We want to roll out HTTP/3 slowly, so this adds the necessary plumbing
and makes it possible to enable it per host.

Instead of adding the conditional logic to each nginx template, the 443
listen config is moved out into a snippet which is managed by the nginx
role.

HTTP/3 uses QUIC which is built on UDP. UDP is connectionless and
therefore reuseport[1][2] must be used to ensure that UDP packets for
the same QUIC connection is directed to the same worker. reuseport can
only be enabled once, so a default_server is added to the
"inventory_hostname vhost" for SSL/QUIC (reuseport is only enabled for
the latter). ssl_reject_handshake[3] is enabled as that allows enabling
SSL/QUIC without specifying a certificate.

[1] https://nginx.org/en/docs/http/ngx_http_core_module.html#listen
[2] https://lwn.net/Articles/542629/
[3] http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake

Ref #606

Robin Candau authored 9 months ago and Robin Candau committed 9 months ago

> 2024/06/02 11:05:53 \[warn\] 30324#30324: the "listen ... http2" directive is deprecated, use the "http2" directive instead

Fixes #589

Kristian Klausen authored 4 years ago and Jelle van der Waa committed 3 years ago

A extra access_log entry was added with the following commands:
$ cd roles
$ grep -lr access_log | xargs -P 1 -n 1 sed -i '/access_log/ s/\(.*\)\( \)\(\(reduced\|main\);$\)/\1 \3\n\1.json json_\3/'

Jelle van der Waa authored 4 years ago and Jelle van der Waa committed 4 years ago

To simplify the archive role, split it up in the web serving part for
the archive-mirrors, gemini and keep the archive role for only the
archive operation. This simplifies the new role as only two lines are
required to setup the the archive mirror website.

For our archive.archlinux.org website instead of always redirecting to
archive.org try if we have the file and fallback redirecting to
archive.org. This reduces the load on archive.org and makes our
reproducible builds downloads faster then archive.org. This also set's
up another archive mirror on archive.ger.mirror.pkgbuild.com

Signed-off-by: Jelle van der Waa <jelle@archlinux.org>

https://bugs.archlinux.org/task/65366



Signed-off-by: Florian Pritz <bluewind@xinu.at>

https://bugs.archlinux.org/task/65366



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Eli Schwartz authored 5 years ago and Florian Pritz committed 5 years ago

Whitelist all extensions known to makepkg.

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>

https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#taxing-rewrites

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Similar change to cb7ac5c3 except that
the pattern is adapted to extract the first char of the pkgname too.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

https://archive.archlinux.org/repos/2016/09/01/core/os/x86_64/iana-etc-20160513-1-any.pkg.tar.xz

should redirect to

https://archive.org/download/archlinux_pkg_iana-etc/iana-etc-20160513-1-any.pkg.tar.xz



but it actually redirects to the URL with the "-etc" part missing from
the directory name. The new regex fixes this by removing the part where
pkgver is allowed to have a hyphen. The PKGBUILD manpage explains that
pkgver is explicitly not allowed to contain a hyphen so we do not need
to allow this either.

It also makes the regex more readable by using named groups for the
different parts.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Currently .all/ keeps symlinks for each package file that point to the
actual file. We also track all files in the /pacakages/ tree separated
into directories based on their pkgname. This rewrite rule matches the
.all/ URLs to the /packages/ directory tree so that we can eventually
delete the symlinks from .all/.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Original-patch-by: Baptiste Jonglez <baptiste@bitsofnetworks.org>

- Changed redirection status to temporary instead of permanent
- Removed unnecessary escape of . in second location block pattern

Signed-off-by: Florian Pritz <bluewind@xinu.at>

For proxy/fastcgi/uwsgi blocks, logging is still set to the old format,
but for everything else (= static data) a reduced format is used that
excludes items that no longer make sense (request_time, remote_user) and
those that are personal information all the time (remote_addr, http_x_forwarded_for).

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This is the same as used on luna and as expected by the zabbix nginx
monitoring service.

Signed-off-by: Florian Pritz <bluewind@xinu.at>