mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-10 20:30:31 +02:00
Sven-Hendrik Haase
3262fc7183
rsync 3.5.0 now requires 'proxy protocol hosts' to be set as it would refuse all connections otherwise. See also https://download.samba.org/pub/rsync/NEWS#3.5.0. To figure this out, I took a look at the journal where it said Aug 16 23:10:48 repos.archlinux.org rsyncd[1263114]: proxy protocol rejected from untrusted peer UNDETERMINED (localhost) I figured I might as well try that and it seems to work. The problem is that we use a socket to connect to rsync from nginx and rsync doesn't seem to handle that case specifically. Fixes #863.
123 lines
3.6 KiB
Django/Jinja
123 lines
3.6 KiB
Django/Jinja
# DO NOT CHANGE rsync.conf, CHANGE rsync.conf.proto INSTEAD!
|
|
# Hosts are managed by archweb, talk to someone that has permission to
|
|
# play with mirrors to get new IP addresses added.
|
|
|
|
use chroot = no
|
|
max connections = 12
|
|
syslog facility = local5
|
|
proxy protocol = true
|
|
# rsync sees unix-socket peers (nginx) as host "UNDETERMINED", required since 3.5.0
|
|
proxy protocol hosts = UNDETERMINED
|
|
pid file = /var/run/rsyncd.pid
|
|
#transfer logging = yes
|
|
transfer logging = no
|
|
motd file = /etc/rsyncd.motd
|
|
timeout = 600
|
|
|
|
# ALLOW ONLY TIERED MIRRORS
|
|
# This effectively disables all sections but *_tier1 and *_auth
|
|
# We keep the configuration around in case we need to revert again
|
|
hosts allow = 127.0.0.1
|
|
|
|
# DENY THE REST
|
|
hosts deny = *
|
|
|
|
[archive]
|
|
path = /srv/archive
|
|
comment = archive
|
|
exclude = .*
|
|
hosts allow = {{ hostvars['archive.archlinux.org']['ipv4_address'] }} {{ hostvars['archive.archlinux.org']['ipv6_address'] }}
|
|
|
|
# Just the release/stable iso/packages (for most mirrors)
|
|
[ftp]
|
|
path = /srv/ftp
|
|
comment = ftp area (most mirrors should use this)
|
|
exclude = /archive/ /other/ /sources/ /*-debug/ /pool/*-debug/ /lastsync.tmp
|
|
|
|
[ftp_tier1]
|
|
path = /srv/ftp
|
|
comment = ftp area (most mirrors should use this)
|
|
exclude = /archive/ /other/ /sources/ /*-debug/ /pool/*-debug/ /lastsync.tmp
|
|
hosts allow = @@ALLOWHOSTS_TIER1@@
|
|
max connections = 0
|
|
|
|
[ftp_auth]
|
|
path = /srv/ftp
|
|
comment = ftp area, passworded (same as 'ftp')
|
|
exclude = /archive/ /other/ /sources/ /*-debug/ /pool/*-debug/ /lastsync.tmp
|
|
hosts allow = *
|
|
auth users = *
|
|
secrets file = /etc/rsyncd.secrets
|
|
max connections = 0
|
|
|
|
# The whole she-bang, except /sources
|
|
[ftpfull]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions, except sources)
|
|
exclude = /sources/ /lastsync.tmp
|
|
|
|
[ftpfull_tier1]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions, except sources)
|
|
exclude = /sources/ /lastsync.tmp
|
|
hosts allow = @@ALLOWHOSTS_TIER1@@
|
|
max connections = 0
|
|
|
|
[ftpfull_auth]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions, except sources)
|
|
exclude = /sources/ /lastsync.tmp
|
|
hosts allow = *
|
|
auth users = *
|
|
secrets file = /etc/rsyncd.secrets
|
|
max connections = 0
|
|
|
|
# The whole she-bang
|
|
[kitchensink]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions)
|
|
exclude = /lastsync.tmp
|
|
hosts allow = {{ hostvars['archlinux.org']['ipv4_address'] }} {{ hostvars['archlinux.org']['ipv6_address'] }}
|
|
|
|
[kitchensink_tier1]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions)
|
|
exclude = /lastsync.tmp
|
|
hosts allow = @@ALLOWHOSTS_TIER1@@ {{ hostvars['archive.archlinux.org']['ipv4_address'] }} {{ hostvars['archive.archlinux.org']['ipv6_address'] }}
|
|
max connections = 0
|
|
|
|
[kitchensink_auth]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions)
|
|
exclude = /lastsync.tmp
|
|
hosts allow = *
|
|
auth users = *
|
|
secrets file = /etc/rsyncd.secrets
|
|
max connections = 0
|
|
|
|
# Debug repositories
|
|
[debug_packages]
|
|
path = /srv/ftp
|
|
comment = debug packages
|
|
exclude = *
|
|
include = /*-debug/*** /pool /pool/*-debug/***
|
|
hosts allow = {{ groups['mirrors'] | map('extract', hostvars, ['ipv4_address']) | join(' ') }} {{ groups['mirrors'] | map('extract', hostvars, ['ipv6_address']) | join(' ') }} {{ hostvars['debuginfod.archlinux.org']['ipv4_address'] }} {{ hostvars['debuginfod.archlinux.org']['ipv6_address'] }}
|
|
max connections = 0
|
|
|
|
# Individual repositories
|
|
[core]
|
|
path = /srv/ftp/core
|
|
comment = core repository
|
|
|
|
[core-testing]
|
|
path = /srv/ftp/core-testing
|
|
comment = core-testing repository
|
|
|
|
[extra]
|
|
path = /srv/ftp/extra
|
|
comment = extra repository
|
|
|
|
[extra-testing]
|
|
path = /srv/ftp/extra-testing
|
|
comment = extra-testing repository
|