mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-10 20:00:36 +02:00
Mark HegrebergandChristian Heusel
410f59cb5a
these are all the systems that the new redirect snippet can be cleanly applied to. there are a few others not included, that will need a more manual approach: - gitlab (multiple domains) - mta.sts(multiple domains) - archweb(mutltiple domains, snippets) - buildbtw(dynamic dev domains) - redirects(different structure) - public html(multiple domains) - archweb maintenence(different structure) - maintenence(different structure) some of these might be solvable by tweaking the snippet to accept multiple domains. I'll look into this Co-authored-by: Christian Heusel <christian@heusel.eu>
62 lines
2.0 KiB
Django/Jinja
62 lines
2.0 KiB
Django/Jinja
# uwsgi caching zone
|
|
uwsgi_cache_path /var/lib/nginx/cache/ levels=1:2 keys_zone=sec_cache:5m max_size=1g inactive=60m use_temp_path=off;
|
|
|
|
# limit requests to 5 r/s to block DoS attempts with a burst of 10.
|
|
limit_req_zone $binary_remote_addr zone=sec_req_limit:10m rate=5r/s;
|
|
|
|
# limit http status: 429 Too Many Requests
|
|
limit_req_status 429;
|
|
|
|
upstream security-tracker {
|
|
server unix:///run/uwsgi/security-tracker.sock;
|
|
}
|
|
|
|
include snippets/redirect-80.conf;
|
|
|
|
server {
|
|
include snippets/listen-443.conf;
|
|
server_name {{ security_tracker_domain }};
|
|
|
|
access_log /var/log/nginx/{{ security_tracker_domain }}/access.log reduced;
|
|
access_log /var/log/nginx/{{ security_tracker_domain }}/access.log.json json_reduced;
|
|
error_log /var/log/nginx/{{ security_tracker_domain }}/error.log;
|
|
|
|
acme_certificate letsencrypt;
|
|
ssl_certificate $acme_certificate;
|
|
ssl_certificate_key $acme_certificate_key;
|
|
|
|
location = /google9fb65bdd43709b25.html {
|
|
# verification code for anthraxx
|
|
return 200 "google-site-verification: google9fb65bdd43709b25.html";
|
|
}
|
|
|
|
location /static/ {
|
|
alias {{ security_tracker_dir }}/tracker/static/;
|
|
}
|
|
|
|
# API/RSS endpoint
|
|
location ~* .*(atom|json)$ {
|
|
access_log /var/log/nginx/{{ security_tracker_domain }}/access.log main;
|
|
access_log /var/log/nginx/{{ security_tracker_domain }}/access.log.json json_main;
|
|
|
|
include uwsgi_params;
|
|
uwsgi_pass security-tracker;
|
|
uwsgi_cache sec_cache;
|
|
uwsgi_cache_valid 5m;
|
|
uwsgi_cache_key "$request_method$request_uri";
|
|
|
|
limit_req zone=sec_req_limit burst=5 nodelay;
|
|
}
|
|
|
|
# Web UI endpoint
|
|
location / {
|
|
access_log /var/log/nginx/{{ security_tracker_domain }}/access.log main;
|
|
access_log /var/log/nginx/{{ security_tracker_domain }}/access.log.json json_main;
|
|
|
|
include uwsgi_params;
|
|
uwsgi_pass security-tracker;
|
|
|
|
limit_req zone=sec_req_limit burst=10 nodelay;
|
|
}
|
|
}
|