From ec9984fcec463b994dd7022e059b65ccfb0afb92 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 30 Apr 2026 12:40:28 -0700 Subject: [PATCH] people: add anubis el container to fedorapeople Scrapers are hitting git projects really hard, so lets put this behind anubis as well. Signed-off-by: Kevin Fenzi --- playbooks/groups/people.yml | 4 ++++ roles/people/templates/people.conf | 32 ++++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/playbooks/groups/people.yml b/playbooks/groups/people.yml index 994138fb8d..c22376d88b 100644 --- a/playbooks/groups/people.yml +++ b/playbooks/groups/people.yml @@ -79,6 +79,10 @@ - role: apache + - role: anubis-el + tags: + - anubis + - role: httpd/certificate certname: wildcard-2025.fedorapeople.org SSLCertificateChainFile: wildcard-2025.fedorapeople.org.intermediate.cert diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index 809735b5f7..459e8c37aa 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -43,6 +43,38 @@ NameVirtualHost *:80 ErrorLog logs/fedorapeople.org-error.log CustomLog logs/fedorapeople.org-access.log vcombined + # proxy all requests to anubis after ssl termination + + RequestHeader set "X-Real-Ip" expr=%{REMOTE_ADDR} + RequestHeader set X-Forwarded-Proto "https" + RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s" + # Pagure uses X-Scheme, not X-Forwarded-Proto, see pagure/proxy.py + RequestHeader set X-Scheme "https" + + ProxyPreserveHost On + + ProxyRequests Off + ProxyVia Off + + ProxyPass / http://[::1]:8923/ + ProxyPassReverse / http://[::1]:8923/ + + + SetHandler server-status + + Require ip 127.0.0.1 + Require ip ::1 + Require host localhost + + + + + +# Once anubis has processed the request it sends it to port 3923 + +Listen 3923 http + + ExpiresActive On ExpiresDefault "access plus 30 minutes"