diff --git a/www/nginx-devel/Makefile b/www/nginx-devel/Makefile
index f691a8f93632..8560909b0327 100644
--- a/www/nginx-devel/Makefile
+++ b/www/nginx-devel/Makefile
@@ -1,384 +1,394 @@
 # Created by: Sergey A. Osokin <osa@FreeBSD.org>
 
 PORTNAME?=	nginx
 PORTVERSION=	1.21.5
-PORTREVISION=	6
+PORTREVISION=	7
 CATEGORIES=	www
 MASTER_SITES=	https://nginx.org/download/ \
 		LOCAL/osa
 PKGNAMESUFFIX?=	-devel
 DISTFILES=	${DISTNAME}${EXTRACT_SUFX}
 
 MAINTAINER?=	osa@FreeBSD.org
 COMMENT?=	Robust and small WWW server
 
 LICENSE?=	BSD2CLAUSE
 LICENSE_FILE?=	${WRKSRC}/LICENSE
 
 CONFLICTS_INSTALL=	nginx
 
 PORTSCOUT=	limit:^1\.21\.[0-9]*
 
 USES=		cpe
 
 CPE_VENDOR=	f5
 CPE_PRODUCT=	nginx
 USE_GITHUB=	nodefault
 
 NGINX_VARDIR?=	/var
 NGINX_LOGDIR?=	${NGINX_VARDIR}/log/nginx
 NGINX_RUNDIR?=	${NGINX_VARDIR}/run
 NGINX_TMPDIR?=	${NGINX_VARDIR}/tmp/nginx
 HTTP_PORT?=	80
 
 NGINX_ACCESSLOG?=	${NGINX_LOGDIR}/access.log
 NGINX_ERRORLOG?=	${NGINX_LOGDIR}/error.log
 
 CONFLICTS?=	nginx-1.* \
 		nginx-full-1.* \
 		nginx-lite-1.* \
 		nginx-naxsi-1.*
 USE_RC_SUBR?=	nginx
 SUB_FILES?=	pkg-message
 SUB_LIST+=	WWWOWN=${WWWOWN} \
 		WWWGRP=${WWWGRP} \
 		NGINX_RUNDIR=${NGINX_RUNDIR} \
 		NGINX_TMPDIR=${NGINX_TMPDIR} \
 		PREFIX=${PREFIX}
 
 HAS_CONFIGURE=	yes
 CONFIGURE_ARGS+=--prefix=${ETCDIR} \
 		--with-cc-opt="-I ${LOCALBASE}/include" \
 		--with-ld-opt="-L ${LOCALBASE}/lib" \
 		--conf-path=${ETCDIR}/nginx.conf \
 		--sbin-path=${PREFIX}/sbin/nginx \
 		--pid-path=${NGINX_RUNDIR}/nginx.pid \
 		--error-log-path=${NGINX_ERRORLOG} \
 		--user=${WWWOWN} --group=${WWWGRP} \
 		--with-compat \
 		--with-pcre
 ALL_TARGET=
 
 PLIST_SUB+=	NGINX_TMPDIR=${NGINX_TMPDIR} NGINX_LOGDIR=${NGINX_LOGDIR} WWWOWN=${WWWOWN} WWWGRP=${WWWGRP}
 
 USERS?=	${WWWOWN}
 GROUPS?=${WWWGRP}
 
 NO_OPTIONS_SORT=	yes
 
 OPTIONS_GROUP=	HTTPGRP MAILGRP STREAMGRP
 # Modules that are part of the base nginx distribution
 OPTIONS_GROUP_HTTPGRP=	GOOGLE_PERFTOOLS HTTP HTTP_ADDITION HTTP_AUTH_REQ \
 	HTTP_CACHE HTTP_DAV HTTP_DEGRADATION HTTP_FLV HTTP_GUNZIP_FILTER \
 	HTTP_GZIP_STATIC HTTP_IMAGE_FILTER HTTP_MP4 HTTP_PERL \
 	HTTP_RANDOM_INDEX HTTP_REALIP HTTP_SECURE_LINK HTTP_SLICE HTTP_SSL \
-	HTTP_STATUS HTTP_SUB HTTP_XSLT HTTPV2 HTTPV3
+	HTTP_STATUS HTTP_SUB HTTP_XSLT HTTPV2 HTTPV3 HTTPV3_BORING HTTPV3_QTLS
 
 OPTIONS_GROUP_MAILGRP=	MAIL MAIL_IMAP MAIL_POP3 MAIL_SMTP MAIL_SSL
 
 OPTIONS_GROUP_STREAMGRP=	STREAM STREAM_REALIP STREAM_SSL \
 	STREAM_SSL_PREREAD
 
 OPTIONS_DEFINE=		DEBUG DEBUGLOG DSO FILE_AIO IPV6 NJS THREADS WWW
 OPTIONS_DEFAULT?=	DSO FILE_AIO HTTP HTTP_ADDITION HTTP_AUTH_REQ HTTP_CACHE \
 		HTTP_DAV HTTP_FLV HTTP_GUNZIP_FILTER HTTP_GZIP_STATIC HTTP_MP4 \
 		HTTP_RANDOM_INDEX HTTP_REALIP HTTP_SECURE_LINK HTTP_SLICE HTTP_SSL \
 		HTTP_STATUS HTTP_SUB HTTPV2 MAIL MAIL_SSL PCRE_ONE STREAM \
 		STREAM_REALIP STREAM_SSL STREAM_SSL_PREREAD THREADS WWW
 
 OPTIONS_RADIO+=		PCRE
 OPTIONS_RADIO_PCRE=	PCRE_ONE PCRE_TWO
 PCRE_ONE_LIB_DEPENDS=	libpcre.so:devel/pcre
 PCRE_ONE_CONFIGURE_ON=	--without-pcre2
 PCRE_TWO_LIB_DEPENDS=	libpcre2-8.so:devel/pcre2
 
 OPTIONS_RADIO+=		GSSAPI
 OPTIONS_RADIO_GSSAPI=	GSSAPI_HEIMDAL GSSAPI_MIT
 GSSAPI_HEIMDAL_USES=	gssapi:heimdal,flags
 GSSAPI_MIT_USES=	gssapi:mit
 
 OPTIONS_SUB=	yes
 
 .include "Makefile.options.desc"
 
 .for opt in ${OPTIONS_GROUP_MAILGRP:NMAIL}
 ${opt}_IMPLIES=	MAIL
 .endfor
 
 .for opt in ${OPTIONS_GROUP_HTTPGRP:NHTTP} WWW
 ${opt}_IMPLIES=	HTTP
 .endfor
 
 .for opt in ${OPTIONS_GROUP_STREAMGRP:NSTREAM}
 ${opt}_IMPLIES=	STREAM
 .endfor
 
 GSSAPI_HEIMDAL_IMPLIES=	HTTP_AUTH_KRB5
 GSSAPI_MIT_IMPLIES=	HTTP_AUTH_KRB5
 
 # If the target is makesum, make sure that every distfile is fetched.
 .if ${.TARGETS:Mmakesum}
 OPTIONS_DEFAULT=	${OPTIONS_DEFINE} ${OPTIONS_GROUP_HTTPGRP} \
 	${OPTIONS_GROUP_MAILGRP} ${OPTIONS_GROUP_STREAMGRP} \
 	${OPTIONS_GROUP_THIRDPARTYGRP}
 .endif
 
 # Non-module options handling
 DEBUG_CFLAGS=		-g
 DEBUG_VARS=		STRIP=#do not strip if nginx with debug information
 DEBUGLOG_CONFIGURE_ON=	--with-debug
 DSO_CONFIGURE_ON=	--modules-path=${MODULESDIR}
 DSO_VARS=		MODULESDIR=${PREFIX}/libexec/${PORTNAME}
 FILE_AIO_CONFIGURE_ON=	--with-file-aio
 IPV6_CONFIGURE_OFF=	--with-cc-opt="-DNGX_HAVE_INET6=0 -I ${LOCALBASE}/include"
 THREADS_CONFIGURE_ON=	--with-threads
 
 # Bundled modules
 GOOGLE_PERFTOOLS_LIB_DEPENDS=	libprofiler.so:devel/google-perftools
 GOOGLE_PERFTOOLS_CONFIGURE_ON=	--with-google_perftools_module
 HTTP_CONFIGURE_ON=		--http-client-body-temp-path=${NGINX_TMPDIR}/client_body_temp \
 				--http-fastcgi-temp-path=${NGINX_TMPDIR}/fastcgi_temp \
 				--http-proxy-temp-path=${NGINX_TMPDIR}/proxy_temp \
 				--http-scgi-temp-path=${NGINX_TMPDIR}/scgi_temp \
 				--http-uwsgi-temp-path=${NGINX_TMPDIR}/uwsgi_temp \
 				--http-log-path=${NGINX_ACCESSLOG}
 HTTP_CONFIGURE_OFF=		--without-http
 HTTP_ADDITION_CONFIGURE_ON=	--with-http_addition_module
 HTTP_AUTH_REQ_CONFIGURE_ON=	--with-http_auth_request_module
 HTTP_CACHE_CONFIGURE_OFF=	--without-http-cache
 HTTP_DAV_CONFIGURE_ON=		--with-http_dav_module
 HTTP_DEGRADATION_CONFIGURE_ON=	--with-http_degradation_module
 HTTP_FLV_CONFIGURE_ON=		--with-http_flv_module
 HTTP_GZIP_STATIC_CONFIGURE_ON=	--with-http_gzip_static_module
 HTTP_GUNZIP_FILTER_CONFIGURE_ON=--with-http_gunzip_module
 HTTP_IMAGE_FILTER_LIB_DEPENDS=	libgd.so:graphics/gd
 HTTP_IMAGE_FILTER_VARS=		DSO_BASEMODS+=http_image_filter_module
 HTTP_MP4_CONFIGURE_ON=		--with-http_mp4_module
 HTTP_PERL_CATEGORIES=		perl5
 HTTP_PERL_USES=			perl5
 HTTP_PERL_VARS=			DSO_BASEMODS+=http_perl_module
 HTTP_RANDOM_INDEX_CONFIGURE_ON=	--with-http_random_index_module
 HTTP_REALIP_CONFIGURE_ON=	--with-http_realip_module
 HTTP_SECURE_LINK_CONFIGURE_ON=	--with-http_secure_link_module
 HTTP_SLICE_CONFIGURE_ON=	--with-http_slice_module
 HTTP_SSL_CONFIGURE_ON=		--with-http_ssl_module
 HTTP_SSL_USES=			ssl
 HTTP_STATUS_CONFIGURE_ON=	--with-http_stub_status_module
 HTTP_SUB_CONFIGURE_ON=		--with-http_sub_module
 HTTP_XSLT_USES=			gnome
 HTTP_XSLT_USE=			GNOME=libxml2,libxslt
 HTTP_XSLT_VARS=			DSO_BASEMODS+=http_xslt_module
 HTTPV2_IMPLIES=			HTTP_SSL
 HTTPV2_CONFIGURE_ON=		--with-http_v2_module
-HTTPV3_BUILD_DEPENDS=		${LOCALBASE}/bin/bssl:security/boringssl
-HTTPV3_RUN_DEPENDS=		${LOCALBASE}/bin/bssl:security/boringssl
-HTTPV3_CONFIGURE_ON=		--with-http_ssl_module \
-				--build=nginx-quic \
+HTTPV3_CONFIGURE_ON=		--build=nginx-quic \
 				--with-stream_quic_module \
 				--with-http_v3_module
 HTTPV3_EXTRA_PATCHES=		${PATCHDIR}/extra-patch-httpv3:-p1
+HTTPV3_BORING_BUILD_DEPENDS=	${LOCALBASE}/bin/bssl:security/boringssl
+HTTPV3_BORING_RUN_DEPENDS=	${LOCALBASE}/bin/bssl:security/boringssl
+HTTPV3_BORING_IMPLIES=		HTTPV3
+HTTPV3_BORING_PREVENTS=		HTTPV3_QTLS
+HTTPV3_QTLS_BUILD_DEPENDS=	${LOCALBASE}/include/openssl/quic.h:security/openssl-quictls
+HTTPV3_QTLS_RUN_DEPENDS=	${LOCALBASE}/include/openssl/quic.h:security/openssl-quictls
+HTTPV3_QTLS_IMPLIES=		HTTPV3
 MAIL_VARS=			DSO_BASEMODS+=mail
 MAIL_IMAP_CONFIGURE_OFF=	--without-mail_imap_module
 MAIL_POP3_CONFIGURE_OFF=	--without-mail_pop3_module
 MAIL_SMTP_CONFIGURE_OFF=	--without-mail_smtp_module
 MAIL_SSL_USES=			ssl
 MAIL_SSL_CONFIGURE_ON=		--with-mail_ssl_module
 STREAM_VARS=			DSO_BASEMODS+=stream
 STREAM_REALIP_CONFIGURE_ON=	--with-stream_realip_module
 STREAM_SSL_USES=		ssl
 STREAM_SSL_CONFIGURE_ON=	--with-stream_ssl_module
 STREAM_SSL_PREREAD_CONFIGURE_ON=--with-stream_ssl_preread_module
 
 ### External modules
 .include "Makefile.extmod"
 
 .include <bsd.port.pre.mk>
 
 .if ${PORT_OPTIONS:MDSO}
 _addbasemod=	=dynamic
 _addextmod=	add-dynamic-module
 .else
 _addextmod=	add-module
 .endif
 
 .for mod in ${DSO_BASEMODS}
 CONFIGURE_ARGS+=	--with-${mod}${_addbasemod}
 .endfor
 
 # Some modules depend on other being there before, for example, devel_kit needs
 # to be there before a few other.
 .for mod in ${FIRST_DSO_EXTMODS}
 CONFIGURE_ARGS+=	--${_addextmod}=${WRKSRC_${mod}}${${mod:tu}_SUBDIR}
 .endfor
 
 .for mod in ${DSO_EXTMODS}
 CONFIGURE_ARGS+=	--${_addextmod}=${WRKSRC_${mod}}${${mod:tu}_SUBDIR}
 .endfor
 # For non-GitHub hosted modules
 .for moddir in ${DSO_EXTDIRS}
 CONFIGURE_ARGS+=	--${_addextmod}=${WRKDIR}/${moddir}
 .endfor
 
 .if empty(PORT_OPTIONS:MHTTP) && empty(PORT_OPTIONS:MMAIL)
 IGNORE=		requires at least HTTP or MAIL to \
 		be defined.  Please do 'make config' again
 .endif
 
 .if ${PORT_OPTIONS:MPASSENGER} && empty(PORT_OPTIONS:MDEBUG)
 CONFIGURE_ENV+=	OPTIMIZE="yes"
 CFLAGS+=	-DNDEBUG
 .endif
 
 .if empty(PORT_OPTIONS:MPCRE_ONE) && empty(PORT_OPTIONS:MPCRE_TWO)
 IGNORE=		required at least PCRE_ONE or PCRE_TWO \
 		to be defined. Please do 'make config' again
 .endif
 
+.if ${PORT_OPTIONS:MHTTPV3} && \
+    (empty(PORT_OPTIONS:MHTTPV3_BORING) && empty(PORT_OPTIONS:MHTTPV3_QTLS))
+IGNORE=		required HTTPV3_BORING or HTTPV3_QTLS \
+		to be defined. Please do 'make config' again
+.endif
+
 .if ${PORT_OPTIONS:MHTTP_AUTH_KRB5} && (empty(PORT_OPTIONS:MGSSAPI_HEIMDAL) && empty(PORT_OPTIONS:MGSSAPI_MIT))
 IGNORE=		required at least GSSAPI_HEIMDAL or \
 		GSSAPI_MIT to be defined. Please do \
 		'make config' again
 .endif
 
 .if ${PORT_OPTIONS:MPCRE_ONE}
 NJS_CONFIGURE_ARGS=	--no-pcre2
 .endif
 
 pre-everything::
 	@${ECHO_MSG}
 .if ${PORT_OPTIONS:MHTTP_UPSTREAM_FAIR}
 	@${ECHO_MSG} "Enable http_ssl module to build upstream_fair with SSL support"
 .endif
 .if ${PORT_OPTIONS:MPASSENGER}
 	@${ECHO_MSG} "This port install Passenger module only"
 .endif
 	@${ECHO_MSG}
 
 post-extract-GRIDFS-on:
 	@${RMDIR} ${WRKSRC_gridfs}/mongo-c-driver/
 	@${MV} ${WRKSRC_mongo_c} ${WRKSRC_gridfs}/mongo-c-driver
 
 post-patch:
 	@${REINPLACE_CMD} 's!%%HTTP_PORT%%!${HTTP_PORT}!; \
 		s!%%PREFIX%%!${PREFIX}!; \
 		s!%%NGINX_ERRORLOG%%!${NGINX_ERRORLOG}!' \
 		${WRKSRC}/conf/nginx.conf
 
 post-patch-BROTLI-on:
 	@${REINPLACE_CMD} -E 's!^brotli=.*!brotli="${LOCALBASE}"!' ${WRKSRC_brotli}/config
 
 post-patch-DRIZZLE-on:
 	@${REINPLACE_CMD} 's!%%PREFIX%%!${LOCALBASE}!g' ${WRKSRC_drizzle}/config
 
 post-patch-FASTDFS-on:
 	@${REINPLACE_CMD} \
 		's!%%PREFIX%%!${PREFIX}!g;s!%%LOCALBASE%%!${LOCALBASE}!g' \
 		${WRKSRC_fastdfs}/src/config
 
 # Respect CFLAGS by remove needless --std=c99 flag
 post-patch-GRIDFS-on:
 	@${REINPLACE_CMD} 's!--std=c99!-DMONGO_HAVE_STDINT!' ${WRKSRC_gridfs}/config
 
 post-patch-HTTP_AUTH_KRB5-on:
 	@${REINPLACE_CMD} 's!%%GSSAPILIBS%%!${GSSAPILIBS}!g; \
 		s!%%GSSAPIINCDIR%%!${GSSAPIINCDIR}!g; \
 		s!%%GSSAPILIBDIR%%!${GSSAPILIBDIR}!g' ${WRKSRC_auth_krb5}/config
 
 post-patch-HTTP_TARANTOOL-on:
 	@${REINPLACE_CMD} 's!%%PREFIX%%!${LOCALBASE}!g' ${WRKSRC_nginx_tarantool}/config
 
 # linker error acquire if --std=c99 defined, add "static" to inline function
 post-patch-HTTP_ZIP-on:
 	@${REINPLACE_CMD} \
 		's!^inline!static inline!' \
 		${WRKSRC_mod_zip}/ngx_http_zip_parsers.*
 
 post-patch-ICONV-on:
 	@${REINPLACE_CMD} 's!%%PREFIX%%!${LOCALBASE}!g' ${WRKSRC_iconv}/config
 
 post-patch-PASSENGER-on:
 	@${REINPLACE_CMD} \
 		'177,179s!true!false!' \
 		${WRKSRC_PASSENGER}/build/basics.rb
 	@${REINPLACE_CMD} \
 		's!-I/usr/include/libev!!; \
 		s!-lev!!; \
 		s!-Iext/libev!!; \
 		s!-I/usr/include/libeio!!; \
 		s!-leio!!; \
 		s!-Iext/libeio!!' \
 		${WRKSRC_PASSENGER}/build/common_library.rb
 
 post-patch-POSTGRES-on:
 	@${REINPLACE_CMD} 's!%%PREFIX%%!${LOCALBASE}!g' ${WRKSRC_postgres}/config
 
 post-patch-SFLOW-on:
 	@${REINPLACE_CMD} \
 		's!%%PREFIX%%!${LOCALBASE}!g' \
 		${WRKSRC_sflow}/ngx_http_sflow_config.h
 
 post-patch-VOD-on:
 	@${REINPLACE_CMD} \
 		's!%%PREFIX%%!${LOCALBASE}!g' \
 		${WRKSRC_vod}/config
 
 pre-configure-SMALL_LIGHT-on:
 	( cd ${WRKSRC_small_light} && ./setup )
 
 do-configure-NJS-on:
 	( cd ${WRKSRC_njs} && ${SETENV} ${CONFIGURE_ENV} ${CONFIGURE_CMD} ${NJS_CONFIGURE_ARGS} \
 		&& ${SETENV} ${MAKE_ENV} ${MAKE_CMD} njs \
 		&& ${MV} build/njs ${WRKSRC_njs} )
 
 .if !target(do-install)
 do-install:
 	${MKDIR} ${STAGEDIR}${ETCDIR}
 	${MKDIR} ${STAGEDIR}${NGINX_TMPDIR}
 	${MKDIR} ${STAGEDIR}${NGINX_LOGDIR}
 	${INSTALL_PROGRAM} ${WRKSRC}/objs/nginx ${STAGEDIR}${PREFIX}/sbin
 .for i in koi-utf koi-win win-utf
 	${INSTALL_DATA} ${WRKSRC}/conf/${i} ${STAGEDIR}${ETCDIR}
 .endfor
 .for i in fastcgi_params mime.types scgi_params uwsgi_params
 	${INSTALL_DATA} ${WRKSRC}/conf/${i} ${STAGEDIR}${ETCDIR}/${i}-dist
 .endfor
 
 do-install-HTTP_PERL-on:
 	${MKDIR} ${STAGEDIR}${PREFIX}/${SITE_ARCH_REL}/auto/nginx
 	${INSTALL_PROGRAM} ${WRKSRC}/objs/src/http/modules/perl/blib/arch/auto/nginx/nginx.so \
 		${STAGEDIR}${PREFIX}/${SITE_ARCH_REL}/auto/nginx
 	${INSTALL_DATA} ${WRKSRC}/objs/src/http/modules/perl/blib/lib/nginx.pm \
 		${STAGEDIR}${PREFIX}/${SITE_ARCH_REL}/
 
 # Install dynamic modules
 do-install-DSO-on:
 	${MKDIR} ${STAGEDIR}${MODULESDIR}
 	(cd ${WRKSRC}/objs/ && ${FIND} . -name '*.so' -maxdepth 1 -type f \
 		-exec ${INSTALL_PROGRAM} {} ${STAGEDIR}${MODULESDIR} \;)
 
 do-install-LINK-on:
 	${INSTALL_DATA} ${WRKSRC_link}/src/ngx_link_func_module.h ${STAGEDIR}${PREFIX}/include
 
 do-install-NAXSI-on:
 	${INSTALL_DATA} \
 	${WRKDIR}/naxsi-${NAXSI_NGINX_VER}/naxsi_config/naxsi_core.rules \
 	${STAGEDIR}${ETCDIR}
 
 do-install-NJS-on:
 	${INSTALL_PROGRAM} ${WRKSRC_njs}/njs ${STAGEDIR}${PREFIX}/sbin
 .endif
 
 .if !target(post-install)
 post-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/share/vim/vimfiles
 	cd ${WRKSRC}/contrib/vim && ${COPYTREE_SHARE} . ${STAGEDIR}${PREFIX}/share/vim/vimfiles
 	${INSTALL_MAN} ${WRKSRC}/objs/nginx.8 ${STAGEDIR}${MAN8PREFIX}/share/man/man8
 	${CAT} ${WRKSRC}/conf/nginx.conf >> ${STAGEDIR}${ETCDIR}/nginx.conf-dist
 
 post-install-WWW-on:
 	${MKDIR} ${STAGEDIR}${PREFIX}/www/nginx-dist
 	(cd ${WRKSRC}/html && ${COPYTREE_SHARE} . ${STAGEDIR}${PREFIX}/www/nginx-dist && \
 	${TOUCH} ${STAGEDIR}${PREFIX}/www/nginx-dist/EXAMPLE_DIRECTORY-DONT_ADD_OR_TOUCH_ANYTHING)
 .endif
 
 .include <bsd.port.post.mk>
diff --git a/www/nginx-devel/Makefile.options.desc b/www/nginx-devel/Makefile.options.desc
index b39e871d0a9b..b6067fe10827 100644
--- a/www/nginx-devel/Makefile.options.desc
+++ b/www/nginx-devel/Makefile.options.desc
@@ -1,118 +1,120 @@
 AJP_DESC=			3rd party ajp module
 ARRAYVAR_DESC=			3rd party array_var module
 AWS_AUTH_DESC=			3rd party aws auth module
 BROTLI_DESC=			3rd party brotli module
 CACHE_PURGE_DESC=		3rd party cache_purge module
 CLOJURE_DESC=			3rd party clojure module
 COOKIE_FLAG_DESC=		3rd party cookie_flag module
 CT_DESC=			3rd party cert_transparency module (SSL req.)
 DEBUGLOG_DESC=			Enable debug log (--with-debug)
 DEVEL_KIT_DESC=			3rd party Nginx Development Kit module
 DRIZZLE_DESC=			3rd party drizzle module
 DSO_DESC=			Enable dynamic modules support
 DYNAMIC_HC_DESC=		3rd party dynamic_healthcheck module
 DYNAMIC_UPSTREAM_DESC=		3rd party dynamic_upstream module
 ECHO_DESC=			3rd party echo module
 ENCRYPTSESSION_DESC=		3rd party encrypted_session module
 FILE_AIO_DESC=			Enable file aio
 FORMINPUT_DESC=			3rd party form_input module
 GOOGLE_PERFTOOLS_DESC=		Enable google perftools module
 GRIDFS_DESC=			3rd party gridfs module
 GSSAPI_DESC=			GSSAPI implementation (imply HTTP_AUTH_KRB5)
 HEADERS_MORE_DESC=		3rd party headers_more module
 HTTPGRP_DESC=			Modules that require HTTP module
 HTTPV2_DESC=			Enable HTTP/2 protocol support (SSL req.)
-HTTPV3_DESC=			Enable HTTP/3 protocol support (BoringSSL req.)
+HTTPV3_DESC=			Enable HTTP/3 protocol support
+HTTPV3_BORING_DESC=		Use security/boringssl
+HTTPV3_QTLS_DESC=		Use security/openssl-quictls
 HTTP_ACCEPT_LANGUAGE_DESC=	3rd party accept_language module
 HTTP_ADDITION_DESC=		Enable http_addition module
 HTTP_AUTH_DIGEST_DESC=		3rd party http_authdigest module
 HTTP_AUTH_KRB5_DESC=		3rd party http_auth_gss module
 HTTP_AUTH_LDAP_DESC=		3rd party http_auth_ldap module
 HTTP_AUTH_PAM_DESC=		3rd party http_auth_pam module
 HTTP_AUTH_REQ_DESC=		Enable http_auth_request module
 HTTP_CACHE_DESC=		Enable http_cache module
 HTTP_DAV_DESC=			Enable http_webdav module
 HTTP_DAV_EXT_DESC=		3rd party webdav_ext module
 HTTP_DEGRADATION_DESC=		Enable http_degradation module
 HTTP_DESC=			Enable HTTP module
 HTTP_EVAL_DESC=			3rd party eval module
 HTTP_FANCYINDEX_DESC=		3rd party http_fancyindex module
 HTTP_FLV_DESC=			Enable http_flv module
 HTTP_FOOTER_DESC=		3rd party http_footer module
 HTTP_GEOIP2_DESC=		3rd party geoip2 module
 HTTP_GUNZIP_FILTER_DESC=	Enable http_gunzip_filter module
 HTTP_GZIP_STATIC_DESC=		Enable http_gzip_static module
 HTTP_IMAGE_FILTER_DESC=		Enable http_image_filter module
 HTTP_IP2LOCATION_DESC=		3rd party ip2location-nginx module
 HTTP_IP2PROXY_DESC=		3rd party ip2proxy-nginx module
 HTTP_JSON_STATUS_DESC=		3rd party http_json_status module
 HTTP_MOGILEFS_DESC=		3rd party mogilefs module
 HTTP_MP4_DESC=			Enable http_mp4 module
 HTTP_MP4_H264_DESC=		3rd party mp4/h264 module
 HTTP_NOTICE_DESC=		3rd party notice module
 HTTP_PERL_DESC=			Enable http_perl module
 HTTP_PUSH_DESC=			3rd party push module
 HTTP_PUSH_STREAM_DESC=		3rd party push stream module
 HTTP_RANDOM_INDEX_DESC=		Enable http_random_index module
 HTTP_REALIP_DESC=		Enable http_realip module
 HTTP_REDIS_DESC=		3rd party http_redis module
 HTTP_RESPONSE_DESC=		3rd party http_response module
 HTTP_SECURE_LINK_DESC=		Enable http_secure_link module
 HTTP_SLICE_DESC=		Enable http_slice module
 HTTP_SLICE_AHEAD_DESC=		3rd party http_slice_ahead module
 HTTP_SSL_DESC=			Enable http_ssl module
 HTTP_STATUS_DESC=		Enable http_stub_status module
 HTTP_SUBS_FILTER_DESC=		3rd party subs filter module
 HTTP_SUB_DESC=			Enable http_sub module
 HTTP_TARANTOOL_DESC=		3rd party tarantool upstream module
 HTTP_UPLOAD_DESC=		3rd party upload module
 HTTP_UPLOAD_PROGRESS_DESC=	3rd party uploadprogress module
 HTTP_UPSTREAM_CHECK_DESC=	3rd party upstream check module
 HTTP_UPSTREAM_FAIR_DESC=	3rd party upstream fair module
 HTTP_UPSTREAM_STICKY_DESC=	3rd party upstream sticky module
 HTTP_VIDEO_DESC=		3rd party video module support
 HTTP_VIDEO_THUMBEXTRACTOR_DESC=	3rd party video_thumbextractor module
 HTTP_XSLT_DESC=			Enable http_xslt module
 HTTP_ZIP_DESC=			3rd party http_zip module
 ICONV_DESC=			3rd party iconv module
 IPV6_DESC=			Enable IPv6 support
 LET_DESC=			3rd party let module
 LINK_DESC=			3rd party link function module
 LUA_DESC=			3rd party lua module
 MAILGRP_DESC=			Modules that require MAIL module
 MAIL_DESC=			Enable IMAP4/POP3/SMTP proxy module
 MAIL_IMAP_DESC=			Enable IMAP4 proxy module
 MAIL_POP3_DESC=			Enable POP3 proxy module
 MAIL_SMTP_DESC=			Enable SMTP proxy module
 MAIL_SSL_DESC=			Enable mail_ssl module
 MEMC_DESC=			3rd party memc (memcached) module
 MODSECURITY3_DESC=		3rd party modsecurity3 module
 NAXSI_DESC=			3rd party naxsi module
 NJS_DESC=			Enable javascript module
 OPENTRACING_DESC=		3rd party opentracing module
 PASSENGER_DESC=			3rd party passenger module
 PCRE_ONE_DESC=			Enable PCRE1 support
 PCRE_TWO_DESC=			Enable PCRE2 support
 POSTGRES_DESC=			3rd party postgres module
 RDS_CSV_DESC=			3rd party rds_csv module
 RDS_JSON_DESC=			3rd party rds_json module
 REDIS2_DESC=			3rd party redis2 module
 RTMP_DESC=			3rd party rtmp module
 SET_MISC_DESC=			3rd party set_misc module
 SFLOW_DESC=			3rd party sflow module
 SHIBBOLETH_DESC=		3rd party shibboleth module
 SLOWFS_CACHE_DESC=		3rd party slowfs_cache module
 SMALL_LIGHT_DESC=		3rd party small_light module
 SRCACHE_DESC=			3rd party srcache module
 STREAMGRP_DESC=			Modules that require STREAM module
 STREAM_DESC=			Enable stream module
 STREAM_REALIP_DESC=		Enable stream_realip module
 STREAM_SSL_DESC=		Enable stream_ssl module (SSL req.)
 STREAM_SSL_PREREAD_DESC=	Enable stream_ssl_preread module (SSL req.)
 THREADS_DESC=			Enable threads support
 THIRDPARTYGRP_DESC=		Third-party modules
 VOD_DESC=			3rd party vod module
 VTS_DESC=			3rd party vts module
 WWW_DESC=			Enable html sample files
 XSS_DESC=			3rd party xss module
 WEBSOCKIFY_DESC=		3rd party websockify module
diff --git a/www/nginx-devel/files/nginx.in b/www/nginx-devel/files/nginx.in
index 7ab503d01820..652468a97596 100644
--- a/www/nginx-devel/files/nginx.in
+++ b/www/nginx-devel/files/nginx.in
@@ -1,158 +1,158 @@
 #!/bin/sh
 
 # PROVIDE: nginx
 # REQUIRE: LOGIN cleanvar
 # KEYWORD: shutdown
 
 #
 # Add the following lines to /etc/rc.conf to enable nginx:
 # nginx_enable (bool):		Set to "NO" by default.
 #				Set it to "YES" to enable nginx
 # nginx_profiles (str):		Set to "" by default.
 #				Define your profiles here.
 # nginx_pid_prefix (str):	Set to "" by default.
 #				When using profiles manually assign value to "nginx_"
 #				for prevent collision with other PIDs names.
 # nginxlimits_enable (bool):	Set to "NO" by default.
 #				Set it to yes to run `limits $limits_args`
 #				just before nginx starts.
 # nginx_reload_quiet (bool):	Set to "NO" by default.
 #				Set it to yes to suppress info output when testng config.
 # nginx_flags (str):		Set to "" by default.
 #				Extra flags passed to start command.
 # nginxlimits_args (str):	Default to "-e -U %%WWWOWN%%"
 #				Arguments of pre-start limits run.
 # nginx_http_accept_enable (bool): Set to "NO" by default.
 #				Set to yes to check for accf_http kernel module
 #				on start-up and load if not loaded.
-# nginx_sig_stop (str):		Default to "-TERM"
+# nginx_sig_stop (str):		Default to "TERM"
 
 . /etc/rc.subr
 
 name="nginx"
 rcvar=nginx_enable
 
 start_precmd="nginx_prestart"
 stop_precmd="nginx_prestop"
 restart_precmd="nginx_checkconfig"
 reload_precmd="nginx_checkconfig"
 configtest_cmd="nginx_checkconfig"
 gracefulstop_cmd="nginx_gracefulstop"
 upgrade_precmd="nginx_checkconfig"
 upgrade_cmd="nginx_upgrade"
 command="%%PREFIX%%/sbin/nginx"
 _pidprefix="%%NGINX_RUNDIR%%"
 pidfile="${_pidprefix}/${name}.pid"
 _tmpprefix="%%NGINX_TMPDIR%%"
 required_files=%%PREFIX%%/etc/nginx/nginx.conf
 extra_commands="reload configtest upgrade gracefulstop"
 
 [ -z "$nginx_enable" ]		&& nginx_enable="NO"
 [ -z "$nginxlimits_enable" ]	&& nginxlimits_enable="NO"
 [ -z "$nginxlimits_args" ]	&& nginxlimits_args="-e -U %%WWWOWN%%"
 [ -z "$nginx_http_accept_enable" ] && nginx_http_accept_enable="NO"
 [ -z "$nginx_reload_quiet" ]	&& nginx_reload_quiet="NO"
 
 load_rc_config $name
 
 if [ -n "$2" ]; then
 	profile="$2"
 	if [ "x${nginx_profiles}" != "x" ]; then
 		pidfile="${_pidprefix}/${nginx_pid_prefix}${profile}.pid"
 		eval nginx_configfile="\${nginx_${profile}_configfile:-}"
 		if [ "x${nginx_configfile}" = "x" ]; then
 			echo "You must define a configuration file (nginx_${profile}_configfile)"
 			exit 1
 		fi
 		required_files="${nginx_configfile}"
 		eval nginx_enable="\${nginx_${profile}_enable:-${nginx_enable}}"
 		eval nginx_flags="\${nginx_${profile}_flags:-${nginx_flags}}"
 		eval nginxlimits_enable="\${nginxlimits_${profile}_enable:-${nginxlimits_enable}}"
 		eval nginxlimits_args="\${nginxlimits_${profile}_args:-${nginxlimits_args}}"
 		nginx_flags="-c ${nginx_configfile} -g \"pid ${pidfile};\" ${nginx_flags}"
 	else
 		echo "$0: extra argument ignored"
 	fi
 else
 	if [ "x${nginx_profiles}" != "x" -a "x$1" != "x" ]; then
 		for profile in ${nginx_profiles}; do
 			echo "===> nginx profile: ${profile}"
 			%%PREFIX%%/etc/rc.d/nginx $1 ${profile}
 			retcode="$?"
 			if [ "0${retcode}" -ne 0 ]; then
 				failed="${profile} (${retcode}) ${failed:-}"
 			else
 				success="${profile} ${success:-}"
 			fi
 		done
 		exit 0
 	fi
 fi
 
 # tmpfs(5)
 nginx_checktmpdir()
 {
 	if [ ! -d ${_tmpprefix} ] ; then
 		install -d -o %%WWWOWN%% -g %%WWWGRP%% -m 755 ${_tmpprefix}
 	fi
 }
 
 nginx_checkconfig()
 {
 	nginx_checktmpdir
 
 	if checkyesno nginx_reload_quiet; then
 		eval ${command} ${nginx_flags} -t -q
 	else
 		echo "Performing sanity check on nginx configuration:"
 		eval ${command} ${nginx_flags} -t
 	fi
 }
 
 nginx_gracefulstop()
 {
 	echo "Performing a graceful stop:"
 	sig_stop="QUIT"
 	run_rc_command ${rc_prefix}stop $rc_extra_args || return 1
 }
 
 nginx_upgrade()
 {
 	echo "Upgrading nginx binary:"
 
 	reload_precmd=""
 	sig_reload="USR2"
 	run_rc_command ${rc_prefix}reload $rc_extra_args || return 1
 
 	sleep 1
 
 	echo "Stopping old binary:"
 
 	sig_reload="QUIT"
 	pidfile="$pidfile.oldbin"
 	run_rc_command ${rc_prefix}reload $rc_extra_args || return 1
 }
 
 nginx_prestart()
 {
 	if checkyesno nginx_http_accept_enable
 	then
 		required_modules="$required_modules accf_http accf_data"
 	fi
 
 	nginx_checkconfig
 
 	if checkyesno nginxlimits_enable
 	then
 		eval `/usr/bin/limits ${nginxlimits_args}` 2>/dev/null
 	else
 		return 0
 	fi
 }
 
 nginx_prestop()
 {
 	sig_stop="${nginx_sig_stop:-TERM}"
 }
 
 run_rc_command "$1"