mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-05-03 18:40:40 +02:00
Kristian Klausen
09cb1c3ed4
There is no reason for not offering (and using it ourselves) rsync mirroring over TLS these days which provides encryption, authentication and integrity. As the pacman database files are unsigned this also provides some protection against MITM tampering. Fix #298
28 lines
907 B
Django/Jinja
28 lines
907 B
Django/Jinja
server {
|
|
listen 873;
|
|
listen [::]:873;
|
|
|
|
access_log /var/log/nginx/{{ repos_rsync_domain }}/stream.log stream;
|
|
access_log /var/log/nginx/{{ repos_rsync_domain }}/stream.log.json json_stream;
|
|
error_log /var/log/nginx/{{ repos_rsync_domain }}/stream.error.log;
|
|
|
|
proxy_pass unix:/run/rsyncd.sock;
|
|
proxy_protocol on;
|
|
}
|
|
|
|
server {
|
|
listen 874 ssl;
|
|
listen [::]:874 ssl;
|
|
server_name {{ repos_rsync_domain }};
|
|
|
|
access_log /var/log/nginx/{{ repos_rsync_domain }}/stream.log stream;
|
|
access_log /var/log/nginx/{{ repos_rsync_domain }}/stream.log.json json_stream;
|
|
error_log /var/log/nginx/{{ repos_rsync_domain }}/stream.error.log;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/{{ repos_domain }}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/{{ repos_domain }}/privkey.pem;
|
|
|
|
proxy_pass unix:/run/rsyncd.sock;
|
|
proxy_protocol on;
|
|
}
|