[ansible] Fixup proxies-website
by Nicolas Chauvet
commit 05975b51c896d82693c5dd5076b6723595468b10
Author: Nicolas Chauvet <kwizart(a)gmail.com>
Date: Fri Jul 22 14:05:23 2016 +0200
Fixup proxies-website
playbooks/include/proxies-websites.yml | 16 +++++++++++-----
1 files changed, 11 insertions(+), 5 deletions(-)
---
diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml
index 06f5ee5..4d87109 100644
--- a/playbooks/include/proxies-websites.yml
+++ b/playbooks/include/proxies-websites.yml
@@ -67,15 +67,21 @@
cert_name: fas.rpmfusion.org
- role: httpd/website
- name: lists.rpmfusion.org
- sslonly: true
- cert_name: lists.rpmfusion.org
-
- - role: httpd/website
name: id.rpmfusion.org
server_aliases:
- "*.id.rpmfusion.org"
# Must not be sslonly, because example.id.fedoraproject.org must be reachable
# via plain http for openid identity support
+ sslonly: false
cert_name: id.rpmfusion.org
+ - role: httpd/website
+ name: lists.rpmfusion.org
+ #sslonly: true
+ cert_name: lists.rpmfusion.org
+
+ - role: httpd/website
+ name: pkgs.rpmfusion.org
+ sslonly: false
+ cert_name: pkgs.rpmfusion.org
+
8 years, 4 months
[ansible] A fedora-web and include proxies
by Nicolas Chauvet
commit 3225a9259abe1d39ae665cf4362d0f287d101a1e
Author: Nicolas Chauvet <kwizart(a)gmail.com>
Date: Fri Jul 22 13:34:28 2016 +0200
A fedora-web and include proxies
playbooks/include/proxies-certificates.yml | 21 +++
playbooks/include/proxies-fedora-web.yml | 18 +++
playbooks/include/proxies-haproxy.yml | 22 +++
playbooks/include/proxies-redirects.yml | 39 ++++++
playbooks/include/proxies-rewrites.yml | 58 ++++++++
playbooks/include/proxies-websites.yml | 81 +++++++++++
roles/fedora-web/main/files/cache.conf | 18 +++
roles/fedora-web/main/files/cron-sync-fedora-web | 2 +
roles/fedora-web/main/files/deflate.conf | 29 ++++
roles/fedora-web/main/files/expires.conf | 17 +++
roles/fedora-web/main/files/fedora-web.conf | 24 ++++
roles/fedora-web/main/files/hotspot.conf | 1 +
roles/fedora-web/main/files/languages.conf | 144 ++++++++++++++++++++
roles/fedora-web/main/files/persona.conf | 5 +
roles/fedora-web/main/files/redirects.conf.prod | 23 +++
roles/fedora-web/main/files/redirects.conf.stg | 23 +++
roles/fedora-web/main/tasks/main.yml | 79 +++++++++++
.../main/templates/browserid.rpmfusion.org | 9 ++
roles/fedora-web/main/templates/sponsor.conf | 1 +
19 files changed, 614 insertions(+), 0 deletions(-)
---
diff --git a/playbooks/include/proxies-certificates.yml b/playbooks/include/proxies-certificates.yml
new file mode 100644
index 0000000..ffcff93
--- /dev/null
+++ b/playbooks/include/proxies-certificates.yml
@@ -0,0 +1,21 @@
+- name: Set up those proxy certificates. Good gravy..
+ hosts: proxies-stg:proxies
+ user: root
+ gather_facts: True
+
+ vars_files:
+ - /srv/web/infra/ansible/vars/global.yml
+ - "/srv/private/ansible/vars.yml"
+ - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+ handlers:
+ - include: "{{ handlers }}/restart_services.yml"
+
+ roles:
+
+ - role: httpd/mod_ssl
+
+ - role: httpd/certificate
+ name: wildcard-2016.rpmfusion.org
+ SSLCertificateChainFile: wildcard-2016.rpmfusion.org.intermediate.cert
+
diff --git a/playbooks/include/proxies-fedora-web.yml b/playbooks/include/proxies-fedora-web.yml
new file mode 100644
index 0000000..917221a
--- /dev/null
+++ b/playbooks/include/proxies-fedora-web.yml
@@ -0,0 +1,18 @@
+- name: Set up all that fedora-web goodness. What a wonder!
+ hosts: proxies-stg:proxies
+ user: root
+ gather_facts: True
+
+ vars_files:
+ - /srv/web/infra/ansible/vars/global.yml
+ - "/srv/private/ansible/vars.yml"
+ - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+ handlers:
+ - include: "{{ handlers }}/restart_services.yml"
+
+ roles:
+
+ - role: fedora-web/main
+ website: rpmfusion.org
+
diff --git a/playbooks/include/proxies-haproxy.yml b/playbooks/include/proxies-haproxy.yml
new file mode 100644
index 0000000..4f5ad75
--- /dev/null
+++ b/playbooks/include/proxies-haproxy.yml
@@ -0,0 +1,22 @@
+- name: Set up all the haproxy stuff.
+ hosts: proxies-stg:proxies
+ user: root
+ gather_facts: True
+
+ vars_files:
+ - /srv/web/infra/ansible/vars/global.yml
+ - "/srv/private/ansible/vars.yml"
+ - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+ handlers:
+ - include: "{{ handlers }}/restart_services.yml"
+
+ roles:
+
+ # The base haproxy role that sets it all up
+ - role: haproxy
+
+ # And an additional apache rewrite so we can access the web stats
+ - role: haproxy/rewrite
+ website: admin.rpmfusion.org
+ path: /haproxy
diff --git a/playbooks/include/proxies-redirects.yml b/playbooks/include/proxies-redirects.yml
new file mode 100644
index 0000000..87db0e1
--- /dev/null
+++ b/playbooks/include/proxies-redirects.yml
@@ -0,0 +1,39 @@
+- name: Set up those proxy redirects. Wow!
+ hosts: proxies-stg:proxies
+ user: root
+ gather_facts: True
+
+ vars_files:
+ - /srv/web/infra/ansible/vars/global.yml
+ - "/srv/private/ansible/vars.yml"
+ - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+ handlers:
+ - include: "{{ handlers }}/restart_services.yml"
+
+ roles:
+
+ # Various app redirects
+ - role: httpd/redirect
+ name: community
+ website: admin.rpmfusion.org
+ path: /community
+ target: https://apps.fedoraproject.org/packages
+
+# - role: httpd/redirect
+# name: fas
+# website: fas.rpmfusion.org
+# target: https://admin.rpmfusion.org/accounts/
+
+ - role: httpd/redirect
+ name: fas
+ website: admin.rpmfusion.org
+ path: /accounts
+ target: https://fas.rpmfusion.org
+
+ - role: httpd/redirectmatch
+ name: mailman
+ website: admin.rpmfusion.org
+ regex: /mailman/(.*)$
+ target: https://lists.rpmfusion.org/mailman/$1
+
diff --git a/playbooks/include/proxies-rewrites.yml b/playbooks/include/proxies-rewrites.yml
new file mode 100644
index 0000000..c72f73b
--- /dev/null
+++ b/playbooks/include/proxies-rewrites.yml
@@ -0,0 +1,58 @@
+- name: Set up some domain rewrites.
+ hosts: proxies-stg:proxies
+ user: root
+ gather_facts: True
+
+ vars_files:
+ - /srv/web/infra/ansible/vars/global.yml
+ - "/srv/private/ansible/vars.yml"
+ - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+ handlers:
+ - include: "{{ handlers }}/restart_services.yml"
+
+ roles:
+
+ - role: httpd/domainrewrite
+ destname: admin
+ website: admin.fedoraproject.org
+ target: https://apps.fedoraproject.org/
+
+ - role: httpd/domainrewrite
+ destname: apache-status
+ website: admin.fedoraproject.org
+ path: /status
+
+ - role: httpd/domainrewrite
+ destname: 00-admin
+ website: admin.fedoraproject.org
+ path: ^/favicon.ico$
+ status: 301
+ target: https://fedoraproject.org/static/images/favicon.ico
+
+ - role: httpd/domainrewrite
+ destname: 00-docs
+ website: docs.fedoraproject.org
+ path: ^/favicon.ico$
+ status: 301
+ target: https://fedoraproject.org/static/images/favicon.ico
+
+ - role: httpd/domainrewrite
+ destname: 00-start
+ website: start.fedoraproject.org
+ path: ^/favicon.ico$
+ status: 301
+ target: https://fedoraproject.org/static/images/favicon.ico
+
+ - role: httpd/domainrewrite
+ destname: translate
+ website: translate.fedoraproject.org
+ # TODO - At some point, this will switch to fedora.zanata.org
+ target: https://fedora.transifex.net/
+
+ - role: httpd/domainrewrite
+ destname: 00-translate-icon
+ website: translate.fedoraproject.org
+ path: ^/favicon.ico$
+ status: 301
+ target: https://fedoraproject.org/static/images/favicon.ico
diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml
new file mode 100644
index 0000000..06f5ee5
--- /dev/null
+++ b/playbooks/include/proxies-websites.yml
@@ -0,0 +1,81 @@
+- name: Set up those proxy websites. My, my..
+ hosts: proxies-stg:proxies
+ user: root
+ gather_facts: True
+
+ vars_files:
+ - /srv/web/infra/ansible/vars/global.yml
+ - "/srv/private/ansible/vars.yml"
+ - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+ handlers:
+ - include: "{{ handlers }}/restart_services.yml"
+
+
+ pre_tasks:
+ - name: Install policycoreutils-python
+ yum: pkg=policycoreutils-python state=present
+
+ - name: Create /srv/web/ for all the goodies.
+ file: >
+ dest=/srv/web state=directory
+ owner=root group=root mode=0755
+ tags:
+ - httpd
+ - httpd/website
+
+ - name: check the selinux context of webdir
+ command: matchpathcon /srv/web
+ register: webdir
+ always_run: yes
+ changed_when: "1 != 1"
+ tags:
+ - config
+ - selinux
+ - httpd
+ - httpd/website
+
+ - name: /srv/web file contexts
+ command: semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"
+ when: webdir.stdout.find('httpd_sys_content_t') == -1
+ tags:
+ - config
+ - selinux
+ - httpd
+ - httpd/website
+
+ roles:
+
+ - role: httpd/website
+ name: rpmfusion.org
+ server_aliases:
+ - localhost
+
+ - role: httpd/website
+ name: admin.rpmfusion.org
+ sslonly: true
+ cert_name: admin.rpmfusion.org
+
+ - role: httpd/website
+ name: bugzilla.rpmfusion.org
+ sslonly: true
+ cert_name: bugzilla.rpmfusion.org
+
+ - role: httpd/website
+ name: fas.rpmfusion.org
+ sslonly: true
+ cert_name: fas.rpmfusion.org
+
+ - role: httpd/website
+ name: lists.rpmfusion.org
+ sslonly: true
+ cert_name: lists.rpmfusion.org
+
+ - role: httpd/website
+ name: id.rpmfusion.org
+ server_aliases:
+ - "*.id.rpmfusion.org"
+ # Must not be sslonly, because example.id.fedoraproject.org must be reachable
+ # via plain http for openid identity support
+ cert_name: id.rpmfusion.org
+
diff --git a/roles/fedora-web/main/files/cache.conf b/roles/fedora-web/main/files/cache.conf
new file mode 100644
index 0000000..05e5a50
--- /dev/null
+++ b/roles/fedora-web/main/files/cache.conf
@@ -0,0 +1,18 @@
+#<IfModule mod_disk_cache.c>
+# CacheRoot /srv/cache/mod_cache
+ # Disabled for normal use, to be enabled on release days
+ # CacheEnable disk /wiki/
+
+# CacheEnable disk /static/
+# CacheEnable disk /wiki/Image:
+# CacheEnable disk /w/skins/
+
+ # This is required for nagios check
+# CacheDisable /wiki/Special:Version
+# CacheDirLevels 5
+# CacheDirLength 3
+# CacheMaxFileSize 512000
+# CacheDefaultExpire 3600
+# CacheIgnoreNoLastMod On
+#</IfModule>
+
diff --git a/roles/fedora-web/main/files/cron-sync-fedora-web b/roles/fedora-web/main/files/cron-sync-fedora-web
new file mode 100644
index 0000000..a3c7406
--- /dev/null
+++ b/roles/fedora-web/main/files/cron-sync-fedora-web
@@ -0,0 +1,2 @@
+# TODO: Make add some locking to this.
+25 * * * * root /usr/bin/rsync --delete -a --no-owner --no-group sundries01::fedoraproject.org/ /srv/web/fedoraproject.org/
diff --git a/roles/fedora-web/main/files/deflate.conf b/roles/fedora-web/main/files/deflate.conf
new file mode 100644
index 0000000..76c9733
--- /dev/null
+++ b/roles/fedora-web/main/files/deflate.conf
@@ -0,0 +1,29 @@
+LoadModule deflate_module modules/mod_deflate.so
+SetOutputFilter DEFLATE
+
+<Location />
+ # Insert filter
+ SetOutputFilter DEFLATE
+
+ # Netscape 4.x has some problems...
+ BrowserMatch ^Mozilla/4 gzip-only-text/html
+
+ # Netscape 4.06-4.08 have some more problems
+ BrowserMatch ^Mozilla/4\.0[678] no-gzip
+
+ # MSIE masquerades as Netscape, but it is fine
+ # BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
+
+ # NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48
+ # the above regex won't work. You can use the following
+ # workaround to get the desired effect:
+ BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
+
+ # Don't compress images
+ SetEnvIfNoCase Request_URI \
+ \.(?:gif|jpe?g|png)$ no-gzip dont-vary
+
+ # Make sure proxies don't deliver the wrong content
+ Header append Vary User-Agent env=!dont-vary
+</Location>
+
diff --git a/roles/fedora-web/main/files/expires.conf b/roles/fedora-web/main/files/expires.conf
new file mode 100644
index 0000000..4c7262d
--- /dev/null
+++ b/roles/fedora-web/main/files/expires.conf
@@ -0,0 +1,17 @@
+ExpiresActive On
+ExpiresByType image/png "access plus 1 week"
+ExpiresByType image/gif "access plus 1 week"
+ExpiresByType image/vnd.microsoft.icon "access plus 1 week"
+<Location /static/>
+ ExpiresDefault "access plus 1 week"
+</Location>
+FileETag none
+#
+# We want this file to never cache, it's used to determine if a client is
+# behind a caching proxy of some kind.
+#
+<LocationMatch "/static/hotspot.txt$">
+ Header set Cache-Control "must-revalidate"
+ ExpiresActive On
+ ExpiresDefault "now"
+</LocationMatch>
diff --git a/roles/fedora-web/main/files/fedora-web.conf b/roles/fedora-web/main/files/fedora-web.conf
new file mode 100644
index 0000000..8cc9b98
--- /dev/null
+++ b/roles/fedora-web/main/files/fedora-web.conf
@@ -0,0 +1,24 @@
+Alias /favicon.ico /srv/web/rpmfusion.org/static/images/favicon.ico
+DocumentRoot /srv/web/rpmfusion.org/
+
+ErrorDocument 404 /e/404
+
+FileETag MTime Size
+
+AddType image/svg+xml .svg
+AddType image/svg+xml .svgz
+AddEncoding gzip .svgz
+<FilesMatch \.svgz$>
+ <IfModule mod_gzip.c>
+ mod_gzip_on No
+ </IfModule>
+</FilesMatch>
+
+<FilesMatch \-webfont>
+ SetEnvIfNoCase Origin "https?://.*\.rpmfusion\.org" ACAO=$0
+ Header set Access-Control-Allow-Origin %{ACAO}e env=ACAO
+</FilesMatch>
+
+<Location /static/checksums/>
+ Options Indexes
+</Location>
diff --git a/roles/fedora-web/main/files/hotspot.conf b/roles/fedora-web/main/files/hotspot.conf
new file mode 100644
index 0000000..8a52229
--- /dev/null
+++ b/roles/fedora-web/main/files/hotspot.conf
@@ -0,0 +1 @@
+Alias /static/hotspot.txt /srv/web/hotspot.txt
diff --git a/roles/fedora-web/main/files/languages.conf b/roles/fedora-web/main/files/languages.conf
new file mode 100644
index 0000000..4db0ada
--- /dev/null
+++ b/roles/fedora-web/main/files/languages.conf
@@ -0,0 +1,144 @@
+# Define the correct MIME type for specific languages
+AddType text/html .bn
+AddType text/html .el
+AddType text/html .nb
+AddType text/html .pl
+AddType text/html .tr
+AddType text/html .es
+
+AddLanguage af .af
+AddLanguage ar .ar
+AddLanguage as .as
+AddLanguage ast .ast
+AddLanguage bal .bal
+AddLanguage bg .bg
+AddLanguage bn .bn
+AddLanguage bn-in .bn_IN
+AddLanguage br .br
+AddLanguage ca .ca
+AddLanguage cs .cs
+AddLanguage da .da
+AddLanguage de .de
+AddLanguage de-ch .de_CH
+AddLanguage el .el
+AddLanguage en .en
+AddLanguage en-gb .en_GB
+AddLanguage es .es
+AddLanguage eu .eu
+AddLanguage fa .fa
+AddLanguage fi .fi
+AddLanguage fr .fr
+AddLanguage gl .gl
+AddLanguage gu .gu
+AddLanguage he .he
+AddLanguage hi .hi
+AddLanguage hu .hu
+AddLanguage ia .ia
+AddLanguage id .id
+AddLanguage is .is
+AddLanguage it .it
+AddLanguage ja .ja
+AddLanguage ka .ka
+AddLanguage kn .kn
+AddLanguage ko .ko
+AddLanguage lv .lv
+AddLanguage ml .ml
+AddLanguage mr .mr
+AddLanguage nb .nb
+AddLanguage nl .nl
+AddLanguage or .or
+AddLanguage pa .pa
+AddLanguage pl .pl
+AddLanguage pt .pt
+AddLanguage pt-br .pt_BR
+AddLanguage ro .ro
+AddLanguage ru .ru
+AddLanguage sk .sk
+AddLanguage sq .sq
+AddLanguage sr .sr
+AddLanguage sv .sv
+AddLanguage ta .ta
+AddLanguage te .te
+AddLanguage tg .tg
+AddLanguage th .th
+AddLanguage tr .tr
+AddLanguage uk .uk
+AddLanguage vi .vi
+AddLanguage zh-cn .zh_CN
+AddLanguage zh-tw .zh_TW
+
+LanguagePriority en
+ForceLanguagePriority Prefer Fallback
+
+AddDefaultCharset utf-8
+
+RewriteEngine on
+
+RewriteCond %{QUERY_STRING} ^lang=(af|ar|as|ast|bal|bg|bn|bn_IN|br|ca|cs|da|de|de_CH|el|en|en_GB|es|eu|fa|fi|fr|gl|gu|he|hi|hu|ia|id|is|it|ja|ka|kn|ko|lv|ml|mr|nb|nl|or|pa|pl|pt|pt_BR|ro|ru|sk|sq|sr|sv|ta|te|tg|th|tr|uk|vi|zh_CN|zh_TW)$
+RewriteRule ^(?:/(?:af|ar|as|ast|bal|bg|bn|bn_IN|br|ca|cs|da|de|de_CH|el|en|en_GB|es|eu|fa|fi|fr|gl|gu|he|hi|hu|ia|id|is|it|ja|ka|kn|ko|lv|ml|mr|nb|nl|or|pa|pl|pt|pt_BR|ro|ru|sk|sq|sr|sv|ta|te|tg|th|tr|uk|vi|zh_CN|zh_TW))?(/.*)$ /%1$1? [R=301]
+AliasMatch ^(?:/(?:af|ar|as|ast|bal|bg|bn|bn_IN|br|ca|cs|da|de|de_CH|el|en|en_GB|es|eu|fa|fi|fr|gl|gu|he|hi|hu|ia|id|is|it|ja|ka|kn|ko|lv|ml|mr|nb|nl|or|pa|pl|pt|pt_BR|ro|ru|sk|sq|sr|sv|ta|te|tg|th|tr|uk|vi|zh_CN|zh_TW))(/.*)?$ /srv/web/fedoraproject.org$1
+
+<Directory /srv/web/fedoraproject.org>
+ Options MultiViews
+
+ SetEnvIf Request_URI ^/af/ prefer-language=af
+ SetEnvIf Request_URI ^/ar/ prefer-language=ar
+ SetEnvIf Request_URI ^/as/ prefer-language=as
+ SetEnvIf Request_URI ^/ast/ prefer-language=ast
+ SetEnvIf Request_URI ^/bal/ prefer-language=bal
+ SetEnvIf Request_URI ^/bg/ prefer-language=bg
+ SetEnvIf Request_URI ^/bn/ prefer-language=bn
+ SetEnvIf Request_URI ^/bn_IN/ prefer-language=bn-in
+ SetEnvIf Request_URI ^/br/ prefer-language=br
+ SetEnvIf Request_URI ^/ca/ prefer-language=ca
+ SetEnvIf Request_URI ^/cs/ prefer-language=cs
+ SetEnvIf Request_URI ^/da/ prefer-language=da
+ SetEnvIf Request_URI ^/de/ prefer-language=de
+ SetEnvIf Request_URI ^/de_CH/ prefer-language=de-ch
+ SetEnvIf Request_URI ^/el/ prefer-language=el
+ SetEnvIf Request_URI ^/en/ prefer-language=en
+ SetEnvIf Request_URI ^/en_GB/ prefer-language=en-gb
+ SetEnvIf Request_URI ^/es/ prefer-language=es
+ SetEnvIf Request_URI ^/eu/ prefer-language=eu
+ SetEnvIf Request_URI ^/fa/ prefer-language=fa
+ SetEnvIf Request_URI ^/fi/ prefer-language=fi
+ SetEnvIf Request_URI ^/fr/ prefer-language=fr
+ SetEnvIf Request_URI ^/gl/ prefer-language=gl
+ SetEnvIf Request_URI ^/gu/ prefer-language=gu
+ SetEnvIf Request_URI ^/he/ prefer-language=he
+ SetEnvIf Request_URI ^/hi/ prefer-language=hi
+ SetEnvIf Request_URI ^/hu/ prefer-language=hu
+ SetEnvIf Request_URI ^/ia/ prefer-language=ia
+ SetEnvIf Request_URI ^/id/ prefer-language=id
+ SetEnvIf Request_URI ^/is/ prefer-language=is
+ SetEnvIf Request_URI ^/it/ prefer-language=it
+ SetEnvIf Request_URI ^/ja/ prefer-language=ja
+ SetEnvIf Request_URI ^/ka/ prefer-language=ka
+ SetEnvIf Request_URI ^/kn/ prefer-language=kn
+ SetEnvIf Request_URI ^/ko/ prefer-language=ko
+ SetEnvIf Request_URI ^/lv/ prefer-language=lv
+ SetEnvIf Request_URI ^/ml/ prefer-language=ml
+ SetEnvIf Request_URI ^/mr/ prefer-language=mr
+ SetEnvIf Request_URI ^/nb/ prefer-language=nb
+ SetEnvIf Request_URI ^/nl/ prefer-language=nl
+ SetEnvIf Request_URI ^/or/ prefer-language=or
+ SetEnvIf Request_URI ^/pa/ prefer-language=pa
+ SetEnvIf Request_URI ^/pl/ prefer-language=pl
+ SetEnvIf Request_URI ^/pt/ prefer-language=pt
+ SetEnvIf Request_URI ^/pt_BR/ prefer-language=pt-br
+ SetEnvIf Request_URI ^/ro/ prefer-language=ro
+ SetEnvIf Request_URI ^/ru/ prefer-language=ru
+ SetEnvIf Request_URI ^/sk/ prefer-language=sk
+ SetEnvIf Request_URI ^/sq/ prefer-language=sq
+ SetEnvIf Request_URI ^/sr/ prefer-language=sr
+ SetEnvIf Request_URI ^/sv/ prefer-language=sv
+ SetEnvIf Request_URI ^/ta/ prefer-language=ta
+ SetEnvIf Request_URI ^/te/ prefer-language=te
+ SetEnvIf Request_URI ^/tg/ prefer-language=tg
+ SetEnvIf Request_URI ^/th/ prefer-language=th
+ SetEnvIf Request_URI ^/tr/ prefer-language=tr
+ SetEnvIf Request_URI ^/uk/ prefer-language=uk
+ SetEnvIf Request_URI ^/vi/ prefer-language=vi
+ SetEnvIf Request_URI ^/zh_CN/ prefer-language=zh-cn
+ SetEnvIf Request_URI ^/zh_TW/ prefer-language=zh-tw
+</Directory>
diff --git a/roles/fedora-web/main/files/persona.conf b/roles/fedora-web/main/files/persona.conf
new file mode 100644
index 0000000..2f00388
--- /dev/null
+++ b/roles/fedora-web/main/files/persona.conf
@@ -0,0 +1,5 @@
+Alias /.well-known/browserid /srv/web/browserid.rpmfusion.org
+
+<Location /.well-known/browserid>
+ ForceType application/json
+</Location>
diff --git a/roles/fedora-web/main/files/redirects.conf.prod b/roles/fedora-web/main/files/redirects.conf.prod
new file mode 100644
index 0000000..4b59472
--- /dev/null
+++ b/roles/fedora-web/main/files/redirects.conf.prod
@@ -0,0 +1,23 @@
+RewriteEngine On
+
+
+# Drop distributed web referrer hits
+RewriteCond %{HTTP_REFERER} ^http://.*/feed/index\.php\?pid2=.*&sid2=.*&mb2=.*&partnerid2=.*&redir=.*&multi=.*&aff_id=.*$
+RewriteCond %{HTTP_REFERER} ^http://playdot.net/.*$
+RewriteCond %{HTTP_REFERER} ^http://www.mailbait.info.*$
+RewriteRule .* - [F]
+
+# Drop connections from .ru site thats spawning thousands of connections at a time.
+RewriteCond %{REMOTE_ADDR} ^95\.24\.237\.122$
+RewriteRule .* - [F]
+
+# Sponsor links should go to the specific sponsor page
+RewriteRule ^(/.*)?/sponsors.*$ https://getfedora.org/sponsors [R=301,L]
+
+RewriteEngine On
+RewriteCond %{HTTPS} off
+RewriteRule ^/([^/]+/)?(keys|verify)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
+
+
+RewriteCond %{HTTP_REFERER} .*fedorproject.*
+RewriteRule .* http://mmcgrath.fedorapeople.org/spam.html [R=301,L]
diff --git a/roles/fedora-web/main/files/redirects.conf.stg b/roles/fedora-web/main/files/redirects.conf.stg
new file mode 100644
index 0000000..ab9f85e
--- /dev/null
+++ b/roles/fedora-web/main/files/redirects.conf.stg
@@ -0,0 +1,23 @@
+RewriteEngine On
+
+# TODO: Are these still necessary?
+RewriteRule ^/CodecBuddy http://fedoraproject.org/wiki/CodecBuddy [NC]
+RewriteRule ^/soc.*$ http://fedoraproject.org/wiki/SummerOfCode [R=301,L]
+
+# Legal redirects
+RewriteRule ^/([^/]+/)?legal/licenses/export https://fedoraproject.org/wiki/Legal:Export [R=301,L]
+RewriteRule ^/([^/]+/)?legal/licenses https://fedoraproject.org/wiki/Legal:Licenses/LicenseAgreement [R=301,L]
+RewriteRule ^/([^/]+/)?legal/trademarks http://fedoraproject.org/wiki/Legal:Trademark_guidelines [R=301,L]
+RewriteRule ^/([^/]+/)?legal https://fedoraproject.org/wiki/Legal:Main [R=301,L]
+
+# Comment this when there is a prerelease available
+RewriteRule ^(/.*)?/get-prerelease.*$ http://fedoramagazine.org/fedora-23-released/ [R=301,L]
+#RewriteRule ^(/.*)?/get-spin-prerelease.*$ $1/get-fedora [R=302]
+
+RewriteEngine On
+RewriteCond %{HTTPS} off
+RewriteRule ^/([^/]+/)?(keys|verify)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
+
+
+RewriteCond %{HTTP_REFERER} .*fedorproject.*
+RewriteRule .* http://mmcgrath.fedorapeople.org/spam.html [R=301,L]
diff --git a/roles/fedora-web/main/tasks/main.yml b/roles/fedora-web/main/tasks/main.yml
new file mode 100644
index 0000000..d0c7cb3
--- /dev/null
+++ b/roles/fedora-web/main/tasks/main.yml
@@ -0,0 +1,79 @@
+- name: Copy in the sync-fedora-web cronjob
+ copy: src=cron-sync-fedora-web dest=/etc/cron.d/sync-fedora-web
+ tags:
+ - fedora-web
+ - fedora-web/main
+
+- name: Copy some config files for {{website}}
+ copy: >
+ src={{item}} dest=/etc/httpd/conf.d/{{website}}/{{item}}
+ owner=root group=root mode=0644
+ with_items:
+ - fedora-web.conf
+ - languages.conf
+ - cache.conf
+ - persona.conf
+ - hotspot.conf
+ - expires.conf
+ - deflate.conf
+ notify:
+ - reload httpd
+ tags:
+ - fedora-web
+ - fedora-web/main
+ - fedora-web/hotspot
+
+- name: And one template (for {{website}})
+ template: >
+ src={{item}} dest=/etc/httpd/conf.d/{{website}}/{{item}}
+ owner=root group=root mode=0644
+ with_items:
+ - sponsor.conf
+ notify:
+ - reload httpd
+ tags:
+ - fedora-web
+ - fedora-web/main
+
+- name: Create a file for hotspot
+ copy: dest=/srv/web/hotspot.txt content="OK"
+ owner=root group=root mode=0644
+ setype=httpd_sys_content_t
+ tags:
+ - fedora-web
+ - fedora-web/main
+ - fedora-web/hotspot
+
+- name: And, copy over a template for browserid
+ template: >
+ src=browserid.rpmfusion.org dest=/srv/web/browserid.rpmfusion.org
+ owner=root group=root mode=0644
+ notify:
+ - reload httpd
+ tags:
+ - fedora-web
+ - fedora-web/main
+
+# TODO -- turn these into redirects in playbooks/groups/proxies-redirect.yml
+- name: Copy over some miscellaneous redirects (for stg)
+ copy: >
+ src=redirects.conf.stg dest=/etc/httpd/conf.d/{{website}}/redirects.conf
+ owner=root group=root mode=0644
+ when: env == "staging"
+ notify:
+ - reload httpd
+ tags:
+ - fedora-web
+ - fedora-web/main
+
+# TODO -- turn these into redirects in playbooks/groups/proxies-redirect.yml
+- name: Copy over some miscellaneous redirects (for prod)
+ copy: >
+ src=redirects.conf.prod dest=/etc/httpd/conf.d/{{website}}/redirects.conf
+ owner=root group=root mode=0644
+ when: env != "staging"
+ notify:
+ - reload httpd
+ tags:
+ - fedora-web
+ - fedora-web/main
diff --git a/roles/fedora-web/main/templates/browserid.rpmfusion.org b/roles/fedora-web/main/templates/browserid.rpmfusion.org
new file mode 100644
index 0000000..7b42252
--- /dev/null
+++ b/roles/fedora-web/main/templates/browserid.rpmfusion.org
@@ -0,0 +1,9 @@
+{
+
+{% if env == "staging" %}
+ "authority": "id.stg.rpmfusion.org"
+{% else %}
+ "authority": "id.rpmfusion.org"
+{% endif %}
+
+}
diff --git a/roles/fedora-web/main/templates/sponsor.conf b/roles/fedora-web/main/templates/sponsor.conf
new file mode 100644
index 0000000..2ee4235
--- /dev/null
+++ b/roles/fedora-web/main/templates/sponsor.conf
@@ -0,0 +1 @@
+Alias /static/js/sponsor.js /srv/web/{{website}}/static/js/sponsors/{{sponsor}}.js
8 years, 4 months
[ansible] Remove mirrorlist3
by Nicolas Chauvet
commit ff43c02002419a72b33c46a23ce855224716e7a1
Author: Nicolas Chauvet <kwizart(a)gmail.com>
Date: Fri Jul 22 11:57:27 2016 +0200
Remove mirrorlist3
inventory/inventory | 3 ---
1 files changed, 0 insertions(+), 3 deletions(-)
---
diff --git a/inventory/inventory b/inventory/inventory
index 8ade802..d43628e 100644
--- a/inventory/inventory
+++ b/inventory/inventory
@@ -16,9 +16,6 @@ ipsilon01.scaleway.rpmfusion.net
[koji]
koji01.online.rpmfusion.net
-[mirrormanager]
-mirrorlist03.scaleway.rpmfusion.net
-
[pkgdb]
pkgdb02.online.rpmfusion.net
8 years, 4 months
[ansible] Fix copr 'might be' future url
by Nicolas Chauvet
commit c3beb058de0f0df76d7d5005882adc8c5e60aeb7
Author: Nicolas Chauvet <kwizart(a)gmail.com>
Date: Fri Jul 22 11:57:11 2016 +0200
Fix copr 'might be' future url
roles/httpd/redirect/templates/redirect.copr.conf | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
diff --git a/roles/httpd/redirect/templates/redirect.copr.conf b/roles/httpd/redirect/templates/redirect.copr.conf
index bf48561..21a3e2e 100644
--- a/roles/httpd/redirect/templates/redirect.copr.conf
+++ b/roles/httpd/redirect/templates/redirect.copr.conf
@@ -1,4 +1,4 @@
RewriteEngine on
RewriteCond %{REQUEST_URI} !^/api/*
RewriteCond %{REQUEST_URI} !^/api_2/*
-RewriteRule ^/(.*) https://copr.fedorainfracloud.org/$1 [L,R]
+RewriteRule ^/(.*) https://copr.rpmfusion.org/$1 [L,R]
8 years, 4 months
[puppet] mirrorlist: add a fifth mirrorlist server for testing
by Adrian Reber
commit 4428999d932d902c5b722a7d7f4c158133279d9c
Author: Adrian Reber <adrian(a)lisas.de>
Date: Sat Jul 16 18:45:00 2016 +0200
mirrorlist: add a fifth mirrorlist server for testing
Signed-off-by: Adrian Reber <adrian(a)lisas.de>
files/dns/rpmfusion.net | 3 ++-
files/dns/rpmfusion.org | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
---
diff --git a/files/dns/rpmfusion.net b/files/dns/rpmfusion.net
index b3b31d0..682b19e 100644
--- a/files/dns/rpmfusion.net
+++ b/files/dns/rpmfusion.net
@@ -1,6 +1,6 @@
$TTL 5M
@ IN SOA ns1.rpmfusion.net. matthias.saou.eu. (
- 2016071402 ; Serial
+ 2016071601 ; Serial
6H ; Refresh
1H ; Retry
5W ; Expire
@@ -53,3 +53,4 @@ mirrorlist01.uase IN A 134.108.44.54
mirrorlist02.mv IN A 81.169.241.26
mirrorlist03.scaleway IN A 163.172.151.63
mirrorlist04.mv IN A 78.47.19.71
+mirrorlist05.ovh IN A 158.69.195.211
diff --git a/files/dns/rpmfusion.org b/files/dns/rpmfusion.org
index ad83ee2..d1e58a5 100644
--- a/files/dns/rpmfusion.org
+++ b/files/dns/rpmfusion.org
@@ -1,6 +1,6 @@
$TTL 5M
@ IN SOA ns1.rpmfusion.net. matthias.saou.eu. (
- 2016071401 ; Serial
+ 2016071601 ; Serial
6H ; Refresh
1H ; Retry
5W ; Expire
@@ -51,3 +51,4 @@ mirrors IN A 81.169.241.26
IN A 163.172.151.63
IN A 78.47.19.71
IN A 134.108.44.54
+ IN A 158.69.195.211
8 years, 4 months
[puppet] mirrorlist: all mirrorlist servers updated to CentOS and ready for production
by Adrian Reber
commit ce776ceea23a1f1d33fef9751e27ed54ac7659fa
Author: Adrian Reber <adrian(a)lisas.de>
Date: Thu Jul 14 16:36:02 2016 +0200
mirrorlist: all mirrorlist servers updated to CentOS and ready for production
Signed-off-by: Adrian Reber <adrian(a)lisas.de>
files/dns/rpmfusion.net | 5 ++++-
files/dns/rpmfusion.org | 3 ++-
2 files changed, 6 insertions(+), 2 deletions(-)
---
diff --git a/files/dns/rpmfusion.net b/files/dns/rpmfusion.net
index c56c986..222c942 100644
--- a/files/dns/rpmfusion.net
+++ b/files/dns/rpmfusion.net
@@ -1,6 +1,6 @@
$TTL 5M
@ IN SOA ns1.rpmfusion.net. matthias.saou.eu. (
- 2016070401 ; Serial
+ 2016071401 ; Serial
6H ; Refresh
1H ; Retry
5W ; Expire
@@ -49,4 +49,7 @@ pkgs01.online IN A 212.129.31.198
; system at uase: university of applied sciences esslingen
hv01.uase IN A 129.143.116.115
+mirrorlist01.uase IN A 134.108.44.54
+mirrorlist02.mv IN A 81.169.241.26
mirrorlist03.scaleway IN A 163.172.151.63
+mirrorlist04.mv IN A 78.47.19.66
diff --git a/files/dns/rpmfusion.org b/files/dns/rpmfusion.org
index d4f506e..ad83ee2 100644
--- a/files/dns/rpmfusion.org
+++ b/files/dns/rpmfusion.org
@@ -1,6 +1,6 @@
$TTL 5M
@ IN SOA ns1.rpmfusion.net. matthias.saou.eu. (
- 2016071303 ; Serial
+ 2016071401 ; Serial
6H ; Refresh
1H ; Retry
5W ; Expire
@@ -50,3 +50,4 @@ download1 IN A 193.28.235.60
mirrors IN A 81.169.241.26
IN A 163.172.151.63
IN A 78.47.19.71
+ IN A 134.108.44.54
8 years, 4 months