July 2016 - sysadmin-notify

by Nicolas Chauvet

commit 05975b51c896d82693c5dd5076b6723595468b10 Author: Nicolas Chauvet <kwizart(a)gmail.com> Date: Fri Jul 22 14:05:23 2016 +0200 Fixup proxies-website playbooks/include/proxies-websites.yml | 16 +++++++++++----- 1 files changed, 11 insertions(+), 5 deletions(-) --- diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index 06f5ee5..4d87109 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -67,15 +67,21 @@ cert_name: fas.rpmfusion.org - role: httpd/website - name: lists.rpmfusion.org - sslonly: true - cert_name: lists.rpmfusion.org - - - role: httpd/website name: id.rpmfusion.org server_aliases: - "*.id.rpmfusion.org" # Must not be sslonly, because example.id.fedoraproject.org must be reachable # via plain http for openid identity support + sslonly: false cert_name: id.rpmfusion.org + - role: httpd/website + name: lists.rpmfusion.org + #sslonly: true + cert_name: lists.rpmfusion.org + + - role: httpd/website + name: pkgs.rpmfusion.org + sslonly: false + cert_name: pkgs.rpmfusion.org +

8 years, 5 months

1
0
0 / 0

[ansible] A fedora-web and include proxies

by Nicolas Chauvet

commit 3225a9259abe1d39ae665cf4362d0f287d101a1e Author: Nicolas Chauvet <kwizart(a)gmail.com> Date: Fri Jul 22 13:34:28 2016 +0200 A fedora-web and include proxies playbooks/include/proxies-certificates.yml | 21 +++ playbooks/include/proxies-fedora-web.yml | 18 +++ playbooks/include/proxies-haproxy.yml | 22 +++ playbooks/include/proxies-redirects.yml | 39 ++++++ playbooks/include/proxies-rewrites.yml | 58 ++++++++ playbooks/include/proxies-websites.yml | 81 +++++++++++ roles/fedora-web/main/files/cache.conf | 18 +++ roles/fedora-web/main/files/cron-sync-fedora-web | 2 + roles/fedora-web/main/files/deflate.conf | 29 ++++ roles/fedora-web/main/files/expires.conf | 17 +++ roles/fedora-web/main/files/fedora-web.conf | 24 ++++ roles/fedora-web/main/files/hotspot.conf | 1 + roles/fedora-web/main/files/languages.conf | 144 ++++++++++++++++++++ roles/fedora-web/main/files/persona.conf | 5 + roles/fedora-web/main/files/redirects.conf.prod | 23 +++ roles/fedora-web/main/files/redirects.conf.stg | 23 +++ roles/fedora-web/main/tasks/main.yml | 79 +++++++++++ .../main/templates/browserid.rpmfusion.org | 9 ++ roles/fedora-web/main/templates/sponsor.conf | 1 + 19 files changed, 614 insertions(+), 0 deletions(-) --- diff --git a/playbooks/include/proxies-certificates.yml b/playbooks/include/proxies-certificates.yml new file mode 100644 index 0000000..ffcff93 --- /dev/null +++ b/playbooks/include/proxies-certificates.yml @@ -0,0 +1,21 @@ +- name: Set up those proxy certificates. Good gravy.. + hosts: proxies-stg:proxies + user: root + gather_facts: True + + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + handlers: + - include: "{{ handlers }}/restart_services.yml" + + roles: + + - role: httpd/mod_ssl + + - role: httpd/certificate + name: wildcard-2016.rpmfusion.org + SSLCertificateChainFile: wildcard-2016.rpmfusion.org.intermediate.cert + diff --git a/playbooks/include/proxies-fedora-web.yml b/playbooks/include/proxies-fedora-web.yml new file mode 100644 index 0000000..917221a --- /dev/null +++ b/playbooks/include/proxies-fedora-web.yml @@ -0,0 +1,18 @@ +- name: Set up all that fedora-web goodness. What a wonder! + hosts: proxies-stg:proxies + user: root + gather_facts: True + + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + handlers: + - include: "{{ handlers }}/restart_services.yml" + + roles: + + - role: fedora-web/main + website: rpmfusion.org + diff --git a/playbooks/include/proxies-haproxy.yml b/playbooks/include/proxies-haproxy.yml new file mode 100644 index 0000000..4f5ad75 --- /dev/null +++ b/playbooks/include/proxies-haproxy.yml @@ -0,0 +1,22 @@ +- name: Set up all the haproxy stuff. + hosts: proxies-stg:proxies + user: root + gather_facts: True + + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + handlers: + - include: "{{ handlers }}/restart_services.yml" + + roles: + + # The base haproxy role that sets it all up + - role: haproxy + + # And an additional apache rewrite so we can access the web stats + - role: haproxy/rewrite + website: admin.rpmfusion.org + path: /haproxy diff --git a/playbooks/include/proxies-redirects.yml b/playbooks/include/proxies-redirects.yml new file mode 100644 index 0000000..87db0e1 --- /dev/null +++ b/playbooks/include/proxies-redirects.yml @@ -0,0 +1,39 @@ +- name: Set up those proxy redirects. Wow! + hosts: proxies-stg:proxies + user: root + gather_facts: True + + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + handlers: + - include: "{{ handlers }}/restart_services.yml" + + roles: + + # Various app redirects + - role: httpd/redirect + name: community + website: admin.rpmfusion.org + path: /community + target: https://apps.fedoraproject.org/packages + +# - role: httpd/redirect +# name: fas +# website: fas.rpmfusion.org +# target: https://admin.rpmfusion.org/accounts/ + + - role: httpd/redirect + name: fas + website: admin.rpmfusion.org + path: /accounts + target: https://fas.rpmfusion.org + + - role: httpd/redirectmatch + name: mailman + website: admin.rpmfusion.org + regex: /mailman/(.*)$ + target: https://lists.rpmfusion.org/mailman/$1 + diff --git a/playbooks/include/proxies-rewrites.yml b/playbooks/include/proxies-rewrites.yml new file mode 100644 index 0000000..c72f73b --- /dev/null +++ b/playbooks/include/proxies-rewrites.yml @@ -0,0 +1,58 @@ +- name: Set up some domain rewrites. + hosts: proxies-stg:proxies + user: root + gather_facts: True + + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + handlers: + - include: "{{ handlers }}/restart_services.yml" + + roles: + + - role: httpd/domainrewrite + destname: admin + website: admin.fedoraproject.org + target: https://apps.fedoraproject.org/ + + - role: httpd/domainrewrite + destname: apache-status + website: admin.fedoraproject.org + path: /status + + - role: httpd/domainrewrite + destname: 00-admin + website: admin.fedoraproject.org + path: ^/favicon.ico$ + status: 301 + target: https://fedoraproject.org/static/images/favicon.ico + + - role: httpd/domainrewrite + destname: 00-docs + website: docs.fedoraproject.org + path: ^/favicon.ico$ + status: 301 + target: https://fedoraproject.org/static/images/favicon.ico + + - role: httpd/domainrewrite + destname: 00-start + website: start.fedoraproject.org + path: ^/favicon.ico$ + status: 301 + target: https://fedoraproject.org/static/images/favicon.ico + + - role: httpd/domainrewrite + destname: translate + website: translate.fedoraproject.org + # TODO - At some point, this will switch to fedora.zanata.org + target: https://fedora.transifex.net/ + + - role: httpd/domainrewrite + destname: 00-translate-icon + website: translate.fedoraproject.org + path: ^/favicon.ico$ + status: 301 + target: https://fedoraproject.org/static/images/favicon.ico diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml new file mode 100644 index 0000000..06f5ee5 --- /dev/null +++ b/playbooks/include/proxies-websites.yml @@ -0,0 +1,81 @@ +- name: Set up those proxy websites. My, my.. + hosts: proxies-stg:proxies + user: root + gather_facts: True + + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + handlers: + - include: "{{ handlers }}/restart_services.yml" + + + pre_tasks: + - name: Install policycoreutils-python + yum: pkg=policycoreutils-python state=present + + - name: Create /srv/web/ for all the goodies. + file: > + dest=/srv/web state=directory + owner=root group=root mode=0755 + tags: + - httpd + - httpd/website + + - name: check the selinux context of webdir + command: matchpathcon /srv/web + register: webdir + always_run: yes + changed_when: "1 != 1" + tags: + - config + - selinux + - httpd + - httpd/website + + - name: /srv/web file contexts + command: semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?" + when: webdir.stdout.find('httpd_sys_content_t') == -1 + tags: + - config + - selinux + - httpd + - httpd/website + + roles: + + - role: httpd/website + name: rpmfusion.org + server_aliases: + - localhost + + - role: httpd/website + name: admin.rpmfusion.org + sslonly: true + cert_name: admin.rpmfusion.org + + - role: httpd/website + name: bugzilla.rpmfusion.org + sslonly: true + cert_name: bugzilla.rpmfusion.org + + - role: httpd/website + name: fas.rpmfusion.org + sslonly: true + cert_name: fas.rpmfusion.org + + - role: httpd/website + name: lists.rpmfusion.org + sslonly: true + cert_name: lists.rpmfusion.org + + - role: httpd/website + name: id.rpmfusion.org + server_aliases: + - "*.id.rpmfusion.org" + # Must not be sslonly, because example.id.fedoraproject.org must be reachable + # via plain http for openid identity support + cert_name: id.rpmfusion.org + diff --git a/roles/fedora-web/main/files/cache.conf b/roles/fedora-web/main/files/cache.conf new file mode 100644 index 0000000..05e5a50 --- /dev/null +++ b/roles/fedora-web/main/files/cache.conf @@ -0,0 +1,18 @@ +#<IfModule mod_disk_cache.c> +# CacheRoot /srv/cache/mod_cache + # Disabled for normal use, to be enabled on release days + # CacheEnable disk /wiki/ + +# CacheEnable disk /static/ +# CacheEnable disk /wiki/Image: +# CacheEnable disk /w/skins/ + + # This is required for nagios check +# CacheDisable /wiki/Special:Version +# CacheDirLevels 5 +# CacheDirLength 3 +# CacheMaxFileSize 512000 +# CacheDefaultExpire 3600 +# CacheIgnoreNoLastMod On +#</IfModule> + diff --git a/roles/fedora-web/main/files/cron-sync-fedora-web b/roles/fedora-web/main/files/cron-sync-fedora-web new file mode 100644 index 0000000..a3c7406 --- /dev/null +++ b/roles/fedora-web/main/files/cron-sync-fedora-web @@ -0,0 +1,2 @@ +# TODO: Make add some locking to this. +25 * * * * root /usr/bin/rsync --delete -a --no-owner --no-group sundries01::fedoraproject.org/ /srv/web/fedoraproject.org/ diff --git a/roles/fedora-web/main/files/deflate.conf b/roles/fedora-web/main/files/deflate.conf new file mode 100644 index 0000000..76c9733 --- /dev/null +++ b/roles/fedora-web/main/files/deflate.conf @@ -0,0 +1,29 @@ +LoadModule deflate_module modules/mod_deflate.so +SetOutputFilter DEFLATE + +<Location /> + # Insert filter + SetOutputFilter DEFLATE + + # Netscape 4.x has some problems... + BrowserMatch ^Mozilla/4 gzip-only-text/html + + # Netscape 4.06-4.08 have some more problems + BrowserMatch ^Mozilla/4\.0[678] no-gzip + + # MSIE masquerades as Netscape, but it is fine + # BrowserMatch \bMSIE !no-gzip !gzip-only-text/html + + # NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48 + # the above regex won't work. You can use the following + # workaround to get the desired effect: + BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html + + # Don't compress images + SetEnvIfNoCase Request_URI \ + \.(?:gif|jpe?g|png)$ no-gzip dont-vary + + # Make sure proxies don't deliver the wrong content + Header append Vary User-Agent env=!dont-vary +</Location> + diff --git a/roles/fedora-web/main/files/expires.conf b/roles/fedora-web/main/files/expires.conf new file mode 100644 index 0000000..4c7262d --- /dev/null +++ b/roles/fedora-web/main/files/expires.conf @@ -0,0 +1,17 @@ +ExpiresActive On +ExpiresByType image/png "access plus 1 week" +ExpiresByType image/gif "access plus 1 week" +ExpiresByType image/vnd.microsoft.icon "access plus 1 week" +<Location /static/> + ExpiresDefault "access plus 1 week" +</Location> +FileETag none +# +# We want this file to never cache, it's used to determine if a client is +# behind a caching proxy of some kind. +# +<LocationMatch "/static/hotspot.txt$"> + Header set Cache-Control "must-revalidate" + ExpiresActive On + ExpiresDefault "now" +</LocationMatch> diff --git a/roles/fedora-web/main/files/fedora-web.conf b/roles/fedora-web/main/files/fedora-web.conf new file mode 100644 index 0000000..8cc9b98 --- /dev/null +++ b/roles/fedora-web/main/files/fedora-web.conf @@ -0,0 +1,24 @@ +Alias /favicon.ico /srv/web/rpmfusion.org/static/images/favicon.ico +DocumentRoot /srv/web/rpmfusion.org/ + +ErrorDocument 404 /e/404 + +FileETag MTime Size + +AddType image/svg+xml .svg +AddType image/svg+xml .svgz +AddEncoding gzip .svgz +<FilesMatch \.svgz$> + <IfModule mod_gzip.c> + mod_gzip_on No + </IfModule> +</FilesMatch> + +<FilesMatch \-webfont> + SetEnvIfNoCase Origin "https?://.*\.rpmfusion\.org" ACAO=$0 + Header set Access-Control-Allow-Origin %{ACAO}e env=ACAO +</FilesMatch> + +<Location /static/checksums/> + Options Indexes +</Location> diff --git a/roles/fedora-web/main/files/hotspot.conf b/roles/fedora-web/main/files/hotspot.conf new file mode 100644 index 0000000..8a52229 --- /dev/null +++ b/roles/fedora-web/main/files/hotspot.conf @@ -0,0 +1 @@ +Alias /static/hotspot.txt /srv/web/hotspot.txt diff --git a/roles/fedora-web/main/files/languages.conf b/roles/fedora-web/main/files/languages.conf new file mode 100644 index 0000000..4db0ada --- /dev/null +++ b/roles/fedora-web/main/files/languages.conf @@ -0,0 +1,144 @@ +# Define the correct MIME type for specific languages +AddType text/html .bn +AddType text/html .el +AddType text/html .nb +AddType text/html .pl +AddType text/html .tr +AddType text/html .es + +AddLanguage af .af +AddLanguage ar .ar +AddLanguage as .as +AddLanguage ast .ast +AddLanguage bal .bal +AddLanguage bg .bg +AddLanguage bn .bn +AddLanguage bn-in .bn_IN +AddLanguage br .br +AddLanguage ca .ca +AddLanguage cs .cs +AddLanguage da .da +AddLanguage de .de +AddLanguage de-ch .de_CH +AddLanguage el .el +AddLanguage en .en +AddLanguage en-gb .en_GB +AddLanguage es .es +AddLanguage eu .eu +AddLanguage fa .fa +AddLanguage fi .fi +AddLanguage fr .fr +AddLanguage gl .gl +AddLanguage gu .gu +AddLanguage he .he +AddLanguage hi .hi +AddLanguage hu .hu +AddLanguage ia .ia +AddLanguage id .id +AddLanguage is .is +AddLanguage it .it +AddLanguage ja .ja +AddLanguage ka .ka +AddLanguage kn .kn +AddLanguage ko .ko +AddLanguage lv .lv +AddLanguage ml .ml +AddLanguage mr .mr +AddLanguage nb .nb +AddLanguage nl .nl +AddLanguage or .or +AddLanguage pa .pa +AddLanguage pl .pl +AddLanguage pt .pt +AddLanguage pt-br .pt_BR +AddLanguage ro .ro +AddLanguage ru .ru +AddLanguage sk .sk +AddLanguage sq .sq +AddLanguage sr .sr +AddLanguage sv .sv +AddLanguage ta .ta +AddLanguage te .te +AddLanguage tg .tg +AddLanguage th .th +AddLanguage tr .tr +AddLanguage uk .uk +AddLanguage vi .vi +AddLanguage zh-cn .zh_CN +AddLanguage zh-tw .zh_TW + +LanguagePriority en +ForceLanguagePriority Prefer Fallback + +AddDefaultCharset utf-8 + +RewriteEngine on + +RewriteCond %{QUERY_STRING} ^lang=(af|ar|as|ast|bal|bg|bn|bn_IN|br|ca|cs|da|de|de_CH|el|en|en_GB|es|eu|fa|fi|fr|gl|gu|he|hi|hu|ia|id|is|it|ja|ka|kn|ko|lv|ml|mr|nb|nl|or|pa|pl|pt|pt_BR|ro|ru|sk|sq|sr|sv|ta|te|tg|th|tr|uk|vi|zh_CN|zh_TW)$ +RewriteRule ^(?:/(?:af|ar|as|ast|bal|bg|bn|bn_IN|br|ca|cs|da|de|de_CH|el|en|en_GB|es|eu|fa|fi|fr|gl|gu|he|hi|hu|ia|id|is|it|ja|ka|kn|ko|lv|ml|mr|nb|nl|or|pa|pl|pt|pt_BR|ro|ru|sk|sq|sr|sv|ta|te|tg|th|tr|uk|vi|zh_CN|zh_TW))?(/.*)$ /%1$1? [R=301] +AliasMatch ^(?:/(?:af|ar|as|ast|bal|bg|bn|bn_IN|br|ca|cs|da|de|de_CH|el|en|en_GB|es|eu|fa|fi|fr|gl|gu|he|hi|hu|ia|id|is|it|ja|ka|kn|ko|lv|ml|mr|nb|nl|or|pa|pl|pt|pt_BR|ro|ru|sk|sq|sr|sv|ta|te|tg|th|tr|uk|vi|zh_CN|zh_TW))(/.*)?$ /srv/web/fedoraproject.org$1 + +<Directory /srv/web/fedoraproject.org> + Options MultiViews + + SetEnvIf Request_URI ^/af/ prefer-language=af + SetEnvIf Request_URI ^/ar/ prefer-language=ar + SetEnvIf Request_URI ^/as/ prefer-language=as + SetEnvIf Request_URI ^/ast/ prefer-language=ast + SetEnvIf Request_URI ^/bal/ prefer-language=bal + SetEnvIf Request_URI ^/bg/ prefer-language=bg + SetEnvIf Request_URI ^/bn/ prefer-language=bn + SetEnvIf Request_URI ^/bn_IN/ prefer-language=bn-in + SetEnvIf Request_URI ^/br/ prefer-language=br + SetEnvIf Request_URI ^/ca/ prefer-language=ca + SetEnvIf Request_URI ^/cs/ prefer-language=cs + SetEnvIf Request_URI ^/da/ prefer-language=da + SetEnvIf Request_URI ^/de/ prefer-language=de + SetEnvIf Request_URI ^/de_CH/ prefer-language=de-ch + SetEnvIf Request_URI ^/el/ prefer-language=el + SetEnvIf Request_URI ^/en/ prefer-language=en + SetEnvIf Request_URI ^/en_GB/ prefer-language=en-gb + SetEnvIf Request_URI ^/es/ prefer-language=es + SetEnvIf Request_URI ^/eu/ prefer-language=eu + SetEnvIf Request_URI ^/fa/ prefer-language=fa + SetEnvIf Request_URI ^/fi/ prefer-language=fi + SetEnvIf Request_URI ^/fr/ prefer-language=fr + SetEnvIf Request_URI ^/gl/ prefer-language=gl + SetEnvIf Request_URI ^/gu/ prefer-language=gu + SetEnvIf Request_URI ^/he/ prefer-language=he + SetEnvIf Request_URI ^/hi/ prefer-language=hi + SetEnvIf Request_URI ^/hu/ prefer-language=hu + SetEnvIf Request_URI ^/ia/ prefer-language=ia + SetEnvIf Request_URI ^/id/ prefer-language=id + SetEnvIf Request_URI ^/is/ prefer-language=is + SetEnvIf Request_URI ^/it/ prefer-language=it + SetEnvIf Request_URI ^/ja/ prefer-language=ja + SetEnvIf Request_URI ^/ka/ prefer-language=ka + SetEnvIf Request_URI ^/kn/ prefer-language=kn + SetEnvIf Request_URI ^/ko/ prefer-language=ko + SetEnvIf Request_URI ^/lv/ prefer-language=lv + SetEnvIf Request_URI ^/ml/ prefer-language=ml + SetEnvIf Request_URI ^/mr/ prefer-language=mr + SetEnvIf Request_URI ^/nb/ prefer-language=nb + SetEnvIf Request_URI ^/nl/ prefer-language=nl + SetEnvIf Request_URI ^/or/ prefer-language=or + SetEnvIf Request_URI ^/pa/ prefer-language=pa + SetEnvIf Request_URI ^/pl/ prefer-language=pl + SetEnvIf Request_URI ^/pt/ prefer-language=pt + SetEnvIf Request_URI ^/pt_BR/ prefer-language=pt-br + SetEnvIf Request_URI ^/ro/ prefer-language=ro + SetEnvIf Request_URI ^/ru/ prefer-language=ru + SetEnvIf Request_URI ^/sk/ prefer-language=sk + SetEnvIf Request_URI ^/sq/ prefer-language=sq + SetEnvIf Request_URI ^/sr/ prefer-language=sr + SetEnvIf Request_URI ^/sv/ prefer-language=sv + SetEnvIf Request_URI ^/ta/ prefer-language=ta + SetEnvIf Request_URI ^/te/ prefer-language=te + SetEnvIf Request_URI ^/tg/ prefer-language=tg + SetEnvIf Request_URI ^/th/ prefer-language=th + SetEnvIf Request_URI ^/tr/ prefer-language=tr + SetEnvIf Request_URI ^/uk/ prefer-language=uk + SetEnvIf Request_URI ^/vi/ prefer-language=vi + SetEnvIf Request_URI ^/zh_CN/ prefer-language=zh-cn + SetEnvIf Request_URI ^/zh_TW/ prefer-language=zh-tw +</Directory> diff --git a/roles/fedora-web/main/files/persona.conf b/roles/fedora-web/main/files/persona.conf new file mode 100644 index 0000000..2f00388 --- /dev/null +++ b/roles/fedora-web/main/files/persona.conf @@ -0,0 +1,5 @@ +Alias /.well-known/browserid /srv/web/browserid.rpmfusion.org + +<Location /.well-known/browserid> + ForceType application/json +</Location> diff --git a/roles/fedora-web/main/files/redirects.conf.prod b/roles/fedora-web/main/files/redirects.conf.prod new file mode 100644 index 0000000..4b59472 --- /dev/null +++ b/roles/fedora-web/main/files/redirects.conf.prod @@ -0,0 +1,23 @@ +RewriteEngine On + + +# Drop distributed web referrer hits +RewriteCond %{HTTP_REFERER} ^http://.*/feed/index\.php\?pid2=.*&sid2=.*&mb2=.*&partnerid2=.*&redir=.*&multi=.*&aff_id=.*$ +RewriteCond %{HTTP_REFERER} ^http://playdot.net/.*$ +RewriteCond %{HTTP_REFERER} ^http://www.mailbait.info.*$ +RewriteRule .* - [F] + +# Drop connections from .ru site thats spawning thousands of connections at a time. +RewriteCond %{REMOTE_ADDR} ^95\.24\.237\.122$ +RewriteRule .* - [F] + +# Sponsor links should go to the specific sponsor page +RewriteRule ^(/.*)?/sponsors.*$ https://getfedora.org/sponsors [R=301,L] + +RewriteEngine On +RewriteCond %{HTTPS} off +RewriteRule ^/([^/]+/)?(keys|verify)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] + + +RewriteCond %{HTTP_REFERER} .*fedorproject.* +RewriteRule .* http://mmcgrath.fedorapeople.org/spam.html [R=301,L] diff --git a/roles/fedora-web/main/files/redirects.conf.stg b/roles/fedora-web/main/files/redirects.conf.stg new file mode 100644 index 0000000..ab9f85e --- /dev/null +++ b/roles/fedora-web/main/files/redirects.conf.stg @@ -0,0 +1,23 @@ +RewriteEngine On + +# TODO: Are these still necessary? +RewriteRule ^/CodecBuddy http://fedoraproject.org/wiki/CodecBuddy [NC] +RewriteRule ^/soc.*$ http://fedoraproject.org/wiki/SummerOfCode [R=301,L] + +# Legal redirects +RewriteRule ^/([^/]+/)?legal/licenses/export https://fedoraproject.org/wiki/Legal:Export [R=301,L] +RewriteRule ^/([^/]+/)?legal/licenses https://fedoraproject.org/wiki/Legal:Licenses/LicenseAgreement [R=301,L] +RewriteRule ^/([^/]+/)?legal/trademarks http://fedoraproject.org/wiki/Legal:Trademark_guidelines [R=301,L] +RewriteRule ^/([^/]+/)?legal https://fedoraproject.org/wiki/Legal:Main [R=301,L] + +# Comment this when there is a prerelease available +RewriteRule ^(/.*)?/get-prerelease.*$ http://fedoramagazine.org/fedora-23-released/ [R=301,L] +#RewriteRule ^(/.*)?/get-spin-prerelease.*$ $1/get-fedora [R=302] + +RewriteEngine On +RewriteCond %{HTTPS} off +RewriteRule ^/([^/]+/)?(keys|verify)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] + + +RewriteCond %{HTTP_REFERER} .*fedorproject.* +RewriteRule .* http://mmcgrath.fedorapeople.org/spam.html [R=301,L] diff --git a/roles/fedora-web/main/tasks/main.yml b/roles/fedora-web/main/tasks/main.yml new file mode 100644 index 0000000..d0c7cb3 --- /dev/null +++ b/roles/fedora-web/main/tasks/main.yml @@ -0,0 +1,79 @@ +- name: Copy in the sync-fedora-web cronjob + copy: src=cron-sync-fedora-web dest=/etc/cron.d/sync-fedora-web + tags: + - fedora-web + - fedora-web/main + +- name: Copy some config files for {{website}} + copy: > + src={{item}} dest=/etc/httpd/conf.d/{{website}}/{{item}} + owner=root group=root mode=0644 + with_items: + - fedora-web.conf + - languages.conf + - cache.conf + - persona.conf + - hotspot.conf + - expires.conf + - deflate.conf + notify: + - reload httpd + tags: + - fedora-web + - fedora-web/main + - fedora-web/hotspot + +- name: And one template (for {{website}}) + template: > + src={{item}} dest=/etc/httpd/conf.d/{{website}}/{{item}} + owner=root group=root mode=0644 + with_items: + - sponsor.conf + notify: + - reload httpd + tags: + - fedora-web + - fedora-web/main + +- name: Create a file for hotspot + copy: dest=/srv/web/hotspot.txt content="OK" + owner=root group=root mode=0644 + setype=httpd_sys_content_t + tags: + - fedora-web + - fedora-web/main + - fedora-web/hotspot + +- name: And, copy over a template for browserid + template: > + src=browserid.rpmfusion.org dest=/srv/web/browserid.rpmfusion.org + owner=root group=root mode=0644 + notify: + - reload httpd + tags: + - fedora-web + - fedora-web/main + +# TODO -- turn these into redirects in playbooks/groups/proxies-redirect.yml +- name: Copy over some miscellaneous redirects (for stg) + copy: > + src=redirects.conf.stg dest=/etc/httpd/conf.d/{{website}}/redirects.conf + owner=root group=root mode=0644 + when: env == "staging" + notify: + - reload httpd + tags: + - fedora-web + - fedora-web/main + +# TODO -- turn these into redirects in playbooks/groups/proxies-redirect.yml +- name: Copy over some miscellaneous redirects (for prod) + copy: > + src=redirects.conf.prod dest=/etc/httpd/conf.d/{{website}}/redirects.conf + owner=root group=root mode=0644 + when: env != "staging" + notify: + - reload httpd + tags: + - fedora-web + - fedora-web/main diff --git a/roles/fedora-web/main/templates/browserid.rpmfusion.org b/roles/fedora-web/main/templates/browserid.rpmfusion.org new file mode 100644 index 0000000..7b42252 --- /dev/null +++ b/roles/fedora-web/main/templates/browserid.rpmfusion.org @@ -0,0 +1,9 @@ +{ + +{% if env == "staging" %} + "authority": "id.stg.rpmfusion.org" +{% else %} + "authority": "id.rpmfusion.org" +{% endif %} + +} diff --git a/roles/fedora-web/main/templates/sponsor.conf b/roles/fedora-web/main/templates/sponsor.conf new file mode 100644 index 0000000..2ee4235 --- /dev/null +++ b/roles/fedora-web/main/templates/sponsor.conf @@ -0,0 +1 @@ +Alias /static/js/sponsor.js /srv/web/{{website}}/static/js/sponsors/{{sponsor}}.js

8 years, 5 months

1
0
0 / 0

[ansible] Remove mirrorlist3

by Nicolas Chauvet

commit ff43c02002419a72b33c46a23ce855224716e7a1 Author: Nicolas Chauvet <kwizart(a)gmail.com> Date: Fri Jul 22 11:57:27 2016 +0200 Remove mirrorlist3 inventory/inventory | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) --- diff --git a/inventory/inventory b/inventory/inventory index 8ade802..d43628e 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -16,9 +16,6 @@ ipsilon01.scaleway.rpmfusion.net [koji] koji01.online.rpmfusion.net -[mirrormanager] -mirrorlist03.scaleway.rpmfusion.net - [pkgdb] pkgdb02.online.rpmfusion.net

8 years, 5 months

1
0
0 / 0

[ansible] Fix copr 'might be' future url

by Nicolas Chauvet

commit c3beb058de0f0df76d7d5005882adc8c5e60aeb7 Author: Nicolas Chauvet <kwizart(a)gmail.com> Date: Fri Jul 22 11:57:11 2016 +0200 Fix copr 'might be' future url roles/httpd/redirect/templates/redirect.copr.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/roles/httpd/redirect/templates/redirect.copr.conf b/roles/httpd/redirect/templates/redirect.copr.conf index bf48561..21a3e2e 100644 --- a/roles/httpd/redirect/templates/redirect.copr.conf +++ b/roles/httpd/redirect/templates/redirect.copr.conf @@ -1,4 +1,4 @@ RewriteEngine on RewriteCond %{REQUEST_URI} !^/api/* RewriteCond %{REQUEST_URI} !^/api_2/* -RewriteRule ^/(.*) https://copr.fedorainfracloud.org/$1 [L,R] +RewriteRule ^/(.*) https://copr.rpmfusion.org/$1 [L,R]

8 years, 5 months

1
0
0 / 0

[puppet] mirrorlist: add a fifth mirrorlist server for testing

by Adrian Reber

commit 4428999d932d902c5b722a7d7f4c158133279d9c Author: Adrian Reber <adrian(a)lisas.de> Date: Sat Jul 16 18:45:00 2016 +0200 mirrorlist: add a fifth mirrorlist server for testing Signed-off-by: Adrian Reber <adrian(a)lisas.de> files/dns/rpmfusion.net | 3 ++- files/dns/rpmfusion.org | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) --- diff --git a/files/dns/rpmfusion.net b/files/dns/rpmfusion.net index b3b31d0..682b19e 100644 --- a/files/dns/rpmfusion.net +++ b/files/dns/rpmfusion.net @@ -1,6 +1,6 @@ $TTL 5M @ IN SOA ns1.rpmfusion.net. matthias.saou.eu. ( - 2016071402 ; Serial + 2016071601 ; Serial 6H ; Refresh 1H ; Retry 5W ; Expire @@ -53,3 +53,4 @@ mirrorlist01.uase IN A 134.108.44.54 mirrorlist02.mv IN A 81.169.241.26 mirrorlist03.scaleway IN A 163.172.151.63 mirrorlist04.mv IN A 78.47.19.71 +mirrorlist05.ovh IN A 158.69.195.211 diff --git a/files/dns/rpmfusion.org b/files/dns/rpmfusion.org index ad83ee2..d1e58a5 100644 --- a/files/dns/rpmfusion.org +++ b/files/dns/rpmfusion.org @@ -1,6 +1,6 @@ $TTL 5M @ IN SOA ns1.rpmfusion.net. matthias.saou.eu. ( - 2016071401 ; Serial + 2016071601 ; Serial 6H ; Refresh 1H ; Retry 5W ; Expire @@ -51,3 +51,4 @@ mirrors IN A 81.169.241.26 IN A 163.172.151.63 IN A 78.47.19.71 IN A 134.108.44.54 + IN A 158.69.195.211

8 years, 5 months

1
0
0 / 0

[puppet] mirrorlist: use the correct IP for the direct access to mirrorlist04

by Adrian Reber

commit af154e28a26ee83cbdb5f93d64ae63fe025e5bb3 Author: Adrian Reber <adrian(a)lisas.de> Date: Thu Jul 14 17:11:50 2016 +0200 mirrorlist: use the correct IP for the direct access to mirrorlist04 Signed-off-by: Adrian Reber <adrian(a)lisas.de> files/dns/rpmfusion.net | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/files/dns/rpmfusion.net b/files/dns/rpmfusion.net index 222c942..b3b31d0 100644 --- a/files/dns/rpmfusion.net +++ b/files/dns/rpmfusion.net @@ -1,6 +1,6 @@ $TTL 5M @ IN SOA ns1.rpmfusion.net. matthias.saou.eu. ( - 2016071401 ; Serial + 2016071402 ; Serial 6H ; Refresh 1H ; Retry 5W ; Expire @@ -52,4 +52,4 @@ hv01.uase IN A 129.143.116.115 mirrorlist01.uase IN A 134.108.44.54 mirrorlist02.mv IN A 81.169.241.26 mirrorlist03.scaleway IN A 163.172.151.63 -mirrorlist04.mv IN A 78.47.19.66 +mirrorlist04.mv IN A 78.47.19.71

8 years, 5 months

1
0
0 / 0

[puppet] mirrorlist: all mirrorlist servers updated to CentOS and ready for production

by Adrian Reber

commit ce776ceea23a1f1d33fef9751e27ed54ac7659fa Author: Adrian Reber <adrian(a)lisas.de> Date: Thu Jul 14 16:36:02 2016 +0200 mirrorlist: all mirrorlist servers updated to CentOS and ready for production Signed-off-by: Adrian Reber <adrian(a)lisas.de> files/dns/rpmfusion.net | 5 ++++- files/dns/rpmfusion.org | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) --- diff --git a/files/dns/rpmfusion.net b/files/dns/rpmfusion.net index c56c986..222c942 100644 --- a/files/dns/rpmfusion.net +++ b/files/dns/rpmfusion.net @@ -1,6 +1,6 @@ $TTL 5M @ IN SOA ns1.rpmfusion.net. matthias.saou.eu. ( - 2016070401 ; Serial + 2016071401 ; Serial 6H ; Refresh 1H ; Retry 5W ; Expire @@ -49,4 +49,7 @@ pkgs01.online IN A 212.129.31.198 ; system at uase: university of applied sciences esslingen hv01.uase IN A 129.143.116.115 +mirrorlist01.uase IN A 134.108.44.54 +mirrorlist02.mv IN A 81.169.241.26 mirrorlist03.scaleway IN A 163.172.151.63 +mirrorlist04.mv IN A 78.47.19.66 diff --git a/files/dns/rpmfusion.org b/files/dns/rpmfusion.org index d4f506e..ad83ee2 100644 --- a/files/dns/rpmfusion.org +++ b/files/dns/rpmfusion.org @@ -1,6 +1,6 @@ $TTL 5M @ IN SOA ns1.rpmfusion.net. matthias.saou.eu. ( - 2016071303 ; Serial + 2016071401 ; Serial 6H ; Refresh 1H ; Retry 5W ; Expire @@ -50,3 +50,4 @@ download1 IN A 193.28.235.60 mirrors IN A 81.169.241.26 IN A 163.172.151.63 IN A 78.47.19.71 + IN A 134.108.44.54

8 years, 5 months

1
0
0 / 0

[puppet] Updated one mirrorlist to CentOS7, removed the remaining CentOS5 host

by Adrian Reber

commit c3999b6c802c4b7fa6c356d46c7468d3f4a90ac2 Author: Adrian Reber <adrian(a)lisas.de> Date: Wed Jul 13 18:10:00 2016 +0200 Updated one mirrorlist to CentOS7, removed the remaining CentOS5 host files/dns/rpmfusion.org | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/files/dns/rpmfusion.org b/files/dns/rpmfusion.org index 6c393c2..d4f506e 100644 --- a/files/dns/rpmfusion.org +++ b/files/dns/rpmfusion.org @@ -1,6 +1,6 @@ $TTL 5M @ IN SOA ns1.rpmfusion.net. matthias.saou.eu. ( - 2016071302 ; Serial + 2016071303 ; Serial 6H ; Refresh 1H ; Retry 5W ; Expire @@ -47,6 +47,6 @@ pkgs IN A 212.129.31.198 ; pkgs01.online download0 IN CNAME hv02.ovh.rpmfusion.net. download1 IN A 193.28.235.60 ;download2 IN CNAME ftp.egwn.net. -mirrors IN A 134.108.44.54 +mirrors IN A 81.169.241.26 IN A 163.172.151.63 IN A 78.47.19.71

8 years, 5 months

1
0
0 / 0

[puppet] actually remove one of the old mirrorlist servers

by Adrian Reber

commit a90d6c1012041beef04c817d88ebd198231b3f04 Author: Adrian Reber <adrian(a)lisas.de> Date: Wed Jul 13 10:44:28 2016 +0200 actually remove one of the old mirrorlist servers files/dns/rpmfusion.org | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) --- diff --git a/files/dns/rpmfusion.org b/files/dns/rpmfusion.org index ab8cc22..6c393c2 100644 --- a/files/dns/rpmfusion.org +++ b/files/dns/rpmfusion.org @@ -1,6 +1,6 @@ $TTL 5M @ IN SOA ns1.rpmfusion.net. matthias.saou.eu. ( - 2016071301 ; Serial + 2016071302 ; Serial 6H ; Refresh 1H ; Retry 5W ; Expire @@ -48,6 +48,5 @@ download0 IN CNAME hv02.ovh.rpmfusion.net. download1 IN A 193.28.235.60 ;download2 IN CNAME ftp.egwn.net. mirrors IN A 134.108.44.54 - IN A 81.169.241.26 IN A 163.172.151.63 IN A 78.47.19.71

8 years, 5 months

1
0
0 / 0

[puppet] new mirrorlist server to remove old CentOS5 based servers

by Adrian Reber

commit 6bede76d587a28f30a86e7c4edecea3fa414f871 Author: Adrian Reber <adrian(a)lisas.de> Date: Wed Jul 13 10:41:14 2016 +0200 new mirrorlist server to remove old CentOS5 based servers files/dns/rpmfusion.org | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) --- diff --git a/files/dns/rpmfusion.org b/files/dns/rpmfusion.org index e97786f..ab8cc22 100644 --- a/files/dns/rpmfusion.org +++ b/files/dns/rpmfusion.org @@ -1,6 +1,6 @@ $TTL 5M @ IN SOA ns1.rpmfusion.net. matthias.saou.eu. ( - 2016070401 ; Serial + 2016071301 ; Serial 6H ; Refresh 1H ; Retry 5W ; Expire @@ -50,3 +50,4 @@ download1 IN A 193.28.235.60 mirrors IN A 134.108.44.54 IN A 81.169.241.26 IN A 163.172.151.63 + IN A 78.47.19.71

8 years, 5 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sysadmin-notify July 2016