dkirwan/infra-ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity
infra-ansible/roles/pagure/templates/0_pagure.conf
Michael Winters aedf43d1f3 Restore arcane breadcrumbs (broken Forge links) 
Also some minor changes to satisfy yamllint.

Signed-off-by: Michael Winters <fedora@mwinters.net>
2026-03-11 21:09:36 +00:00

380 lines
12 KiB
Text
Raw Permalink Blame History

WSGISocketPrefix run/wsgi
#WSGIRestrictStdout On
WSGIRestrictSignal Off
WSGIPythonOptimize 1
WSGIPassAuthorization On
{% if env == 'pagure-staging' %}
# Only use a single process because flask-oidc stores its credentials in a dictionary.
WSGIDaemonProcess pagure user=git group=git maximum-requests=1000 display-name=pagure processes=1 threads=20 inactivity-timeout=300
{% else %}
WSGIDaemonProcess pagure user=git group=git maximum-requests=1000 display-name=pagure processes=20 threads=6 inactivity-timeout=300
{% endif %}
WSGIDaemonProcess paguredocs user=git group=git maximum-requests=1000 display-name=paguredocs processes=4 threads=4 inactivity-timeout=300
Protocols h2 h2c http/1.1
ServerLimit 100
ThreadsPerChild 30
MaxRequestWorkers 3000
MaxConnectionsPerChild 1000
## Redirects http -> https
<VirtualHost *:80>
{% if env == 'pagure-staging' %}
ServerName stg.pagure.io
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
Redirect permanent / https://stg.pagure.io/
{% else %}
ServerName pagure.io
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
Redirect permanent / https://pagure.io/
{% endif %}
</VirtualHost>
{% if env != 'pagure-staging' %}
<VirtualHost *:80>
ServerName www.pagure.io
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
Redirect permanent / https://pagure.io/
</VirtualHost>
{% endif %}
<VirtualHost *:80>
{% if env == 'pagure-staging' %}
ServerName docs.stg.pagure.org
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
Redirect permanent / https://docs.stg.pagure.org/
{% else %}
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
ServerName docs.pagure.org
Redirect permanent / https://docs.pagure.org/
{% endif %}
</VirtualHost>
<VirtualHost *:80>
{% if env == 'pagure-staging' %}
ServerName releases.stg.pagure.org
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
Redirect permanent / https://releases.stg.pagure.org/
{% else %}
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
ServerName releases.pagure.org
Redirect permanent / https://releases.pagure.org/
{% endif %}
</VirtualHost>
<VirtualHost *:80>
{% if env == 'pagure-staging' %}
ServerName stg.pagure.org
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
Redirect permanent / https://releases.stg.pagure.org/
{% else %}
ServerName pagure.org
#Redirect permanent / https://releases.pagure.org/
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
{% endif %}
# Added until we can get the cert out
DocumentRoot "/var/www/releases"
<Directory />
Options +Indexes
IndexOptions NameWidth=*
</Directory>
</VirtualHost>
## End of redirects http -> https
{% if env != 'pagure-staging' %}
<VirtualHost *:443>
ServerName www.pagure.io
ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge"
Redirect permanent / https://pagure.io/
SSLEngine on
SSLProtocol +all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
# Use secure TLSv1.1 and TLSv1.2 ciphers
Header always add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
SSLCertificateFile /etc/pki/tls/certs/pagure.io.cert
SSLCertificateChainFile /etc/pki/tls/certs/pagure.io.intermediate.cert
SSLCertificateKeyFile /etc/pki/tls/private/pagure.io.key
</VirtualHost>
{% endif %}
<VirtualHost *:443>
{% if env == 'pagure-staging' %}
ServerName stg.pagure.io
{% else %}
ServerName pagure.io
{% endif %}
TimeOut 600
Alias "/robots.txt" "/var/www/html/robots.txt"
WSGIScriptAlias / /var/www/pagure.wsgi
ServerAdmin admin@fedoraproject.org
SSLEngine on
SSLProtocol {{ ssl_protocols }}
SSLCipherSuite {{ ssl_ciphers }}
# Use secure TLSv1.1 and TLSv1.2 ciphers
Header always add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
{% if env == 'pagure-staging' %}
SSLCertificateFile /etc/pki/tls/certs/stg.pagure.io.cert
SSLCertificateChainFile /etc/pki/tls/certs/stg.pagure.io.intermediate.cert
SSLCertificateKeyFile /etc/pki/tls/private/stg.pagure.io.key
{% else %}
SSLCertificateFile /etc/pki/tls/certs/pagure.io.cert
SSLCertificateChainFile /etc/pki/tls/certs/pagure.io.intermediate.cert
SSLCertificateKeyFile /etc/pki/tls/private/pagure.io.key
{% endif %}
SetEnv GIT_PROJECT_ROOT /srv/git/repositories
<Location />
WSGIProcessGroup pagure
<IfModule mod_authz_core.c>
# Apache 2.4
Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
# Apache 2.2
Order deny,allow
Allow from all
</IfModule>
</Location>
<Location /releases>
{% if env == 'pagure-staging' %}
Redirect "/releases" https://releases.stg.pagure.org
{% else %}
Redirect "/releases" https://releases.pagure.org
{% endif %}
</Location>
# Drop distributed web hits
RewriteEngine On
# RewriteCond %{REQUEST_URI} ^/linux-forgeperf.*$
# RewriteRule .* - [F]
# reject /blame endpoints for now.
# They cause pagure to take a while to process and pile up requests.
# Users can just git clone and run blame there if they need to.
RewriteCond %{REQUEST_URI} ^/.*/blame/.*$
RewriteRule .* - [F]
# disable generating archives for tags in forks
# crawlers hit every one of these and cause undue io load
# and disk space. Users needing an archive of a fork can clone
# and generate one locally.
RewriteCond %{REQUEST_URI} ^/fork/.*/archive/.*(gz|zip)$
RewriteRule .* - [F]
# Spiders-gone-wild
# These spiders may not follow robots.txt and will
# hit admin sections which consume large amounts of CPU
RewriteCond %{HTTP_USER_AGENT} "(Bytespider|ClaudeBot|Amazonbot|YandexBot|ChatGLM-Spider|GPTBot|Barkrowler|YisouSpider|MJ12bot)" [NC]
RewriteRule .* - [F,L]
# proxy all requests to anubis after ssl termination
RequestHeader set "X-Real-Ip" expr=%{REMOTE_ADDR}
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s"
# Pagure uses X-Scheme, not X-Forwarded-Proto, see pagure/proxy.py
RequestHeader set X-Scheme "https"
ProxyPreserveHost On
ProxyRequests Off
ProxyVia Off
ProxyPass / http://[::1]:8923/
ProxyPassReverse / http://[::1]:8923/
<Location /apache-status>
SetHandler server-status
<RequireAny>
Require ip 127.0.0.1
Require ip ::1
Require host localhost
</RequireAny>
</Location>
</VirtualHost>
# Once anubis has processed the request it sends it to port 3923
Listen 3923 http
<VirtualHost *:3923>
ServerName stg.pagure.io
TimeOut 600
Alias "/robots.txt" "/var/www/html/robots.txt"
WSGIScriptAlias / /var/www/pagure.wsgi
ServerAdmin admin@fedoraproject.org
SetEnv GIT_PROJECT_ROOT /srv/git/repositories
<Location />
WSGIProcessGroup pagure
<IfModule mod_authz_core.c>
# Apache 2.4
Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
# Apache 2.2
Order deny,allow
Allow from all
</IfModule>
</Location>
<Location /releases>
Redirect "/releases" https://releases.stg.pagure.org
</Location>
# Drop distributed web hits
# RewriteEngine On
# RewriteCond %{REQUEST_URI} ^/linux-forgeperf.*$
# RewriteRule .* - [F]
# Spiders-gone-wild
# These spiders may not follow robots.txt and will
# hit admin sections which consume large amounts of CPU
RewriteCond %{HTTP_USER_AGENT} "(Bytespider|ClaudeBot|Amazonbot|YandexBot|ChatGLM-Spider|GPTBot|Barkrowler|YisouSpider|MJ12bot)" [NC]
RewriteRule .* - [F,L]
<Location /apache-status>
SetHandler server-status
<RequireAny>
Require ip 127.0.0.1
Require ip ::1
Require host localhost
</RequireAny>
</Location>
</VirtualHost>
<VirtualHost *:443>
{% if env == 'pagure-staging' %}
ServerName stg.pagure.org
{% else %}
ServerName pagure.org
{% endif %}
SSLEngine on
SSLProtocol {{ ssl_protocols }}
SSLCipherSuite {{ ssl_ciphers }}
# Use secure TLSv1.1 and TLSv1.2 ciphers
Header always add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
{% if env == 'pagure-staging' %}
SSLCertificateFile /etc/pki/tls/certs/stg.pagure.io.cert
SSLCertificateChainFile /etc/pki/tls/certs/stg.pagure.io.intermediate.cert
SSLCertificateKeyFile /etc/pki/tls/private/stg.pagure.io.key
{% else %}
SSLCertificateFile /etc/pki/tls/certs/pagure.io.cert
SSLCertificateChainFile /etc/pki/tls/certs/pagure.io.intermediate.cert
SSLCertificateKeyFile /etc/pki/tls/private/pagure.io.key
{% endif %}
{% if env == 'pagure-staging' %}
Redirect permanent / https://stg.pagure.io/
{% else %}
Redirect permanent / https://pagure.io/
{% endif %}
</VirtualHost>
<VirtualHost *:443>
{% if env == 'pagure-staging' %}
ServerName docs.stg.pagure.org
{% else %}
ServerName docs.pagure.org
{% endif %}
WSGIScriptAlias / /var/www/docs_pagure.wsgi
SSLEngine on
SSLProtocol {{ ssl_protocols }}
SSLCipherSuite {{ ssl_ciphers }}
# Use secure TLSv1.1 and TLSv1.2 ciphers
Header always add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
{% if env == 'pagure-staging' %}
SSLCertificateFile /etc/pki/tls/certs/stg.pagure.io.cert
SSLCertificateChainFile /etc/pki/tls/certs/stg.pagure.io.intermediate.cert
SSLCertificateKeyFile /etc/pki/tls/private/stg.pagure.io.key
{% else %}
SSLCertificateFile /etc/pki/tls/certs/pagure.io.cert
SSLCertificateChainFile /etc/pki/tls/certs/pagure.io.intermediate.cert
SSLCertificateKeyFile /etc/pki/tls/private/pagure.io.key
{% endif %}
# redirects for sssd docs.
# https://forge.fedoraproject.org/infra/tickets/issues/8995
RedirectMatch ^/SSSD.sssd$ https://sssd.io
RedirectMatch ^/SSSD.sssd/$ https://sssd.io
RedirectMatch ^/SSSD.sssd/index.html https://sssd.io/index.html
RedirectMatch ^/SSSD.sssd/(.*) https://sssd.io/docs/$1
# Spiders-gone-wild
# These spiders may not follow robots.txt and will
# hit admin sections which consume large amounts of CPU
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} "(Bytespider|ClaudeBot|Amazonbot|YandexBot|ChatGLM-Spider|GPTBot|Barkrowler|YisouSpider|MJ12bot)" [NC]
RewriteRule .* - [F,L]
<Location />
WSGIProcessGroup paguredocs
<IfModule mod_authz_core.c>
# Apache 2.4
Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
# Apache 2.2
Order deny,allow
Allow from all
</IfModule>
</Location>
</VirtualHost>
<VirtualHost *:443>
DocumentRoot "/var/www/releases"
{% if env == 'pagure-staging' %}
ServerName releases.stg.pagure.org
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/stg.pagure.io.cert
SSLCertificateKeyFile /etc/pki/tls/private/stg.pagure.io.key
SSLCertificateChainFile /etc/pki/tls/certs/stg.pagure.io.intermediate.cert
SSLHonorCipherOrder On
SSLProtocol {{ ssl_protocols }}
SSLCipherSuite {{ ssl_ciphers }}
{% else %}
ServerName releases.pagure.org
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/pagure.io.cert
SSLCertificateKeyFile /etc/pki/tls/private/pagure.io.key
SSLCertificateChainFile /etc/pki/tls/certs/pagure.io.intermediate.cert
SSLHonorCipherOrder On
SSLProtocol {{ ssl_protocols }}
SSLCipherSuite {{ ssl_ciphers }}
{% endif %}
AddType application/octet-stream msi
<Directory />
Options +Indexes
IndexOptions NameWidth=*
</Directory>
</VirtualHost>
View git blame Copy permalink