infrastructure/roles/aurweb/templates/nginx.d.conf.j2

upstream cgit {
    server unix://{{ cgit_socket }};
}

upstream smartgit {
    server unix://{{ smartgit_socket }};
}

# limit Git requests to block Git DoS attempts.
# # grep aurwebgitlimit /var/log/nginx/aur.archlinux.org/error.log | awk '{ print $14 }' | sort | uniq | sort
limit_req_zone $binary_remote_addr zone=aurwebgitlimit:10m rate=30r/m;

# limit general requests to 60 r/m to block DoS attempts.
limit_req_zone $binary_remote_addr zone=aurweblimit:10m rate=60r/m;

limit_req_status 429;

proxy_cache_path  /var/lib/nginx/cache levels=1:2 keys_zone=aurwebcache:10m inactive=60m;

# needed for long server names (dev box)
server_names_hash_bucket_size 128;

# Cache for cgit (uWSGI)
# Keep TTL short to avoid stale views, but long enough to absorb crawler bursts.
# inactive is kept well above the TTL so popular entries survive between visits
# (cgit pages are tiny, max_size holds hundreds of thousands of them).
uwsgi_cache_path /var/lib/nginx/uwsgi-cache
                 levels=1:2
                 keys_zone=cgitcache:50m
                 inactive=24h
                 max_size=5g;

# Rate limits for cgit.
limit_req_zone $binary_remote_addr zone=cgitlight:10m rate=1r/s;

include snippets/redirect-80.conf;

server {
    include      snippets/listen-443.conf;
    server_name  {{ aurweb_domain }};

    access_log off;
    error_log /dev/null;

    acme_certificate     letsencrypt;
    ssl_certificate      $acme_certificate;
    ssl_certificate_key  $acme_certificate_key;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Http-Version $server_protocol;
        proxy_redirect http://{{ aurweb_domain }}:3000/ /;
        # Anubis
        proxy_pass http://127.0.0.1:8923;
        # Bypass Anubis
        # proxy_pass http://127.0.0.1:3000;
    }
}

server {
    set_real_ip_from 127.0.0.1;
    real_ip_header X-Real-IP;
    listen 127.0.0.1:3000;

    access_log   /var/log/nginx/{{ aurweb_domain }}/access.log main;
    access_log   /var/log/nginx/{{ aurweb_domain }}/access.log.json json_main;
    error_log    /var/log/nginx/{{ aurweb_domain }}/error.log;

    root    {{ aurweb_dir }}/static;
    index   index.php;

    location = /robots.txt {
        alias {{ aurweb_dir }}/robots.txt;
    }

{% if aurweb_registration_closed %}
    location ~ /register$ {
        error_page 503 /_registration-closed.html;
        return 503;
    }

    location = /_registration-closed.html {
        internal;
        alias {{ aurweb_registration_closed_page }};
        default_type text/html;
        add_header Retry-After 86400 always;
        add_header Cache-Control "no-store" always;
    }
{% endif %}

    # redirect /tu to /package-maintainer for external links
    location ~ ^/tu($|/.*) {
        return 301 https://aur.archlinux.org/package-maintainer$1;
    }

    #
    # smartgit location for Git Archive repositories
    # Should be shallow-cloned:
    # `git clone --depth=1 https://aur_location/archives/metadata.git`
    #
    # Routes:
    # - /archives/metadata.git
    # - /archives/users.git
    # - /archives/pkgbases.git
    # - /archives/pkgnames.git
    #
    location ~ "^/archives/(metadata|users|pkgbases|pkgnames)(\.git)/(git-(receive|upload)-pack|HEAD|info/refs|objects/(info/(http-)?alternates|packs)|[0-9a-f]{2}/[0-9a-f]{38}|pack/pack-[0-9a-f]{40}\.(pack|idx))" {
        include      uwsgi_params;
        uwsgi_pass   smartgit;
        uwsgi_modifier1 9;
        uwsgi_param  SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
        uwsgi_param  PATH_INFO /$1.git/$3;
        uwsgi_param  GIT_HTTP_EXPORT_ALL "";
        uwsgi_param  GIT_PROJECT_ROOT {{ aurweb_dir }};
    }

    #
    # smartgit location for AUR package git repository
    # Clone packages:
    # `git clone https://aur_location/pkgname.git`
    #
    location ~ "^/([a-z0-9][a-z0-9.+_-]*?)(\.git)?/(git-(receive|upload)-pack|HEAD|info/refs|objects/(info/(http-)?alternates|packs)|[0-9a-f]{2}/[0-9a-f]{38}|pack/pack-[0-9a-f]{40}\.(pack|idx))$" {
	limit_req zone=aurwebgitlimit burst=900 nodelay;
        include      uwsgi_params;
        uwsgi_pass   smartgit;
        uwsgi_modifier1 9;
        uwsgi_param  SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
        uwsgi_param  PATH_INFO /aur.git/$3;
        uwsgi_param  GIT_HTTP_EXPORT_ALL "";
        uwsgi_param  GIT_NAMESPACE $1;
        uwsgi_param  GIT_PROJECT_ROOT {{ aurweb_dir }};
    }

    location = /cgit.js {
        alias /usr/share/webapps/cgit-aurweb/cgit.js;
        expires 7d;
        include snippets/headers.conf;
        add_header Pragma public;
        add_header Cache-Control "public, must-revalidate, proxy-revalidate";
    }

    location ~ ^/cgit {
        limit_req zone=cgitlight burst=5;
        include uwsgi_params;
        rewrite ^/cgit/([^?/]+/[^?]*)?(?:\?(.*))?$ /cgit.cgi?url=$1&$2 last;
        uwsgi_modifier1 9;
        uwsgi_param CGIT_CONFIG {{ aurweb_conf_dir }}/cgitrc;
        uwsgi_pass cgit;

        uwsgi_cache cgitcache;
        uwsgi_cache_key $host$request_uri;
        uwsgi_cache_valid 200 301 302 15m;
        uwsgi_cache_valid 404 30s;
        uwsgi_cache_use_stale error timeout updating http_500 http_503;
        # Serve expired entries instantly and refresh them in the background so
        # expiry never blocks a user-facing request.
        uwsgi_cache_background_update on;
        # Revalidate via If-Modified-Since (cgit sends Last-Modified)
        uwsgi_cache_revalidate on;
        uwsgi_cache_lock on;
        uwsgi_cache_lock_timeout 10s;
        add_header X-Cgit-Cache $upstream_cache_status always;
    }

    location ~ \.gz$ {
        root    {{ aurweb_dir }}/archives;
        default_type text/plain;
        include snippets/headers.conf;
        expires 5m;
    }

    location ~ ^/static/(?:css|js|images)/ {
        rewrite ^/static(/.*)$ $1 break;

        expires 7d;
        include snippets/headers.conf;
        add_header Pragma public;
        add_header Cache-Control "public, must-revalidate, proxy-revalidate";
    }

    location /rpc {
        rewrite ^/rpc.php /rpc last;
        proxy_pass http://127.0.0.1:10666/rpc;
        proxy_set_header X-Forwarded-For $remote_addr;
    }

    location = /rpc/metrics {
{% if aurweb_environment_type == 'prod' %}
        if ($http_authorization != "Bearer {{ vault_goaurrpc_metrics_token }}") {
            return 403;
        }
{% endif %}

        proxy_pass http://127.0.0.1:10666/metrics;
        proxy_set_header X-Forwarded-For $remote_addr;
    }

    location /rss {
{% block asgi_proxy  %}
        # Proxy over to aurweb's ASGI application.
        proxy_pass http://{{ aurweb_asgi_bind }};
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Ssl on;
{% endblock %}

        proxy_cache             aurwebcache;
        proxy_cache_key         $scheme$proxy_host$uri$http_authorization;
        proxy_cache_valid any 1m;
        add_header X-Cache-Status $upstream_cache_status;

        limit_req zone=aurweblimit burst=10 nodelay;
    }

    location / {
{{ self.asgi_proxy() }}

        proxy_cache                     aurwebcache;
        proxy_cache_key                 $scheme$proxy_host$uri$args;
        proxy_cache_valid               200 1m;
        proxy_cache_bypass              $cookie_AURSID;
        proxy_no_cache                  $cookie_AURSID;
        proxy_cache_lock                on;
        proxy_cache_lock_timeout        10s;
        proxy_cache_use_stale           error timeout updating http_500 http_503;
        proxy_cache_background_update   on;
        add_header X-Cache-Status $upstream_cache_status;

        limit_req zone=aurweblimit burst=10 nodelay;
    }

    location = /metrics {
{% if aurweb_environment_type == 'prod' %}
        if ($http_authorization != "Bearer {{ vault_aurweb_metrics_token }}") {
            return 403;
        }
{% endif %}

{{ self.asgi_proxy() }}
    }
}