Giancarlo Razzolini authored Dec 18, 2020 and Jelle van der Waa committed Dec 20, 2020

Since the network manager package is still pointing to http://www.archlinux.org for its check,
add a variable archweb_network_check_domain and change the nginx conf for both the maintenance
and regular, to allow the check to pass for the www site. Once the package is updated to point to
http://archlinux.org and after a reasonable amount of time has passed, we can remove this.

Jan Alexander Steffens (heftig) authored Aug 19, 2020 and Jelle van der Waa committed Oct 03, 2020

Required to get .well-known working with web clients.

Changed the nginx template to handle includes and also reworked the way the dict is used, by using
the dict2items filter on the template directly. We also have create a custom template for ipxe.archlinux.org
using weaker ciphers.

https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#taxing-rewrites

https://github.com/matrix-org/synapse/blob/master/docs/MSC1711_certificates_FAQ.md

For proxy/fastcgi/uwsgi blocks, logging is still set to the old format,
but for everything else (= static data) a reduced format is used that
excludes items that no longer make sense (request_time, remote_user) and
those that are personal information all the time (remote_addr, http_x_forwarded_for).

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Fully static file and we are not interested in the requests to that.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This is the same as used on luna and as expected by the zabbix nginx
monitoring service.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Django generates an unique css, png and JavaScript files when
collectstatic is run. Which allows us to set an expiry of 1 month.

Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl>

At http://www.archlinux.org/check_network_status.txt (no https)

roles/archweb: Make the nginx config able to support preload by redirecting alternate domains to their https version before redirecting then to the main domain.

roles/archweb: Deny iso downloads on the /iso url. All the other downloads are allowed. Also change the location to use the configuration.

roles/archweb: Added a register for virtualenv changes and to deploy archweb in this case. Also changed nginx template to use the main domain.

roles/archweb: Add an alternate domains variable, with the proper templating, redirecting even tls requests to the main domain

roles/archweb: Nginx deployment, domain variable and other improvements.