Add a default rate limit for 20 req/s for the uwsgi endpoint and
automatically ban users who reach this limit. The nginx-limit-req rule
does not ban users who reach the rss limit as these are not likely DoS
attempts.

We did the revert to help a small business, but they had some time to
fix their setup, so we can revert the revert.

This reverts commit a842fbe7.

The latter can cause duplicate Content-Type headers. Thanks to strcat
for notifying me of the issue.

This is causing issues for a small business, which can't reach their
"remote systems" anymore due to NM reporting "limited access".
We should be able to revert this in 1-2 weeks.

This reverts commit b909fa58.

Kristian Klausen authored Mar 30, 2021 and Jelle van der Waa committed Apr 08, 2021

A extra access_log entry was added with the following commands:
$ cd roles
$ grep -lr access_log | xargs -P 1 -n 1 sed -i '/access_log/ s/\(.*\)\( \)\(\(reduced\|main\);$\)/\1 \3\n\1.json json_\3/'

Kristian Klausen authored Mar 19, 2021 and Jelle van der Waa committed Apr 07, 2021

[1] https://github.com/yandex/gixy/blob/641060d6355fbb5bd71695928a2bf14a9bcb8bf2/docs/en/plugins/aliastraversal.md

Fix #291

With the ping.al.org domain added in[1] and a updated networkmanager
package shipped[2], we can now remove the file from the main domain.

[1] 498d5304 ("Merge branch 'ping' into 'master'")
    fabccd0f (""Move" NM connectivity check file to a subdomain")
[2] https://github.com/archlinux/svntogit-packages/commit/fb573170fc63c18f64eb4f155ed64a966a61b037

Cache urls which urls marks as can be cached by nginx. This offloads our
uwsgi workers and allows for speedier delivery of RSS feeds and other
cached routes.

Due to users misconfiguring their conky to query for rss updates every
second add proper rate limitting to all rss endpoints in nginx.

Giancarlo Razzolini authored Dec 18, 2020 and Jelle van der Waa committed Dec 20, 2020

Since the network manager package is still pointing to http://www.archlinux.org for its check,
add a variable archweb_network_check_domain and change the nginx conf for both the maintenance
and regular, to allow the check to pass for the www site. Once the package is updated to point to
http://archlinux.org and after a reasonable amount of time has passed, we can remove this.

Jan Alexander Steffens (heftig) authored Aug 19, 2020 and Jelle van der Waa committed Oct 03, 2020

Required to get .well-known working with web clients.

Changed the nginx template to handle includes and also reworked the way the dict is used, by using
the dict2items filter on the template directly. We also have create a custom template for ipxe.archlinux.org
using weaker ciphers.

https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#taxing-rewrites

https://github.com/matrix-org/synapse/blob/master/docs/MSC1711_certificates_FAQ.md

For proxy/fastcgi/uwsgi blocks, logging is still set to the old format,
but for everything else (= static data) a reduced format is used that
excludes items that no longer make sense (request_time, remote_user) and
those that are personal information all the time (remote_addr, http_x_forwarded_for).
Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Fully static file and we are not interested in the requests to that.
Signed-off-by: Florian Pritz <bluewind@xinu.at>

This is the same as used on luna and as expected by the zabbix nginx
monitoring service.
Signed-off-by: Florian Pritz <bluewind@xinu.at>

Django generates an unique css, png and JavaScript files when
collectstatic is run. Which allows us to set an expiry of 1 month.
Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl>

At http://www.archlinux.org/check_network_status.txt (no https)

roles/archweb: Make the nginx config able to support preload by redirecting alternate domains to their https version before redirecting then to the main domain.

roles/archweb: Deny iso downloads on the /iso url. All the other downloads are allowed. Also change the location to use the configuration.

roles/archweb: Added a register for virtualenv changes and to deploy archweb in this case. Also changed nginx template to use the main domain.

roles/archweb: Add an alternate domains variable, with the proper templating, redirecting even tls requests to the main domain

roles/archweb: Nginx deployment, domain variable and other improvements.