Added Nginx configuration to test Debian SSO
This commit is contained in:
parent
52ff0be45a
commit
8341baf357
9 changed files with 612 additions and 0 deletions
74
nginx/debsso.crl
Normal file
74
nginx/debsso.crl
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
-----BEGIN X509 CRL-----
|
||||
MIINXzCCDEcwDQYJKoZIhvcNAQELBQAwRDEaMBgGA1UEAxMRU1NPIENBIDIwMTUt
|
||||
MDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xpZW50IGNlcnRpZmljYXRlFw0x
|
||||
NzA0MTcxMjAwMDFaFw0xNzA0MjAxMjAwMDFaMIIL0DATAgIQABcNMTUwODIxMjEy
|
||||
NTI4WjATAgIQARcNMTUwODIxMjA1MDUxWjATAgIQAhcNMTUwODIxMjEwNjQ3WjAT
|
||||
AgIQAxcNMTUwODIxMjEwNjQ5WjATAgIQBBcNMTUwODI0MTMwMjQyWjATAgIQBRcN
|
||||
MTUwODIxMjEyNTMzWjATAgIQERcNMTYwMzE0MTQxMTAzWjATAgIQEhcNMTUwODI2
|
||||
MTExODUwWjATAgIQFRcNMTYwNTE1MDE0OTA1WjATAgIQFhcNMTYwMzIzMjMyNTE3
|
||||
WjATAgIQIBcNMTUwODI0MTMwMjQ0WjATAgIQIRcNMTUwODI0MTMwMjQ2WjATAgIQ
|
||||
IhcNMTUwODI0MTMwMjQ2WjATAgIQIxcNMTUwODI0MTMwMzQ2WjATAgIQJRcNMTUx
|
||||
MjE2MjAyMjM5WjATAgIQKBcNMTUwODI1MTUwODA3WjATAgIQMRcNMTUwODI2MTMz
|
||||
ODQ4WjATAgIQNBcNMTUwODI2MTUyODE4WjATAgIQQRcNMTUxMjE2MTI1ODE0WjAT
|
||||
AgIQRxcNMTUwODI4MDgxNDQ0WjATAgIQUBcNMTUwOTAxMDc1MjMxWjATAgIQURcN
|
||||
MTUwOTAxMDc1MjM4WjATAgIQWxcNMTYwODE3MTcxNjM4WjATAgIQYhcNMTUwODI4
|
||||
MTM1NjI4WjATAgIQcBcNMTUwOTE0MTIyNzUwWjATAgIQehcNMTYwNjIwMDkwNDE1
|
||||
WjATAgIQjhcNMTYwMTEwMDEwNTEwWjATAgIQnBcNMTUxMTI1MTQ0NDI5WjATAgIQ
|
||||
qBcNMTUwOTAyMTU0OTAxWjATAgIQvRcNMTUxMjA5MTM0NzQyWjATAgIQyhcNMTYw
|
||||
NDA2MDkyNjI3WjATAgIQzxcNMTUxMDEyMDc1ODMxWjATAgIQ1RcNMTUxMDE5MTQ0
|
||||
MjIwWjATAgIQ1hcNMTYwNDA0MDgwMTUxWjATAgIQ6RcNMTYwODE3MTcxNjQwWjAT
|
||||
AgIQ9BcNMTUxMTE3MTQxMzI1WjATAgIQ+RcNMTUxMTIwMTM0OTA2WjATAgIREBcN
|
||||
MTYwMjA1MjEyODAxWjATAgIREhcNMTYwMzE4MjMwMjAyWjATAgIRExcNMTYwNjEx
|
||||
MjI0ODI2WjATAgIRGRcNMTYxMjEwMTUzMzE3WjATAgIRHhcNMTYwNDA5MjAwODM1
|
||||
WjATAgIRHxcNMTYwNDA5MjAwODM5WjATAgIRJhcNMTUxMjE3MTYyNzM1WjATAgIR
|
||||
JxcNMTYwNzA3MTA1MTMzWjATAgIRKxcNMTYwNjIwMDkwNDE3WjATAgIROBcNMTYw
|
||||
ODE3MTcxNjQzWjATAgIRRBcNMTYxMDIwMDc0NjAzWjATAgIRSBcNMTYwMTIwMjAw
|
||||
MjEzWjATAgIRbRcNMTYwMjEzMTgzODI2WjATAgIRchcNMTYxMjEwMTUzMzE1WjAT
|
||||
AgIRcxcNMTYxMDA5MTcwMjIxWjATAgIRexcNMTYwMjI5MjMyNjU1WjATAgIRiRcN
|
||||
MTYwNzA3MTA1MTMxWjATAgIRixcNMTYwMzE0MTQxMTA4WjATAgIRkRcNMTYwNjIw
|
||||
MDkwNDE5WjATAgIRkhcNMTYwMzE0MTQxMTA2WjATAgIRlRcNMTcwMTE4MTYwMDI2
|
||||
WjATAgIRnxcNMTYxMDAzMjAwNjMzWjATAgIRohcNMTYwMzE4MTQwNjE5WjATAgIR
|
||||
thcNMTYwMzE5MTUzNzQ3WjATAgIRuRcNMTYwMzE5MTYyMjQzWjATAgIRwhcNMTYw
|
||||
MzIwMTE1MzAzWjATAgIRwxcNMTYwNTExMjI1ODE1WjATAgIRzxcNMTYwMzI0MDEx
|
||||
MzMyWjATAgIR0RcNMTcwMjA3MTk1ODI5WjATAgIR5BcNMTYwNzAyMTUxNTMzWjAT
|
||||
AgIR5xcNMTYwODE4MTUzMDUzWjATAgIR6hcNMTYwMzI5MTYyMDMzWjATAgIR7xcN
|
||||
MTcwMzIyMjM0MTM5WjATAgIR9RcNMTYwMzI3MDgwMzI0WjATAgIR/BcNMTYwNTI0
|
||||
MjA1MDE4WjATAgIR/xcNMTYwNTA0MTk1NDMzWjATAgISFhcNMTcwMjE2MjEyODE5
|
||||
WjATAgISIRcNMTYwNDA4MDkyMjEwWjATAgISIhcNMTYwNDA4MDkyMjEyWjATAgIS
|
||||
IxcNMTYwNDA4MDkyMjE1WjATAgISJBcNMTYwNDA4MDkyMjE3WjATAgISKBcNMTYw
|
||||
NTAyMDU1MDAyWjATAgISMhcNMTYwNDA5MjAyOTU3WjATAgISPRcNMTYwNDEwMTkx
|
||||
MjA3WjATAgISShcNMTYxMjEwMTUzMzE0WjATAgISUhcNMTYwNDIxMTYwNDU2WjAT
|
||||
AgISbhcNMTYwNTE0MDE0MzEyWjATAgIScBcNMTYwNTEzMjIyOTMyWjATAgIScRcN
|
||||
MTYwNTEzMjIyOTM2WjATAgIScxcNMTYwNTE0MDE0MzE4WjATAgISgRcNMTYwNjMw
|
||||
MTUwMjU1WjATAgIShRcNMTYxMDAzMjAwNjI0WjATAgISqBcNMTYwNjA4MTQ0NTEz
|
||||
WjATAgISrRcNMTYwNjExMjMwNjA4WjATAgISsRcNMTcwMzIyMjM0MTQ3WjATAgIS
|
||||
sxcNMTYwNjIwMTM1MDAyWjATAgIStBcNMTYwNjIwMTM1MDAwWjATAgIStRcNMTYw
|
||||
NjIwMTM0OTU4WjATAgISwRcNMTYxMTIyMTIxNDAzWjATAgIS5BcNMTYwOTI5MTcz
|
||||
MTA4WjATAgIS5RcNMTYwOTI5MTczMDUzWjATAgITBRcNMTcwNDEzMDE1NDM0WjAT
|
||||
AgITHxcNMTYwOTA4MDg1MDIzWjATAgITIBcNMTcwMTA2MjExMDU3WjATAgITIxcN
|
||||
MTYxMTMwMTAzOTI1WjATAgITPBcNMTYwOTI5MTc0NzI3WjATAgITQhcNMTYwOTI5
|
||||
MTczNTQ1WjATAgITThcNMTYxMDA5MjA0NTQyWjATAgITTxcNMTYxMDA5MTcxMjIx
|
||||
WjATAgITVRcNMTYxMDEyMTQwMDIwWjATAgITXBcNMTYxMjI4MTg0NzMxWjATAgIT
|
||||
XRcNMTYxMDE2MTU1NzM2WjATAgITYxcNMTYxMDE4MTcwNzE0WjATAgITaxcNMTcw
|
||||
NDE3MTA1MTIxWjATAgITbhcNMTYxMjE4MTYwNTI0WjATAgITchcNMTYxMDI0MjA1
|
||||
MjU3WjATAgITfhcNMTcwMTE3MTAzMzMzWjATAgITghcNMTYxMDMwMTgzODQyWjAT
|
||||
AgIThxcNMTYxMDMxMjE0NzUyWjATAgITiBcNMTYxMDMxMjE0MzE4WjATAgITixcN
|
||||
MTYxMTAyMTkyOTIxWjATAgITmBcNMTYxMTA4MTkyODE2WjATAgITmRcNMTYxMTA4
|
||||
MTkzNTExWjATAgITmhcNMTYxMTA4MTkzNTEyWjATAgITnRcNMTcwMTA2MjExMDU2
|
||||
WjATAgITpRcNMTYxMTEwMjE1NjA5WjATAgITphcNMTYxMTEwMjIxODE1WjATAgIT
|
||||
uxcNMTcwMTAxMTAwNDQxWjATAgIT5hcNMTcwMTA2MjExMDU1WjATAgIT8xcNMTYx
|
||||
MjIxMjEzMjQ0WjATAgIT+BcNMTYxMjIzMjIzNTQ0WjATAgIT+RcNMTYxMjIzMjIz
|
||||
NTQzWjATAgIUABcNMTYxMjMwMDA1NjM2WjATAgIUCBcNMTcwMTEwMDk1MzQwWjAT
|
||||
AgIUERcNMTcwMTA0MTMzMjI1WjATAgIUEhcNMTcwMTA0MTMzMzU3WjATAgIUExcN
|
||||
MTcwMTA0MTMzODI2WjATAgIURRcNMTcwMjA1MTYxNTE0WjATAgIURhcNMTcwMjA1
|
||||
MTYyMDIyWjATAgIUXxcNMTcwMjEzMTYyMzQ5WjATAgIUbBcNMTcwMjI0MDc0MTU4
|
||||
WjATAgIUfxcNMTcwMzA5MTAxNTI2WjATAgIUhxcNMTcwMzE1MDczNzE3WjATAgIU
|
||||
txcNMTcwMzMwMTcxODQxWjATAgIUuBcNMTcwMzMwMTcxODI5WjATAgIUuRcNMTcw
|
||||
MzMwMTcyMDIzWjATAgIU4hcNMTcwNDEzMDc1MDE3WjANBgkqhkiG9w0BAQsFAAOC
|
||||
AQEAplaw9kFqKl3k/pF679iDMaLEVVyPg1yRnhO9a18D4FjCR/ZsDHOwdpows472
|
||||
+/V1oPLQH9uISKfNWXAjBBMLP+XG4rQehvE45mvwTnCTe8LZ7rXipIjOc5BFDj4H
|
||||
c57/eLB6e9NW++wng+mfKXzzhNKonfg9957PDC19Q4OZJT5J2g8xRQLfk86jGglv
|
||||
hEK3Pn3xW5Hww7sN0BbKr4+gCasl6xw2ZMD0JxNcdPfLR+S9Er7aqVHCvncCR9ua
|
||||
0ZRe1XeUFCwEb2269yhRG0qSMEHeFOs7ZvFqN+LSJQ0z8XBNtvSmLHbIszMJ+OJp
|
||||
dZJOfdUZhmtxop0YahWKyDsdYw==
|
||||
-----END X509 CRL-----
|
||||
22
nginx/debsso.crt
Normal file
22
nginx/debsso.crt
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDlzCCAn+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBEMRowGAYDVQQDExFTU08g
|
||||
Q0EgMjAxNS0wOC0yMTEmMCQGA1UEChMdRGViaWFuIFNTTyBjbGllbnQgY2VydGlm
|
||||
aWNhdGUwIhgPMjAxNTA4MjEyMDQzMzVaGA85OTk5MTIzMTIzNTk1OVowRDEaMBgG
|
||||
A1UEAxMRU1NPIENBIDIwMTUtMDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xp
|
||||
ZW50IGNlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
|
||||
1SUMNiEVMlycwDPlJhgJ099VorLDTW556XvbWSw8l7cnygs8V9bN83f6W2P8x328
|
||||
dz+U1OxEZ/PnS+/zMwco03XQggXcNN+UjHwUu9WP5koNsPFH6HRbvUy5oBDfbdVN
|
||||
EzBE2gXE4WYFoj45U9rSU6qLEnT4QKxJ/CbTeMGvLKzuXdCv6W+UxUfbh186kSqM
|
||||
tfDtY3aQ+L6MuPA1a+bumUh9EGVZrrIMbjgm1xrQohQBJC75X10dnicUliGZ+7C0
|
||||
h7pUQlIY+/IxREQ46xBY1CNYeZNMEI9ErMbiFiShsc3mP3aLxTAQ4KzHCDtIuzwD
|
||||
ElH8aMPxIQOUyL/FLx8ZTQIDAQABo4GPMIGMMA8GA1UdEwEB/wQFMAMBAf8wEwYD
|
||||
VR0lBAwwCgYIKwYBBQUHAwkwDwYDVR0PAQH/BAUDAwcGADAdBgNVHQ4EFgQU0OJ+
|
||||
JoHgzarLNF+2eiay11GCk44wNAYDVR0fBC0wKzApoCegJYYjaHR0cHM6Ly9zc28u
|
||||
ZGViaWFuLm9yZy9zcGthYy9jYS5jcmwwDQYJKoZIhvcNAQELBQADggEBAKynxkRr
|
||||
7w85LHYzH5q9xVHXX6+K6r1mA3b+OAopNMJZTCTn7v9UVDncp26wOeHOUEvawWaQ
|
||||
21HBd70CiFH0XGDow0/K68ite/0RHxq1WAuggBc678d/0yDkoWdFHAf9n5Agzf4J
|
||||
rXov++XmBXYHRXiHunuSLnM3i8HToejZMCC7P9nqpPo0tK7O22calbZn20Pdve6k
|
||||
KrKxwwjxpuNxezr6uYGuNTLJOZtyjF09FuAebSlHvX6VYPl7FnMUDcS6QerEyocL
|
||||
Bv7pbsNWehIfvfjqPJQwqznieieZGL6s1zB8/XWQw37C0i28LqJ8DTvEjgmF44RP
|
||||
6JhTYDnI06pKfQY=
|
||||
-----END CERTIFICATE-----
|
||||
8
nginx/dhparams.pem
Normal file
8
nginx/dhparams.pem
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
-----BEGIN DH PARAMETERS-----
|
||||
MIIBCAKCAQEA8kUEh2+7OSDG3BQ22cJBlBM0jp+AWW8Wa64J0hE/gQaR8jw9VSQW
|
||||
a+WBaDQ+FAcxOmAeVvrX4owvBocHBcVPmU4NEnkWe77qsCG56wEJWco+DgN3cq43
|
||||
SYbhI3s2HNQwLCzUYLAMZVXcUDH4Nn3cRTTl3ZNpB99XhAio20frNpGQrQeUb0Of
|
||||
dDj3QpLL1k09b+OVnAh+3KFHawrjzzyFf9pZMsrmK/wZR5SSds1TTisHjVaJe4zN
|
||||
dcOfvQr5dUHl1mvwxYPnpbXmXdlDmdBU6/HCqkXpUcfl18bhwKG1UT7wmWuInizT
|
||||
AsNFRK393l5eqlE+AFvWZpacMGGMGJhd+wIBAg==
|
||||
-----END DH PARAMETERS-----
|
||||
89
nginx/mime.types
Normal file
89
nginx/mime.types
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
|
||||
types {
|
||||
text/html html htm shtml;
|
||||
text/css css;
|
||||
text/xml xml;
|
||||
image/gif gif;
|
||||
image/jpeg jpeg jpg;
|
||||
application/javascript js;
|
||||
application/atom+xml atom;
|
||||
application/rss+xml rss;
|
||||
|
||||
text/mathml mml;
|
||||
text/plain txt;
|
||||
text/vnd.sun.j2me.app-descriptor jad;
|
||||
text/vnd.wap.wml wml;
|
||||
text/x-component htc;
|
||||
|
||||
image/png png;
|
||||
image/tiff tif tiff;
|
||||
image/vnd.wap.wbmp wbmp;
|
||||
image/x-icon ico;
|
||||
image/x-jng jng;
|
||||
image/x-ms-bmp bmp;
|
||||
image/svg+xml svg svgz;
|
||||
image/webp webp;
|
||||
|
||||
application/font-woff woff;
|
||||
application/java-archive jar war ear;
|
||||
application/json json;
|
||||
application/mac-binhex40 hqx;
|
||||
application/msword doc;
|
||||
application/pdf pdf;
|
||||
application/postscript ps eps ai;
|
||||
application/rtf rtf;
|
||||
application/vnd.apple.mpegurl m3u8;
|
||||
application/vnd.ms-excel xls;
|
||||
application/vnd.ms-fontobject eot;
|
||||
application/vnd.ms-powerpoint ppt;
|
||||
application/vnd.wap.wmlc wmlc;
|
||||
application/vnd.google-earth.kml+xml kml;
|
||||
application/vnd.google-earth.kmz kmz;
|
||||
application/x-7z-compressed 7z;
|
||||
application/x-cocoa cco;
|
||||
application/x-java-archive-diff jardiff;
|
||||
application/x-java-jnlp-file jnlp;
|
||||
application/x-makeself run;
|
||||
application/x-perl pl pm;
|
||||
application/x-pilot prc pdb;
|
||||
application/x-rar-compressed rar;
|
||||
application/x-redhat-package-manager rpm;
|
||||
application/x-sea sea;
|
||||
application/x-shockwave-flash swf;
|
||||
application/x-stuffit sit;
|
||||
application/x-tcl tcl tk;
|
||||
application/x-x509-ca-cert der pem crt;
|
||||
application/x-xpinstall xpi;
|
||||
application/xhtml+xml xhtml;
|
||||
application/xspf+xml xspf;
|
||||
application/zip zip;
|
||||
|
||||
application/octet-stream bin exe dll;
|
||||
application/octet-stream deb;
|
||||
application/octet-stream dmg;
|
||||
application/octet-stream iso img;
|
||||
application/octet-stream msi msp msm;
|
||||
|
||||
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
|
||||
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
|
||||
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
|
||||
|
||||
audio/midi mid midi kar;
|
||||
audio/mpeg mp3;
|
||||
audio/ogg ogg;
|
||||
audio/x-m4a m4a;
|
||||
audio/x-realaudio ra;
|
||||
|
||||
video/3gpp 3gpp 3gp;
|
||||
video/mp2t ts;
|
||||
video/mp4 mp4;
|
||||
video/mpeg mpeg mpg;
|
||||
video/quicktime mov;
|
||||
video/webm webm;
|
||||
video/x-flv flv;
|
||||
video/x-m4v m4v;
|
||||
video/x-mng mng;
|
||||
video/x-ms-asf asx asf;
|
||||
video/x-ms-wmv wmv;
|
||||
video/x-msvideo avi;
|
||||
}
|
||||
60
nginx/nginx.conf
Normal file
60
nginx/nginx.conf
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
events {
|
||||
worker_connections 768;
|
||||
}
|
||||
|
||||
pid /tmp/nginx.pid;
|
||||
error_log /tmp/error;
|
||||
|
||||
http {
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
ssl_dhparam dhparams.pem;
|
||||
|
||||
##
|
||||
# Logging Settings
|
||||
##
|
||||
|
||||
access_log /tmp/access-main;
|
||||
|
||||
|
||||
#passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini;
|
||||
#passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby;
|
||||
|
||||
|
||||
##
|
||||
# Gzip Settings
|
||||
##
|
||||
|
||||
gzip on;
|
||||
|
||||
server {
|
||||
listen *:3001 ssl;
|
||||
ssl_certificate screenshots.debian.net.crt;
|
||||
ssl_certificate_key screenshots.debian.net.key;
|
||||
ssl_client_certificate debsso.crt;
|
||||
ssl_crl debsso.crl;
|
||||
ssl_verify_client optional;
|
||||
ssl_verify_depth 1;
|
||||
proxy_set_header X-Debian-SSO-DN $ssl_client_s_dn;
|
||||
|
||||
root ../public;
|
||||
server_name _;
|
||||
access_log /tmp/access-front;
|
||||
|
||||
# Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite
|
||||
# redirection loop because the backend assumes that HTTP was spoken behind the
|
||||
# proxy.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs
|
||||
proxy_set_header Host $host:$server_port;
|
||||
|
||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
gzip_proxied any;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:3000/;
|
||||
}
|
||||
}
|
||||
}
|
||||
98
nginx/screenshots.debian.net.crt
Normal file
98
nginx/screenshots.debian.net.crt
Normal file
|
|
@ -0,0 +1,98 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIFEjCCA/qgAwIBAgIRAL/YYnl8IOX8JwWB+NpqTN4wDQYJKoZIhvcNAQELBQAw
|
||||
XzELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBhcmlzMQ4wDAYDVQQHEwVQYXJpczEO
|
||||
MAwGA1UEChMFR2FuZGkxIDAeBgNVBAMTF0dhbmRpIFN0YW5kYXJkIFNTTCBDQSAy
|
||||
MB4XDTE1MDExMzAwMDAwMFoXDTE3MDMxMjIzNTk1OVowYTEhMB8GA1UECxMYRG9t
|
||||
YWluIENvbnRyb2wgVmFsaWRhdGVkMRswGQYDVQQLExJHYW5kaSBTdGFuZGFyZCBT
|
||||
U0wxHzAdBgNVBAMTFnNjcmVlbnNob3RzLmRlYmlhbi5uZXQwggEiMA0GCSqGSIb3
|
||||
DQEBAQUAA4IBDwAwggEKAoIBAQC0QybbIT5MMZgmDONX2hY/oezY5pz9p3CfcQkc
|
||||
I4y5GcWRtTKDn46y+gmcQA9wHZTHKMT7tEsGAx7/55KaG2TtNqoZnhmyRYG7MDIg
|
||||
bztbdYA0/RwlVp/iVmqsc5Wsq7/ZmU/aIB2WDH6V2cWJgJoJ0LQMj/nCBRqS4n3+
|
||||
YZxSr0fTrmBROHjw6pIp7AouVJ0NVeG8lnkhYXlqBpK+qmCyhj54UpvXVAYeoiS5
|
||||
Qbld8kpQKZYvUdOnJyY2xUIaeGbIrQFRS6QAkSgi7B+ZkJkt06mGKwB6hLH6M2kL
|
||||
UlKANIIEYVuMEYk2jYQL+pIdBDRlHpp5r3H6F11ZPctYP+INAgMBAAGjggHFMIIB
|
||||
wTAfBgNVHSMEGDAWgBSzkKfYya9OzWE8n3ytXX9B/Wkw6jAdBgNVHQ4EFgQUxfoL
|
||||
wPdHyJb6SwhYF0uesh28NlwwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAw
|
||||
HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEsGA1UdIAREMEIwNgYLKwYB
|
||||
BAGyMQECAhowJzAlBggrBgEFBQcCARYZaHR0cHM6Ly9jcHMudXNlcnRydXN0LmNv
|
||||
bTAIBgZngQwBAgEwQQYDVR0fBDowODA2oDSgMoYwaHR0cDovL2NybC51c2VydHJ1
|
||||
c3QuY29tL0dhbmRpU3RhbmRhcmRTU0xDQTIuY3JsMHMGCCsGAQUFBwEBBGcwZTA8
|
||||
BggrBgEFBQcwAoYwaHR0cDovL2NydC51c2VydHJ1c3QuY29tL0dhbmRpU3RhbmRh
|
||||
cmRTU0xDQTIuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3Qu
|
||||
Y29tMD0GA1UdEQQ2MDSCFnNjcmVlbnNob3RzLmRlYmlhbi5uZXSCGnd3dy5zY3Jl
|
||||
ZW5zaG90cy5kZWJpYW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQAtcPKcIeq6iFap
|
||||
EaEuVIOpbfPQn1sF3tsKWGb9waHFBZX35BSXoie/IoxJk5m+MIu8UH+PTgcXPIGc
|
||||
95eNxbLa+59RjTd3GRyLr7Gscfl1JuR1HzpBiW77q4nJUQoh+kNaeOmqHESi8kGv
|
||||
2Fe6mVINlkyWyK2Gx337kUvQYKuowgqprVsrHNi9YI1H7d8VhaAiWQeD1AyAvi8W
|
||||
roF9FiMmkOkTtAkoo28D2L1OkBW7PLgAT2J/zSI4Nf26duZmvETNn85NfLicGuTh
|
||||
z3z+p6RVI6Rl7LitFvbnuaVCe7xysseCuXYg8uZAjQq+mN1LkdrDKbY+5e1/9ghl
|
||||
yeR6Uwhu
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIF6TCCA9GgAwIBAgIQBeTcO5Q4qzuFl8umoZhQ4zANBgkqhkiG9w0BAQwFADCB
|
||||
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
|
||||
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
|
||||
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQw
|
||||
OTEyMDAwMDAwWhcNMjQwOTExMjM1OTU5WjBfMQswCQYDVQQGEwJGUjEOMAwGA1UE
|
||||
CBMFUGFyaXMxDjAMBgNVBAcTBVBhcmlzMQ4wDAYDVQQKEwVHYW5kaTEgMB4GA1UE
|
||||
AxMXR2FuZGkgU3RhbmRhcmQgU1NMIENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IB
|
||||
DwAwggEKAoIBAQCUBC2meZV0/9UAPPWu2JSxKXzAjwsLibmCg5duNyj1ohrP0pIL
|
||||
m6jTh5RzhBCf3DXLwi2SrCG5yzv8QMHBgyHwv/j2nPqcghDA0I5O5Q1MsJFckLSk
|
||||
QFEW2uSEEi0FXKEfFxkkUap66uEHG4aNAXLy59SDIzme4OFMH2sio7QQZrDtgpbX
|
||||
bmq08j+1QvzdirWrui0dOnWbMdw+naxb00ENbLAb9Tr1eeohovj0M1JLJC0epJmx
|
||||
bUi8uBL+cnB89/sCdfSN3tbawKAyGlLfOGsuRTg/PwSWAP2h9KK71RfWJ3wbWFmV
|
||||
XooS/ZyrgT5SKEhRhWvzkbKGPym1bgNi7tYFAgMBAAGjggF1MIIBcTAfBgNVHSME
|
||||
GDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUs5Cn2MmvTs1hPJ98
|
||||
rV1/Qf1pMOowDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYD
|
||||
VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIGA1UdIAQbMBkwDQYLKwYBBAGy
|
||||
MQECAhowCAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNl
|
||||
cnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNy
|
||||
bDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRy
|
||||
dXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZ
|
||||
aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAWGf9
|
||||
crJq13xhlhl+2UNG0SZ9yFP6ZrBrLafTqlb3OojQO3LJUP33WbKqaPWMcwO7lWUX
|
||||
zi8c3ZgTopHJ7qFAbjyY1lzzsiI8Le4bpOHeICQW8owRc5E69vrOJAKHypPstLbI
|
||||
FhfFcvwnQPYT/pOmnVHvPCvYd1ebjGU6NSU2t7WKY28HJ5OxYI2A25bUeo8tqxyI
|
||||
yW5+1mUfr13KFj8oRtygNeX56eXVlogMT8a3d2dIhCe2H7Bo26y/d7CQuKLJHDJd
|
||||
ArolQ4FCR7vY4Y8MDEZf7kYzawMUgtN+zY+vkNaOJH1AQrRqahfGlZfh8jjNp+20
|
||||
J0CT33KpuMZmYzc4ZCIwojvxuch7yPspOqsactIGEk72gtQjbz7Dk+XYtsDe3CMW
|
||||
1hMwt6CaDixVBgBwAc/qOR2A24j3pSC4W/0xJmmPLQphgzpHphNULB7j7UTKvGof
|
||||
KA5R2d4On3XNDgOVyvnFqSot/kGkoUeuDcL5OWYzSlvhhChZbH2UF3bkRYKtcCD9
|
||||
0m9jqNf6oDP6N8v3smWe2lBvP+Sn845dWDKXcCMu5/3EFZucJ48y7RetWIExKREa
|
||||
m9T8bJUox04FB6b9HbwZ4ui3uRGKLXASUoWNjDNKD/yZkuBjcNqllEdjB+dYxzFf
|
||||
BT02Vf6Dsuimrdfp5gJ0iHRc2jTbkNJtUQoj1iM=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFdzCCBF+gAwIBAgIQE+oocFv07O0MNmMJgGFDNjANBgkqhkiG9w0BAQwFADBv
|
||||
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
|
||||
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
|
||||
eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow
|
||||
gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
|
||||
ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
|
||||
VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjAN
|
||||
BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sIs9CsVw127c0n00yt
|
||||
UINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnGvDoZtF+mvX2do2NC
|
||||
tnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQIjy8/hPwhxR79uQf
|
||||
jtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfbIWax1Jt4A8BQOujM
|
||||
8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0tyA9yn8iNK5+O2hm
|
||||
AUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97Exwzf4TKuzJM7UXiV
|
||||
Z4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNVicQNwZNUMBkTrNN9
|
||||
N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5D9kCnusSTJV882sF
|
||||
qV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJWBp/kjbmUZIO8yZ9
|
||||
HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ5lhCLkMaTLTwJUdZ
|
||||
+gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzGKAgEJTm4Diup8kyX
|
||||
HAc/DVL17e8vgg8CAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTv
|
||||
A73gJMtUGjAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/
|
||||
BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1Ud
|
||||
HwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4
|
||||
dGVybmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0
|
||||
dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAJNl9jeD
|
||||
lQ9ew4IcH9Z35zyKwKoJ8OkLJvHgwmp1ocd5yblSYMgpEg7wrQPWCcR23+WmgZWn
|
||||
RtqCV6mVksW2jwMibDN3wXsyF24HzloUQToFJBv2FAY7qCUkDrvMKnXduXBBP3zQ
|
||||
YzYhBx9G/2CkkeFnvN4ffhkUyWNnkepnB2u0j4vAbkN9w6GAbLIevFOFfdyQoaS8
|
||||
Le9Gclc1Bb+7RrtubTeZtv8jkpHGbkD4jylW6l/VXxRTrPBPYer3IsynVgviuDQf
|
||||
Jtl7GQVoP7o81DgGotPmjw7jtHFtQELFhLRAlSv0ZaBIefYdgWOWnU914Ph85I6p
|
||||
0fKtirOMxyHNwu8=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
28
nginx/screenshots.debian.net.key
Normal file
28
nginx/screenshots.debian.net.key
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC0QybbIT5MMZgm
|
||||
DONX2hY/oezY5pz9p3CfcQkcI4y5GcWRtTKDn46y+gmcQA9wHZTHKMT7tEsGAx7/
|
||||
55KaG2TtNqoZnhmyRYG7MDIgbztbdYA0/RwlVp/iVmqsc5Wsq7/ZmU/aIB2WDH6V
|
||||
2cWJgJoJ0LQMj/nCBRqS4n3+YZxSr0fTrmBROHjw6pIp7AouVJ0NVeG8lnkhYXlq
|
||||
BpK+qmCyhj54UpvXVAYeoiS5Qbld8kpQKZYvUdOnJyY2xUIaeGbIrQFRS6QAkSgi
|
||||
7B+ZkJkt06mGKwB6hLH6M2kLUlKANIIEYVuMEYk2jYQL+pIdBDRlHpp5r3H6F11Z
|
||||
PctYP+INAgMBAAECggEAdU+GR/EYc8mKtKiKgy/AbuTYGEfsPv7qwjhzr0ZLXGKz
|
||||
OqHrH9GEsmEaQ/9EjLgTjJCxsQSiFmWNlQiFVZkiU2XRyR4kpumpBcLVvFnnDRwo
|
||||
tVNLL9lx74BBp70I2PhkwB2P4+omlvHGp4qzjUqN9HlH0y0XYvajVpfjWtr3Oq8S
|
||||
8WlIE25fi0l8NGeMZg/pvX9I42+Os46kH/Cpmw+wZY2wptTosMe2IUFwTkMUyEuT
|
||||
I3oJnz3VQ24d7Q01rQdllkRpg68HBtv99k7fIPs2pSwhiBXpM39jneeFfdY7GdKB
|
||||
spyAipfmOkw8COuhXNbaewl+GBAkugNT9Bbgc+XmwQKBgQDnj5GNEJv9RgXQasYY
|
||||
5opNCZhlPsfOVlyhqYc/niatnMRK6L6PRgDswbfNixa3bbymMCkjgTip7U0XsbWc
|
||||
8ueq+b3CnutrM5p8R9LceStDdU4oB+Tt4egqH1VkezwqD9s9OgbPYnCRTjJ1JDXH
|
||||
HtjY87XhSDABSoue3R+XVAb+WQKBgQDHSZLJTuf5htltbShc1TEP11ER01Bjlid6
|
||||
bIs5XdnDsShl8DsPqrAnaiWrnHJegp3YYAcXi3fRIsO1Nbow/uk6fu9wNBt3fWPu
|
||||
3T4Vf2MLUDtrsQJGQYB7JW79dbzo02Cz1tA4+b1LZil9JkRjmwub33G4Ww5+zWOi
|
||||
+TzlW2wS1QKBgQDThDkX+gwDFmtJLb82D6BVLmaeVPJ+cDS9FvYMDpKWE5TaOC+Z
|
||||
AADoQyt5/YsKkpq301ZAsFDqJ3E8K4ARlXA4pVfI5xF0IvcCfzkFW0lBnW1+83cS
|
||||
NEC1+VkvJ8KVSVaiXtbJqMnacOt2RVU6Rdsekb+ZwS7Yfxd6TdIFkSOyQQKBgANc
|
||||
MTZltzGU3Xuj2IdgLNiYh8xmJLfZI0dEJ0DLXU2YYhb96vEDrr6rYoE3PRJs315z
|
||||
mAsElfuXu3cFteL3mVUcKMtahZAJNDMl1dMk97WMH8RcEq6+kf0Bj5KEdq/ySHIf
|
||||
0Bj11QQ9b7uldoe7aIGzTcaO+nqW2fQ4gZdYaEUVAoGBAK5SPXvZPTPeloTrTT6T
|
||||
ialF4hH8+8oibHqIac91tKFjHvP2eyJKreJ5DnLa/qGki8WCcc5BWvZtGwlc+2JV
|
||||
0o9rqurSIsztr+nbXye1rdwG82pTdud50m0YM0VtXOEJ16l+d+hd9muB0ZaHp3t/
|
||||
L3FxwwYVzwm+5QfHADevnvMN
|
||||
-----END PRIVATE KEY-----
|
||||
122
nginx/sophisticated-nginx.conf
Normal file
122
nginx/sophisticated-nginx.conf
Normal file
|
|
@ -0,0 +1,122 @@
|
|||
#user www-data;
|
||||
#worker_processes 4;
|
||||
pid /tmp/nginx.pid;
|
||||
error_log /tmp/error-foo;
|
||||
|
||||
#events {
|
||||
# worker_connections 768;
|
||||
#}
|
||||
|
||||
http {
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 20;
|
||||
types_hash_max_size 2048;
|
||||
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
|
||||
ssl_dhparam dhparams.pem;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:20m;
|
||||
ssl_session_timeout 180m;
|
||||
|
||||
##
|
||||
# Logging Settings
|
||||
##
|
||||
|
||||
access_log /tmp/access-main;
|
||||
error_log /tmp/error-main;
|
||||
|
||||
##
|
||||
# Gzip Settings
|
||||
##
|
||||
|
||||
gzip on;
|
||||
|
||||
##
|
||||
# Phusion Passenger config
|
||||
##
|
||||
# Uncomment it if you installed passenger or passenger-enterprise
|
||||
##
|
||||
|
||||
#passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini;
|
||||
#passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby;
|
||||
|
||||
|
||||
server {
|
||||
listen *:8000 default_server;
|
||||
listen *:8443 ssl;
|
||||
ssl_certificate screenshots.debian.net.crt;
|
||||
ssl_certificate_key screenshots.debian.net.key;
|
||||
ssl_client_certificate debsso.crt;
|
||||
ssl_crl debsso.crl;
|
||||
ssl_verify_client optional;
|
||||
ssl_verify_depth 1;
|
||||
|
||||
root ../public;
|
||||
server_name _;
|
||||
access_log /tmp/access-front;
|
||||
error_log /tmp/error-front;
|
||||
|
||||
# Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite
|
||||
# redirection loop because the backend assumes that HTTP was spoken behind the
|
||||
# proxy.
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs
|
||||
proxy_set_header Host $host;
|
||||
|
||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
gzip_proxied any;
|
||||
|
||||
location / {
|
||||
try_files /maintenance.html @backend;
|
||||
add_header X-Coffee main;
|
||||
}
|
||||
|
||||
location /json/ {
|
||||
try_files /maintenance.html @backend;
|
||||
add_header X-Coffee json;
|
||||
}
|
||||
|
||||
location /favicon.ico {
|
||||
# try_files /maintenance.html @backend;
|
||||
alias ../public/favicon.ico;
|
||||
}
|
||||
|
||||
location @backend {
|
||||
proxy_pass http://127.0.0.1:3000;
|
||||
}
|
||||
|
||||
#location /assets/ {
|
||||
# alias ../public/assets/;
|
||||
# expires 1h;
|
||||
# add_header X-Coffee assets;
|
||||
#}
|
||||
location /logo/ {
|
||||
alias ../public/logo/;
|
||||
expires 1h;
|
||||
add_header X-Coffee logo;
|
||||
}
|
||||
location /screenshots/ {
|
||||
alias ../public/screenshots/;
|
||||
expires max;
|
||||
add_header X-Coffee screenshots;
|
||||
}
|
||||
location /images/ {
|
||||
alias ../public/images/;
|
||||
expires 1h;
|
||||
add_header X-Coffee images;
|
||||
}
|
||||
|
||||
location /debian_sso/ {
|
||||
#
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
111
nginx/update-debsso-ca
Executable file
111
nginx/update-debsso-ca
Executable file
|
|
@ -0,0 +1,111 @@
|
|||
#!/usr/bin/python3
|
||||
|
||||
# Download new versions of the CA certificate and Certificate Revocation List
|
||||
# from sso.debian.org and write them out atomically.
|
||||
|
||||
import requests
|
||||
import tempfile
|
||||
import argparse
|
||||
import os
|
||||
import subprocess
|
||||
import ssl
|
||||
|
||||
class atomic_writer(object):
|
||||
"""
|
||||
Atomically write to a file
|
||||
"""
|
||||
def __init__(self, fname, mode, osmode=0o644, sync=True, **kw):
|
||||
self.fname = fname
|
||||
self.osmode = osmode
|
||||
self.sync = sync
|
||||
dirname = os.path.dirname(self.fname)
|
||||
self.fd, self.abspath = tempfile.mkstemp(dir=dirname, text="b" not in mode)
|
||||
self.outfd = open(self.fd, mode, closefd=True, **kw)
|
||||
|
||||
def __enter__(self):
|
||||
return self.outfd
|
||||
|
||||
def __exit__(self, exc_type, exc_val, exc_tb):
|
||||
if exc_type is None:
|
||||
self.outfd.flush()
|
||||
if self.sync: os.fdatasync(self.fd)
|
||||
os.fchmod(self.fd, self.osmode)
|
||||
os.rename(self.abspath, self.fname)
|
||||
else:
|
||||
os.unlink(self.abspath)
|
||||
self.outfd.close()
|
||||
return False
|
||||
|
||||
|
||||
def get_url(url):
|
||||
"""
|
||||
Fetch a URL and return the raw result as bytes
|
||||
"""
|
||||
bundle='/etc/ssl/ca-debian/ca-certificates.crt'
|
||||
if os.path.exists(bundle):
|
||||
res = requests.get(url, verify=bundle)
|
||||
else:
|
||||
res = requests.get(url)
|
||||
res.raise_for_status()
|
||||
return res.content
|
||||
|
||||
|
||||
def update_file(pathname, content, validate=None):
|
||||
"""
|
||||
Write content on pathname atomically, and do nothing if pathname exists and
|
||||
has the same content as `content`.
|
||||
|
||||
Returns True if the file has been updated, else False.
|
||||
"""
|
||||
try:
|
||||
with open(pathname, "rb") as fd:
|
||||
existing = fd.read()
|
||||
except OSError:
|
||||
existing = None
|
||||
|
||||
if existing == content: return False
|
||||
|
||||
# Validate the contents
|
||||
if validate:
|
||||
validate(content)
|
||||
|
||||
with atomic_writer(pathname, "wb", osmode=0o644) as out:
|
||||
out.write(content)
|
||||
return True
|
||||
|
||||
def validate_crt(data):
|
||||
ssl.PEM_cert_to_DER_cert(data.decode("utf-8"))
|
||||
|
||||
def validate_crl(data):
|
||||
if not data.startswith(b"-----BEGIN X509 CRL-----"):
|
||||
raise RuntimeError("Data does not begin with a CRL signature")
|
||||
if not data.endswith(b"-----END X509 CRL-----\n"):
|
||||
raise RuntimeError("Data does not end with a CRL footer")
|
||||
|
||||
def update(destdir):
|
||||
# Fetch the certificate and the CRL
|
||||
cert = get_url("https://sso.debian.org/ca/ca.pem")
|
||||
crl = get_url("https://sso.debian.org/ca/ca.crl")
|
||||
|
||||
# Write them out atomically
|
||||
|
||||
updated = False
|
||||
updated = update_file(os.path.join(destdir, "debsso.crt"), cert, validate=validate_crt) or updated
|
||||
updated = update_file(os.path.join(destdir, "debsso.crl"), crl, validate=validate_crl) or updated
|
||||
return updated
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("--destdir", default=".", help="destination directory. Default: .")
|
||||
parser.add_argument("--onupdate", help="command to run if the file has been updated. Default: do not run anything.")
|
||||
args = parser.parse_args()
|
||||
|
||||
if update(args.destdir):
|
||||
if args.onupdate:
|
||||
subprocess.check_call(["sh", "-c", args.onupdate])
|
||||
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Loading…
Add table
Add a link
Reference in a new issue