Commit fabccd0f authored by Kristian Klausen's avatar Kristian Klausen

"Move" NM connectivity check file to a subdomain

The file should not be on the main domain as it adds unnecessary
complexity to the archweb role and there is a bigger chance that we
unintentionally break connectivity checking (which has happened in the
past[1][2]).

This doesn't remove the file from the main domain[3], as we need to ship
a updated NetworkManager package first.

[1] https://www.reddit.com/r/archlinux/comments/keai0g/does_anyone_know_if_this_is_normal/
[2] https://www.reddit.com/r/gnome/comments/ke9ytm/network_manager_popup/
[3] http://www.archlinux.org/check_network_status.txt

Fix #239
parent 36bf4ef1
......@@ -127,6 +127,7 @@ Medium-fast-ish packet.net Arch Linux box.
### Services
- Redirects (nginx redirects)
- ping
## security.archlinux.org
......
......@@ -13,3 +13,4 @@
- { role: redirects }
- { role: prometheus_exporters }
- { role: hardening }
- { role: ping }
ping_domain: 'ping.archlinux.org'
---
- name: create ssl cert
include_role:
name: certificate
vars:
domains: ["{{ ping_domain }}"]
- name: make nginx log dir
file: path=/var/log/nginx/{{ ping_domain }} state=directory owner=root group=root mode=0755
- name: set up nginx
template: src=nginx.d.conf.j2 dest="/etc/nginx/nginx.d/ping.conf" owner=root group=root mode=644
notify: reload nginx
tags: ['nginx']
server {
# We don't redirect to HTTPS because a redirect is considered a captive portal.
listen 80;
listen [::]:80;
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{ ping_domain }};
access_log /var/log/nginx/{{ ping_domain }}/access.log reduced;
error_log /var/log/nginx/{{ ping_domain }}/error.log;
include snippets/letsencrypt.conf;
ssl_certificate /etc/letsencrypt/live/{{ ping_domain }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ ping_domain }}/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/{{ ping_domain }}/chain.pem;
default_type text/plain;
location = / {
return 200 'This domain is used for connectivity checking (captive portal detection).\n';
}
# https://man.archlinux.org/man/NetworkManager.conf.5#CONNECTIVITY_SECTION
location /nm-check.txt {
access_log off;
add_header Cache-Control "max-age=0, must-revalidate";
return 200 'NetworkManager is online\n';
}
location / {
access_log off;
return 404;
}
}
......@@ -284,6 +284,7 @@ locals {
ipxe = { value = "www" }
mailman = { value = "redirect" }
packages = { value = "www" }
ping = { value = "redirect" }
planet = { value = "www" }
projects = { value = "luna" }
repos = { value = "gemini" }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment