mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-03-05 05:41:36 +01:00
09cb1c3ed4
There is no reason for not offering (and using it ourselves) rsync mirroring over TLS these days which provides encryption, authentication and integrity. As the pacman database files are unsigned this also provides some protection against MITM tampering. Fix #298
30 lines
880 B
Django/Jinja
30 lines
880 B
Django/Jinja
server {
|
|
listen 873;
|
|
listen [::]:873;
|
|
|
|
access_log /var/log/nginx/{{ mirror_domain }}/stream.log stream;
|
|
access_log /var/log/nginx/{{ mirror_domain }}/stream.log.json json_stream;
|
|
error_log /var/log/nginx/{{ mirror_domain }}/stream.error.log;
|
|
|
|
proxy_pass unix:/run/rsyncd.sock;
|
|
proxy_protocol on;
|
|
}
|
|
{% for domain in mirror_domains %}
|
|
|
|
server {
|
|
listen 874 ssl;
|
|
listen [::]:874 ssl;
|
|
server_name {{ domain }};
|
|
|
|
access_log /var/log/nginx/{{ domain }}/stream.log stream;
|
|
access_log /var/log/nginx/{{ domain }}/stream.log.json json_stream;
|
|
error_log /var/log/nginx/{{ domain }}/stream.error.log;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
|
|
|
|
proxy_pass unix:/run/rsyncd.sock;
|
|
proxy_protocol on;
|
|
}
|
|
{% endfor %}
|