With the ping.al.org domain added in[1] and a updated networkmanager
package shipped[2], we can now remove the file from the main domain.

[1] 498d5304 ("Merge branch 'ping' into 'master'")
    fabccd0f (""Move" NM connectivity check file to a subdomain")
[2] https://github.com/archlinux/svntogit-packages/commit/fb573170fc63c18f64eb4f155ed64a966a61b037

Giancarlo Razzolini authored 4 years ago and Jelle van der Waa committed 4 years ago

Since the network manager package is still pointing to http://www.archlinux.org for its check,
add a variable archweb_network_check_domain and change the nginx conf for both the maintenance
and regular, to allow the check to pass for the www site. Once the package is updated to point to
http://archlinux.org and after a reasonable amount of time has passed, we can remove this.

Added the missing break; parameter to allow the maintenace remote machine in.

This template is very similar to the regular archweb nginx one with a few notable differences:
- Regardless of the domain, everything will go to the main domain
- It allows the network manager check to pass
- It will use the ip address of the person running the role, and exempt only that ip address from hitting the
  maintenance page. Everybody else should see the maintenance page.

Jan Alexander Steffens (heftig) authored 4 years ago and Jelle van der Waa committed 4 years ago

Required to get .well-known working with web clients.

Changed the nginx template to handle includes and also reworked the way the dict is used, by using
the dict2items filter on the template directly. We also have create a custom template for ipxe.archlinux.org
using weaker ciphers.

https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#taxing-rewrites

https://github.com/matrix-org/synapse/blob/master/docs/MSC1711_certificates_FAQ.md

For proxy/fastcgi/uwsgi blocks, logging is still set to the old format,
but for everything else (= static data) a reduced format is used that
excludes items that no longer make sense (request_time, remote_user) and
those that are personal information all the time (remote_addr, http_x_forwarded_for).

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Fully static file and we are not interested in the requests to that.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This is the same as used on luna and as expected by the zabbix nginx
monitoring service.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Django generates an unique css, png and JavaScript files when
collectstatic is run. Which allows us to set an expiry of 1 month.

Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl>

At http://www.archlinux.org/check_network_status.txt (no https)

roles/archweb: Make the nginx config able to support preload by redirecting alternate domains to their https version before redirecting then to the main domain.

roles/archweb: Deny iso downloads on the /iso url. All the other downloads are allowed. Also change the location to use the configuration.

roles/archweb: Added a register for virtualenv changes and to deploy archweb in this case. Also changed nginx template to use the main domain.

roles/archweb: Add an alternate domains variable, with the proper templating, redirecting even tls requests to the main domain

roles/archweb: Nginx deployment, domain variable and other improvements.