mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-10 19:40:21 +02:00
Kristian Klausen
dbb77610b5
Let's Encrypt recently changed to their "Generation Y" intermediates[1], resulting in a longer chain. Before: EE ← E7/E8 ← ISRG Root X1 After: EE ← YE1/YE2 ← Root YE ← ISRG Root X2 ← ISRG Root X1 (ISRG Root X2 is part of our trust store, so the ISRG Root X1 cross-sign is irrelevant for us) nginx by default uses a verification depth of one[2], meaning: "SSL_CTX_set_verify_depth() and SSL_set_verify_depth() set a limit on the number of certificates between the end-entity and trust-anchor certificates. Neither the end-entity nor the trust-anchor certificates count against depth. If the certificate chain needed to reach a trusted issuer is longer than depth+2, X509_V_ERR_CERT_CHAIN_TOO_LONG will be issued. The depth count is "level 0:peer certificate", "level 1: CA certificate", "level 2: higher level CA certificate", and so on. Setting the maximum depth to 2 allows the levels 0, 1, 2 and 3 (0 being the end-entity and 3 the trust-anchor)."[3] So bump the verification depth to 2 to work with the longer chain. [1] https://community.letsencrypt.org/t/upcoming-let-s-encrypt-profile-changes-on-may-13-20th-and-27th/247049 [2] https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify_depth [3] https://docs.openssl.org/3.6/man3/SSL_CTX_set_verify/#notes
78 lines
2.5 KiB
Django/Jinja
78 lines
2.5 KiB
Django/Jinja
proxy_cache_path /var/lib/nginx/cache levels=1:2 keys_zone=auth_cache:5m inactive=60m;
|
|
|
|
server {
|
|
include snippets/listen-80.conf;
|
|
|
|
include snippets/listen-443.conf;
|
|
server_name {{ repos_domain }} {{repos_rsync_domain}};
|
|
root /srv/ftp;
|
|
|
|
include snippets/letsencrypt.conf;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/{{ repos_domain }}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/{{ repos_domain }}/privkey.pem;
|
|
|
|
access_log /var/log/nginx/{{ repos_domain }}/access.log reduced;
|
|
access_log /var/log/nginx/{{ repos_domain }}/access.log.json json_reduced;
|
|
|
|
location = /lastupdate {
|
|
allow all;
|
|
}
|
|
|
|
location ~ /git(/.*) {
|
|
fastcgi_pass unix:/run/fcgiwrap.sock;
|
|
include fastcgi_params;
|
|
fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
|
|
fastcgi_param GIT_PROJECT_ROOT /srv/repos;
|
|
fastcgi_param PATH_INFO $1;
|
|
}
|
|
|
|
location / {
|
|
satisfy any;
|
|
auth_request /devel/mirrorauth/;
|
|
|
|
{% for host in groups['buildservers'] | sort %}
|
|
# {{ host }}
|
|
{% for address in ['ipv4_address', 'ipv6_address'] if address in hostvars[host] %}
|
|
allow {{ hostvars[host][address] }};
|
|
{% else %}
|
|
# no addresses defined in hostvars
|
|
{% endfor %}
|
|
|
|
{% endfor %}
|
|
autoindex on;
|
|
}
|
|
|
|
location = /devel/mirrorauth/ {
|
|
# Authentication to archweb
|
|
internal;
|
|
proxy_pass https://archlinux.org;
|
|
|
|
# Do not pass the request body, only http authorisation header is required
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
|
|
# Proxy headers
|
|
proxy_set_header Host $proxy_host;
|
|
proxy_set_header X-Sent-From "{{ vault_archweb_x_sent_from_secret }}";
|
|
|
|
# Cache responses from the auth proxy
|
|
proxy_cache auth_cache;
|
|
proxy_cache_key $scheme$proxy_host$uri$http_authorization;
|
|
|
|
# Minimize the number of requests to archweb
|
|
proxy_cache_lock on;
|
|
proxy_cache_use_stale updating;
|
|
proxy_cache_background_update on;
|
|
|
|
# Verify destination TLS cert
|
|
proxy_ssl_verify on;
|
|
proxy_ssl_verify_depth 2;
|
|
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
|
|
|
|
# Send SNI with TLS handshake
|
|
proxy_ssl_server_name on;
|
|
proxy_ssl_name $proxy_host;
|
|
}
|
|
}
|