diff --git a/nginx.spec b/nginx.spec
index ee38beb..511c7e1 100644
--- a/nginx.spec
+++ b/nginx.spec
@@ -47,6 +47,7 @@ Source210:         UPGRADE-NOTES-1.6-to-1.10
 Source300:         lua-nginx-module-%{lua_version}.tar.gz
 Source301:         ngx_devel_kit-%{ndk_version}.tar.gz
 Source302:         modsecurity-nginx-v%{modsecurity_version}.tar.gz
+Source303:         naxsi-%{naxsi_version}.tar.gz
 
 # removes -Werror in upstream build scripts.  -Werror conflicts with
 # -D_FORTIFY_SOURCE=2 causing warnings to turn into errors.
@@ -212,11 +213,22 @@ Requires:          libmodsecurity
 %description mod-http-modsecurity
 %{summary}.
 
+%package mod-http-naxsi
+Summary:           nginx naxsi dynamic module
+URL:               https://github.com/nbs-system/naxsi/
+Group:             System Environment/Daemons
+License:           GNU GPL v3
+Requires:          nginx == %{?epoch:%{epoch}:}%{version}
+
+%description mod-http-naxsi
+%{summary}.
+
 %prep
 %setup -q
 %setup -q -T -D -a 300
 %setup -q -T -D -a 301
 %setup -q -T -D -a 302
+%setup -q -T -D -a 303
 %patch0 -p0
 
 cp %{SOURCE200} .
@@ -288,7 +300,8 @@ export DESTDIR=%{buildroot}
     --with-ld-opt="$RPM_LD_FLAGS -Wl,-E" \
     --add-dynamic-module=lua-nginx-module-%{lua_version} \
     --add-dynamic-module=ngx_devel_kit-%{ndk_version} \
-    --add-dynamic-module=modsecurity-nginx-v%{modsecurity_version}
+    --add-dynamic-module=modsecurity-nginx-v%{modsecurity_version} \
+    --add-dynamic-module=naxsi-%{naxsi_version}/naxsi_src
 
 make %{?_smp_mflags}
 
@@ -359,6 +372,8 @@ echo 'load_module "%{_libdir}/nginx/modules/ngx_http_lua_module.so";' \
     > %{buildroot}%{_datadir}/nginx/modules/mod-lua.conf
 echo 'load_module "%{_libdir}/nginx/modules/ngx_http_modsecurity_module.so";' \
     > %{buildroot}%{_datadir}/nginx/modules/mod-modsecurity.conf
+echo 'load_module "%{_libdir}/nginx/modules/ngx_http_naxsi_module.so";' \
+    > %{buildroot}%{_datadir}/nginx/modules/mod-naxsi.conf
 
 %pre filesystem
 getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user}
@@ -415,6 +430,11 @@ if [ $1 -eq 1 ]; then
     /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || :
 fi
 
+%post mod-http-naxsi
+if [ $1 -eq 1 ]; then
+    /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || :
+fi
+
 %preun
 %systemd_preun nginx.service
 
@@ -511,6 +531,10 @@ fi
 %{_datadir}/nginx/modules/mod-modsecurity.conf
 %{_libdir}/nginx/modules/ngx_http_modsecurity_module.so
 
+%files mod-http-naxsi
+%{_datadir}/nginx/modules/mod-naxsi.conf
+%{_libdir}/nginx/modules/ngx_http_naxsi_module.so
+
 %changelog
 * Tue Nov 06 2018 Daniel Berteaud <daniel@firewall-services.com> 1.12.2-20.beta7
 - Add ndk and lua 3rd party modules (daniel@firewall-services.com)