use_with unwind)
+		--without-jemalloc
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	python_replicate_script "${D}/usr/share/varnish/vmodtool.py"
+
+	newinitd "${FILESDIR}"/varnishlog.initd varnishlog
+	newconfd "${FILESDIR}"/varnishlog.confd varnishlog
+
+	newinitd "${FILESDIR}"/varnishncsa.initd varnishncsa
+	newconfd "${FILESDIR}"/varnishncsa.confd varnishncsa
+
+	newinitd "${FILESDIR}"/varnishd.initd-r4 varnishd
+	newconfd "${FILESDIR}"/varnishd.confd-r4 varnishd
+
+	insinto /etc/logrotate.d/
+	newins "${FILESDIR}/varnishd.logrotate-r2" varnishd
+
+	diropts -m750
+
+	keepdir /var/lib/varnish
+	keepdir /var/log/varnish
+
+	systemd_dounit "${FILESDIR}/varnishd.service"
+
+	insinto /etc/varnish/
+	doins vmod/vmod_*.vcc
+	doins etc/example.vcl
+
+	dodoc README.rst
+	dodoc doc/changes.rst
+
+	fowners root:varnish /etc/varnish/
+	fowners varnish:varnish /var/lib/varnish/
+	fperms 0750 /var/lib/varnish/ /etc/varnish/
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/www-servers/vinyl-cache/vinyl-cache-9.0.0.ebuild b/www-servers/vinyl-cache/vinyl-cache-9.0.0.ebuild
new file mode 100644
index 000000000000..f1d3f98e2167
--- /dev/null
+++ b/www-servers/vinyl-cache/vinyl-cache-9.0.0.ebuild
@@ -0,0 +1,129 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit autotools systemd python-r1
+
+DESCRIPTION="A high-performance caching HTTP reverse proxy"
+HOMEPAGE="https://vinyl-cache.org/"
+SRC_URI="https://vinyl-cache.org/downloads/${P}.tgz"
+
+LICENSE="BSD-2 GPL-2"
+SLOT="0/9"
+KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 ~riscv x86"
+IUSE="jit selinux static-libs unwind"
+
+COMMON_DEPEND="
+	sys-libs/readline:=
+	dev-libs/libedit
+	dev-libs/libpcre2[jit?]
+	sys-libs/ncurses:=
+	unwind? ( sys-libs/libunwind:= )
+"
+
+# varnish compiles stuff at run time
+RDEPEND="
+	${PYTHON_DEPS}
+	${COMMON_DEPEND}
+	acct-user/vinyl
+	acct-group/vinyl
+	sys-devel/gcc
+	selinux? ( sec-policy/selinux-varnishd )
+"
+DEPEND="
+	${COMMON_DEPEND}
+	dev-python/docutils
+	dev-python/sphinx
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+# Upstream acknowledge that a small number of tests fail sporadically, including on their
+# test boxes. We SKIP problematic tests here.  Check https://vinyl-cache.org/vtest/
+SKIP_TESTS=(
+	"u00021.vtc" # Commit: 83d9fbb2961c
+	"r02686.vtc" # Bug: 880627
+	"r02990.vtc" # Bug: 880627
+	"u00008.vtc" # Bug: 880627
+	"u00009.vtc" # Bug: 880627
+	"t02014.vtc" # Bug: 964041
+)
+
+src_prepare() {
+	default
+
+	# Fix python shebangs for python-exec[-native-symlinks], #909330
+	# skip vmodtool, as that gets installed by python_replicate_script later
+	local shebangs=($(grep -rl "#!/usr/bin/env python3"|grep -v vmodtool || die))
+	python_setup
+	python_fix_shebang -q ${shebangs[*]}
+
+	# SKIP unreliable tests
+	local t
+	for t in ${SKIP_TESTS[*]}; do
+		sed -i -e '/^vtest.*$/a feature cmd false' bin/vinyltest/tests/${t} || die
+	done
+
+	# Remove -Werror bug #528354
+	sed -i -e 's/-Werror\([^=]\)/\1/g' configure.ac || die
+
+	# Upstream doesn't put vinyl.m4 in the m4/ directory
+	# We link because the Makefiles look for the file in
+	# the original location
+	ln -sf ../vinyl.m4 m4/vinyl.m4 || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--with-contrib
+		$(use_enable static-libs static)
+		$(use_enable jit pcre2-jit)
+		$(use_with unwind)
+		--without-jemalloc
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	python_replicate_script "${D}/usr/share/vinyl-cache/vmodtool.py"
+
+	newinitd "${FILESDIR}"/vinyllog.initd vinyllog
+	newconfd "${FILESDIR}"/vinyllog.confd vinyllog
+
+	newinitd "${FILESDIR}"/vinylncsa.initd vinylncsa
+	newconfd "${FILESDIR}"/vinylncsa.confd vinylncsa
+
+	newinitd "${FILESDIR}"/vinyld.initd vinyld
+	newconfd "${FILESDIR}"/vinyld.confd vinyld
+
+	insinto /etc/logrotate.d/
+	newins "${FILESDIR}/vinyld.logrotate" vinyld
+
+	diropts -m750
+
+	keepdir /var/lib/vinyl-cache
+	keepdir /var/log/vinyl-cache
+
+	systemd_dounit "${FILESDIR}/vinyld.service"
+
+	insinto /etc/vinyl-cache/
+	doins vmod/vmod_*.vcc
+	doins etc/example.vcl
+
+	dodoc README.md
+	dodoc doc/changes.rst
+
+	fowners root:vinyl /etc/vinyl-cache/
+	fowners vinyl:vinyl /var/lib/vinyl-cache/
+	fperms 0750 /var/lib/vinyl-cache/ /etc/vinyl-cache/
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/www-servers/vinyl-cache/vinyl-cache-9.0.1.ebuild b/www-servers/vinyl-cache/vinyl-cache-9.0.1.ebuild
new file mode 100644
index 000000000000..fd9a46dbf618
--- /dev/null
+++ b/www-servers/vinyl-cache/vinyl-cache-9.0.1.ebuild
@@ -0,0 +1,130 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit autotools systemd python-r1
+
+DESCRIPTION="A high-performance caching HTTP reverse proxy"
+HOMEPAGE="https://vinyl-cache.org/"
+SRC_URI="https://vinyl-cache.org/downloads/${P}.tgz"
+
+LICENSE="BSD-2 GPL-2"
+SLOT="0/9"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+IUSE="jit selinux static-libs unwind"
+
+COMMON_DEPEND="
+	sys-libs/readline:=
+	dev-libs/libedit
+	dev-libs/libpcre2[jit?]
+	sys-libs/ncurses:=
+	unwind? ( sys-libs/libunwind:= )
+"
+
+# varnish compiles stuff at run time
+RDEPEND="
+	${PYTHON_DEPS}
+	${COMMON_DEPEND}
+	acct-user/vinyl
+	acct-group/vinyl
+	sys-devel/gcc
+	selinux? ( sec-policy/selinux-varnishd )
+"
+DEPEND="
+	${COMMON_DEPEND}
+	dev-python/docutils
+	dev-python/sphinx
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+# Upstream acknowledge that a small number of tests fail sporadically, including on their
+# test boxes. We SKIP problematic tests here.  Check https://vinyl-cache.org/vtest/
+SKIP_TESTS=(
+	"u00021.vtc" # Commit: 83d9fbb2961c
+	"r02686.vtc" # Bug: 880627
+	"r02990.vtc" # Bug: 880627
+	"u00008.vtc" # Bug: 880627
+	"u00009.vtc" # Bug: 880627
+	"t02014.vtc" # Bug: 964041
+)
+
+src_prepare() {
+	default
+
+	# Fix python shebangs for python-exec[-native-symlinks], #909330
+	# skip vmodtool, as that gets installed by python_replicate_script later
+	local shebangs=($(grep -rl "#!/usr/bin/env python3"|grep -v vmodtool || die))
+	python_setup
+	python_fix_shebang -q ${shebangs[*]}
+
+	# SKIP unreliable tests
+	local t
+	for t in ${SKIP_TESTS[*]}; do
+		sed -i -e '/^vtest.*$/a feature cmd false' bin/vinyltest/tests/${t} || die
+	done
+
+	# Remove -Werror bug #528354
+	sed -i -e 's/-Werror\([^=]\)/\1/g' configure.ac || die
+
+	# Upstream doesn't put vinyl.m4 in the m4/ directory
+	# We link because the Makefiles look for the file in
+	# the original location
+	ln -sf ../vinyl.m4 m4/vinyl.m4 || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--with-contrib
+		$(use_enable static-libs static)
+		$(use_enable jit pcre2-jit)
+		$(use_with unwind)
+		--without-jemalloc
+		--with-statedir="/var/lib/${PN}"
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	python_replicate_script "${D}/usr/share/vinyl-cache/vmodtool.py"
+
+	newinitd "${FILESDIR}"/vinyllog.initd vinyllog
+	newconfd "${FILESDIR}"/vinyllog.confd vinyllog
+
+	newinitd "${FILESDIR}"/vinylncsa.initd vinylncsa
+	newconfd "${FILESDIR}"/vinylncsa.confd vinylncsa
+
+	newinitd "${FILESDIR}"/vinyld.initd vinyld
+	newconfd "${FILESDIR}"/vinyld.confd vinyld
+
+	insinto /etc/logrotate.d/
+	newins "${FILESDIR}/vinyld.logrotate" vinyld
+
+	diropts -m750
+
+	keepdir /var/lib/vinyl-cache
+	keepdir /var/log/vinyl-cache
+
+	systemd_dounit "${FILESDIR}/vinyld.service"
+
+	insinto /etc/vinyl-cache/
+	doins vmod/vmod_*.vcc
+	doins etc/example.vcl
+
+	dodoc README.md
+	dodoc doc/changes.rst
+
+	fowners root:vinyl /etc/vinyl-cache/
+	fowners vinyl:vinyl /var/lib/vinyl-cache/
+	fperms 0750 /var/lib/vinyl-cache/ /etc/vinyl-cache/
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/www-servers/webfs/Manifest b/www-servers/webfs/Manifest
new file mode 100644
index 000000000000..7736407698cb
--- /dev/null
+++ b/www-servers/webfs/Manifest
@@ -0,0 +1 @@
+DIST webfs-1.21.tar.gz 44249 BLAKE2B 3d1bf7023f271f06079378a9a8e957deb611d567209ebd0ee947cae9852aecc2704ec8ce115b1f03ec39299040f44d7caf53fb30241f4990521aeda7b5815f3f SHA512 68b9b3163a21be8a549e395295b27dd8ce9b575183d6c36b05b98bdc310917cf2dc653ff73bdb78a8c063674a8e9480211ec5c28b8a676f9cee41fa962cfd473
diff --git a/www-servers/webfs/files/webfs-1.21-CVE-2013-0347.patch b/www-servers/webfs/files/webfs-1.21-CVE-2013-0347.patch
new file mode 100644
index 000000000000..26e225def360
--- /dev/null
+++ b/www-servers/webfs/files/webfs-1.21-CVE-2013-0347.patch
@@ -0,0 +1,15 @@
+--- ./webfsd.c
++++ ./webfsd.c
+@@ -918,8 +918,11 @@
+ 	} else {
+ 	    if (NULL == (logfh = fopen(logfile,"a")))
+ 		xperror(LOG_WARNING,"open access log",NULL);
+-	    else
++	    else {
+ 		close_on_exec(fileno(logfh));
++		if (0 != chmod(logfile,S_IRUSR|S_IWUSR))
++		    xperror(LOG_WARNING,"chmod access log",NULL);
++	    }
+ 	}
+     }
+ 
diff --git a/www-servers/webfs/files/webfs-1.21-Variables.mk-dont-strip-binaries-on-install.patch b/www-servers/webfs/files/webfs-1.21-Variables.mk-dont-strip-binaries-on-install.patch
new file mode 100644
index 000000000000..03f2f5c59816
--- /dev/null
+++ b/www-servers/webfs/files/webfs-1.21-Variables.mk-dont-strip-binaries-on-install.patch
@@ -0,0 +1,12 @@
+diff -Naur webfs-1.21.orig/mk/Variables.mk webfs-1.21/mk/Variables.mk
+--- webfs-1.21.orig/mk/Variables.mk	2009-02-03 01:14:18.000000000 +0100
++++ webfs-1.21/mk/Variables.mk	2009-02-03 01:16:01.000000000 +0100
+@@ -23,7 +23,7 @@
+ CXX		?= g++
+ MOC             ?= $(if $(QTDIR),$(QTDIR)/bin/moc,moc)
+ INSTALL		?= install
+-INSTALL_BINARY  := $(INSTALL) -s
++INSTALL_BINARY  := $(INSTALL)
+ INSTALL_SCRIPT  := $(INSTALL)
+ INSTALL_DATA	:= $(INSTALL) -m 644
+ INSTALL_DIR	:= $(INSTALL) -d
diff --git a/www-servers/webfs/files/webfs.confd b/www-servers/webfs/files/webfs.confd
new file mode 100644
index 000000000000..5c4de3ad9b74
--- /dev/null
+++ b/www-servers/webfs/files/webfs.confd
@@ -0,0 +1,27 @@
+# Configuration for webfsd init script
+
+WEBFS_PORT=80
+WEBFS_DOCROOT=/var/www/localhost/htdocs
+WEBFS_INDEX=index.html
+WEBFS_LOG=/var/log/webfsd.log
+
+# set server name
+#WEBFS_SERVNAME=
+
+# uncomment to chroot to specified dir
+#WEBFS_CHROOT="/var/www/localhost" 
+
+# max allowed connections (defaults to 32)
+#WEBFS_MAXCONN=50
+
+# uncomment to enable directory listings
+#WEBFS_DIR_LIST=true
+
+# uncomment to enable SSL (you'll need to add -C <cert> -P <pass> to WEBFS_OPTS)
+#WEBFS_SSL=true
+
+# uncomment to enable ipv6
+#WEBFS_IPV6=true
+
+# Add any extra options here. See webfsd for more information.
+#WEBFS_OPTS=""
diff --git a/www-servers/webfs/files/webfs.initd b/www-servers/webfs/files/webfs.initd
new file mode 100644
index 000000000000..ec328b662f83
--- /dev/null
+++ b/www-servers/webfs/files/webfs.initd
@@ -0,0 +1,29 @@
+#!/sbin/openrc-run
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+depend() {
+	need net
+}
+
+start() {
+	WEBFS_OPTS="-p ${WEBFS_PORT:-80} -f ${WEBFS_INDEX:-index.html} ${WEBFS_OPTS}"
+	[ -n "${WEBFS_DOCROOT}" ] && WEBFS_OPTS="${WEBFS_OPTS} -r ${WEBFS_DOCROOT}"
+	[ -n "${WEBFS_CHROOT}" ] && WEBFS_OPTS="${WEBFS_OPTS} -R ${WEBFS_CHROOT}"
+	[ -n "${WEBFS_LOG}" ] && WEBFS_OPTS="${WEBFS_OPTS} -L ${WEBFS_LOG}"
+	[ -n "${WEBFS_MAXCONN}" ] && WEBFS_OPTS="${WEBFS_OPTS} -c ${WEBFS_MAXCONN}"
+	[ -n "${WEBFS_IPV6}" ] && WEBFS_OPTS="${WEBFS_OPTS} -6"
+	[ -n "${WEBFS_SSL}" ] && WEBFS_OPTS="${WEBFS_OPTS} -S" 
+	[ -n "${WEBFS_SERVNAME}" ] && WEBFS_OPTS="${WEBFS_OPTS} -n ${WEBFS_SERVNAME}"
+	[ -n "${WEBFS_DIR_LIST}" ] || WEBFS_OPTS="${WEBFS_OPTS} -j" 
+
+	ebegin "Starting webfsd"
+	start-stop-daemon --start --quiet --exec /usr/bin/webfsd -- ${WEBFS_OPTS}
+	eend $? "Failed to start webfsd"
+}
+
+stop() {
+	ebegin "Stopping webfsd"
+	start-stop-daemon --stop --quiet --exec /usr/bin/webfsd
+	eend $? "Failed to stop webfsd"
+}
diff --git a/www-servers/webfs/files/webfs.service b/www-servers/webfs/files/webfs.service
new file mode 100644
index 000000000000..f8857655e28f
--- /dev/null
+++ b/www-servers/webfs/files/webfs.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Simple and instant http server.
+Documentation=man:webfsd(1)
+After=network.target
+
+[Service]
+ExecStart=/usr/bin/webfsd -p ${WEBFS_PORT:-80} -f ${WEBFS_INDEX:-index.html} ${WEBFS_OPTS} -F
+
+[Install]
+WantedBy=multi-user.target
diff --git a/www-servers/webfs/files/webfs.service.conf b/www-servers/webfs/files/webfs.service.conf
new file mode 100644
index 000000000000..80daa14dc7ae
--- /dev/null
+++ b/www-servers/webfs/files/webfs.service.conf
@@ -0,0 +1,27 @@
+# Configuration for webfsd
+
+WEBFS_PORT=80
+WEBFS_DOCROOT=/var/www/localhost/htdocs
+WEBFS_INDEX=index.html
+WEBFS_LOG=/var/log/webfsd.log
+
+# set server name
+#WEBFS_SERVNAME=
+
+# uncomment to chroot to specified dir
+#WEBFS_CHROOT="/var/www/localhost" 
+
+# max allowed connections (defaults to 32)
+#WEBFS_MAXCONN=50
+
+# uncomment to enable directory listings
+#WEBFS_DIR_LIST=true
+
+# uncomment to enable SSL (you'll need to add -C <cert> -P <pass> to WEBFS_OPTS)
+#WEBFS_SSL=true
+
+# uncomment to enable ipv6
+#WEBFS_IPV6=true
+
+# Add any extra options here. See webfsd for more information.
+#WEBFS_OPTS=""
diff --git a/www-servers/webfs/metadata.xml b/www-servers/webfs/metadata.xml
new file mode 100644
index 000000000000..7139acbaaca3
--- /dev/null
+++ b/www-servers/webfs/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>alexxy@gentoo.org</email>
+    <name>Alexey Shvetsov</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-servers/webfs/webfs-1.21.ebuild b/www-servers/webfs/webfs-1.21.ebuild
new file mode 100644
index 000000000000..7b512f519cdf
--- /dev/null
+++ b/www-servers/webfs/webfs-1.21.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd
+
+DESCRIPTION="Lightweight HTTP server for static content"
+SRC_URI="http://dl.bytesex.org/releases/${PN}/${P}.tar.gz"
+HOMEPAGE="http://linux.bytesex.org/misc/webfs.html"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="ssl threads"
+
+DEPEND="ssl? ( dev-libs/openssl:0= )"
+
+RDEPEND="${DEPEND}
+	app-misc/mime-types"
+
+PATCHES=(
+	"${FILESDIR}/${P}-Variables.mk-dont-strip-binaries-on-install.patch"
+	"${FILESDIR}/${P}-CVE-2013-0347.patch"
+)
+
+src_prepare() {
+	sed -e "s:/etc/mime.types:${EPREFIX}\\0:" -i GNUmakefile || die "sed failed"
+	default
+}
+
+src_compile() {
+	local myconf
+	use ssl || myconf="${myconf} USE_SSL=no"
+	use threads && myconf="${myconf} USE_THREADS=yes"
+
+	emake prefix="${EPREFIX}/usr" ${myconf}
+}
+
+src_install() {
+	local myconf
+	use ssl || myconf="${myconf} USE_SSL=no"
+	use threads && myconf="${myconf} USE_THREADS=yes"
+	emake DESTDIR="${D}" install prefix="${EPREFIX}/usr"  ${myconf} mandir="${ED}/usr/share/man"
+	newinitd "${FILESDIR}"/${PN}.initd ${PN}
+	newconfd "${FILESDIR}"/${PN}.confd ${PN}
+	systemd_dounit "${FILESDIR}/${PN}.service"
+	systemd_install_serviced "${FILESDIR}/${PN}.service.conf"
+	dodoc README
+}
+
+pkg_preinst() {
+	# Fix existing log permissions for bug #458892.
+	chmod 0600 "${EROOT}/var/log/webfsd.log" 2>/dev/null
+}
author	root <root@alpha.trunkmasters.com>	2026-06-12 19:09:37 -0500
committer	root <root@alpha.trunkmasters.com>	2026-06-12 19:09:37 -0500
commit	b590c8d7572b727d565cc0b8ff660d43569845de (patch)
tree	06f7a4102ea4e845df8b66660f252920d52952f9 /www-servers
parent	24f9cbfc4c34fdb6a6e03311674414e881ceab47 (diff)
download	baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.gz baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.xz baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.zip