mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-10 13:00:27 +02:00
Kristian Klausen
09cb1c3ed4
There is no reason for not offering (and using it ourselves) rsync mirroring over TLS these days which provides encryption, authentication and integrity. As the pacman database files are unsigned this also provides some protection against MITM tampering. Fix #298
57 lines
1.8 KiB
YAML
57 lines
1.8 KiB
YAML
- name: Create ssl cert
|
|
include_role:
|
|
name: certificate
|
|
vars:
|
|
domains: ["{{ mirror_domain }}"]
|
|
when: 'mirror_domain is defined'
|
|
|
|
- name: Create ssl cert for geo mirror
|
|
include_role:
|
|
name: certificate
|
|
vars:
|
|
domains: ["{{ geo_mirror_domain }}"]
|
|
challenge: "DNS-01"
|
|
when: "'geo_mirrors' in group_names"
|
|
|
|
- name: Install rsync
|
|
pacman: name=rsync state=present
|
|
|
|
- name: Install rsyncd config
|
|
copy: src=rsyncd.conf dest=/etc/rsyncd.conf owner=root group=root mode=0644
|
|
|
|
- name: Create drop-in directory for rsyncd.socket
|
|
file: path=/etc/systemd/system/rsyncd.socket.d state=directory owner=root group=root mode=0755
|
|
|
|
- name: Install drop-in for rsyncd.socket
|
|
copy: src=rsyncd-override.socket.conf dest=/etc/systemd/system/rsyncd.socket.d/override.conf owner=root group=root mode=0644
|
|
notify: Restart rsyncd.socket
|
|
|
|
- name: Start and enable rsyncd.socket
|
|
service: name=rsyncd.socket enabled=yes state=started
|
|
|
|
- name: Make nginx log dirs
|
|
file: path=/var/log/nginx/{{ item }} state=directory owner=root group=root mode=0755
|
|
loop: "{{ [mirror_domain, geo_mirror_domain] if 'geo_mirrors' in group_names else [mirror_domain] }}"
|
|
when: 'mirror_domain is defined'
|
|
|
|
- name: Set up nginx
|
|
template: src={{ item.src }} dest=/etc/nginx/{{ item.dest }} owner=root group=root mode=0644
|
|
loop:
|
|
- { src: nginx.d.conf.j2, dest: nginx.d/syncrepo.conf }
|
|
- { src: stream.d.conf.j2, dest: stream.d/syncrepo.conf }
|
|
vars:
|
|
mirror_domains: "{{ [mirror_domain, geo_mirror_domain] if 'geo_mirrors' in group_names else [mirror_domain] }}"
|
|
notify:
|
|
- Reload nginx
|
|
when: 'mirror_domain is defined'
|
|
tags: ['nginx']
|
|
|
|
- name: Open firewall holes
|
|
ansible.posix.firewalld: port={{ item }} permanent=true state=enabled immediate=yes
|
|
loop:
|
|
- 873/tcp
|
|
- 874/tcp
|
|
when: configure_firewall
|
|
tags:
|
|
- firewall
|