mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-01-30 03:18:35 +01:00
09cb1c3ed4
There is no reason for not offering (and using it ourselves) rsync mirroring over TLS these days which provides encryption, authentication and integrity. As the pacman database files are unsigned this also provides some protection against MITM tampering. Fix #298
121 lines
3.5 KiB
Django/Jinja
121 lines
3.5 KiB
Django/Jinja
# DO NOT CHANGE rsync.conf, CHANGE rsync.conf.proto INSTEAD!
|
|
# Hosts are managed by archweb, talk to someone that has permission to
|
|
# play with mirrors to get new IP addresses added.
|
|
|
|
use chroot = no
|
|
max connections = 12
|
|
syslog facility = local5
|
|
proxy protocol = true
|
|
pid file = /var/run/rsyncd.pid
|
|
#transfer logging = yes
|
|
transfer logging = no
|
|
motd file = /etc/rsyncd.motd
|
|
timeout = 600
|
|
|
|
# ALLOW ONLY TIERED MIRRORS
|
|
# This effectively disables all sections but *_tier1 and *_auth
|
|
# We keep the configuration around in case we need to revert again
|
|
hosts allow = 127.0.0.1
|
|
|
|
# DENY THE REST
|
|
hosts deny = *
|
|
|
|
[archive]
|
|
path = /srv/archive
|
|
comment = archive
|
|
exclude = .*
|
|
hosts allow = {{ hostvars['archive.archlinux.org']['ipv4_address'] }} {{ hostvars['archive.archlinux.org']['ipv6_address'] }}
|
|
|
|
# Just the release/stable iso/packages (for most mirrors)
|
|
[ftp]
|
|
path = /srv/ftp
|
|
comment = ftp area (most mirrors should use this)
|
|
exclude = /archive/ /other/ /sources/ /*-debug/ /pool/*-debug/ /lastsync.tmp
|
|
|
|
[ftp_tier1]
|
|
path = /srv/ftp
|
|
comment = ftp area (most mirrors should use this)
|
|
exclude = /archive/ /other/ /sources/ /*-debug/ /pool/*-debug/ /lastsync.tmp
|
|
hosts allow = @@ALLOWHOSTS_TIER1@@
|
|
max connections = 0
|
|
|
|
[ftp_auth]
|
|
path = /srv/ftp
|
|
comment = ftp area, passworded (same as 'ftp')
|
|
exclude = /archive/ /other/ /sources/ /*-debug/ /pool/*-debug/ /lastsync.tmp
|
|
hosts allow = *
|
|
auth users = *
|
|
secrets file = /etc/rsyncd.secrets
|
|
max connections = 0
|
|
|
|
# The whole she-bang, except /sources
|
|
[ftpfull]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions, except sources)
|
|
exclude = /sources/ /lastsync.tmp
|
|
|
|
[ftpfull_tier1]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions, except sources)
|
|
exclude = /sources/ /lastsync.tmp
|
|
hosts allow = @@ALLOWHOSTS_TIER1@@
|
|
max connections = 0
|
|
|
|
[ftpfull_auth]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions, except sources)
|
|
exclude = /sources/ /lastsync.tmp
|
|
hosts allow = *
|
|
auth users = *
|
|
secrets file = /etc/rsyncd.secrets
|
|
max connections = 0
|
|
|
|
# The whole she-bang
|
|
[kitchensink]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions)
|
|
exclude = /lastsync.tmp
|
|
hosts allow = {{ hostvars['archlinux.org']['ipv4_address'] }} {{ hostvars['archlinux.org']['ipv6_address'] }}
|
|
|
|
[kitchensink_tier1]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions)
|
|
exclude = /lastsync.tmp
|
|
hosts allow = @@ALLOWHOSTS_TIER1@@ {{ hostvars['archive.archlinux.org']['ipv4_address'] }} {{ hostvars['archive.archlinux.org']['ipv6_address'] }}
|
|
max connections = 0
|
|
|
|
[kitchensink_auth]
|
|
path = /srv/ftp
|
|
comment = ftp area (everything, including very old versions)
|
|
exclude = /lastsync.tmp
|
|
hosts allow = *
|
|
auth users = *
|
|
secrets file = /etc/rsyncd.secrets
|
|
max connections = 0
|
|
|
|
# Debug repositories
|
|
[debug_packages]
|
|
path = /srv/ftp
|
|
comment = debug packages
|
|
exclude = *
|
|
include = /*-debug/*** /pool /pool/*-debug/***
|
|
hosts allow = {{ groups['mirrors'] | map('extract', hostvars, ['ipv4_address']) | join(' ') }} {{ groups['mirrors'] | map('extract', hostvars, ['ipv6_address']) | join(' ') }} {{ hostvars['debuginfod.archlinux.org']['ipv4_address'] }} {{ hostvars['debuginfod.archlinux.org']['ipv6_address'] }}
|
|
max connections = 0
|
|
|
|
# Individual repositories
|
|
[core]
|
|
path = /srv/ftp/core
|
|
comment = core repository
|
|
|
|
[core-testing]
|
|
path = /srv/ftp/core-testing
|
|
comment = core-testing repository
|
|
|
|
[extra]
|
|
path = /srv/ftp/extra
|
|
comment = extra repository
|
|
|
|
[extra-testing]
|
|
path = /srv/ftp/extra-testing
|
|
comment = extra-testing repository
|