Added Nginx configuration to test Debian SSO

This commit is contained in:
Christoph Haas 2017-04-19 00:17:31 +02:00
parent 52ff0be45a
commit 8341baf357
9 changed files with 612 additions and 0 deletions

74
nginx/debsso.crl Normal file
View file

@ -0,0 +1,74 @@
-----BEGIN X509 CRL-----
MIINXzCCDEcwDQYJKoZIhvcNAQELBQAwRDEaMBgGA1UEAxMRU1NPIENBIDIwMTUt
MDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xpZW50IGNlcnRpZmljYXRlFw0x
NzA0MTcxMjAwMDFaFw0xNzA0MjAxMjAwMDFaMIIL0DATAgIQABcNMTUwODIxMjEy
NTI4WjATAgIQARcNMTUwODIxMjA1MDUxWjATAgIQAhcNMTUwODIxMjEwNjQ3WjAT
AgIQAxcNMTUwODIxMjEwNjQ5WjATAgIQBBcNMTUwODI0MTMwMjQyWjATAgIQBRcN
MTUwODIxMjEyNTMzWjATAgIQERcNMTYwMzE0MTQxMTAzWjATAgIQEhcNMTUwODI2
MTExODUwWjATAgIQFRcNMTYwNTE1MDE0OTA1WjATAgIQFhcNMTYwMzIzMjMyNTE3
WjATAgIQIBcNMTUwODI0MTMwMjQ0WjATAgIQIRcNMTUwODI0MTMwMjQ2WjATAgIQ
IhcNMTUwODI0MTMwMjQ2WjATAgIQIxcNMTUwODI0MTMwMzQ2WjATAgIQJRcNMTUx
MjE2MjAyMjM5WjATAgIQKBcNMTUwODI1MTUwODA3WjATAgIQMRcNMTUwODI2MTMz
ODQ4WjATAgIQNBcNMTUwODI2MTUyODE4WjATAgIQQRcNMTUxMjE2MTI1ODE0WjAT
AgIQRxcNMTUwODI4MDgxNDQ0WjATAgIQUBcNMTUwOTAxMDc1MjMxWjATAgIQURcN
MTUwOTAxMDc1MjM4WjATAgIQWxcNMTYwODE3MTcxNjM4WjATAgIQYhcNMTUwODI4
MTM1NjI4WjATAgIQcBcNMTUwOTE0MTIyNzUwWjATAgIQehcNMTYwNjIwMDkwNDE1
WjATAgIQjhcNMTYwMTEwMDEwNTEwWjATAgIQnBcNMTUxMTI1MTQ0NDI5WjATAgIQ
qBcNMTUwOTAyMTU0OTAxWjATAgIQvRcNMTUxMjA5MTM0NzQyWjATAgIQyhcNMTYw
NDA2MDkyNjI3WjATAgIQzxcNMTUxMDEyMDc1ODMxWjATAgIQ1RcNMTUxMDE5MTQ0
MjIwWjATAgIQ1hcNMTYwNDA0MDgwMTUxWjATAgIQ6RcNMTYwODE3MTcxNjQwWjAT
AgIQ9BcNMTUxMTE3MTQxMzI1WjATAgIQ+RcNMTUxMTIwMTM0OTA2WjATAgIREBcN
MTYwMjA1MjEyODAxWjATAgIREhcNMTYwMzE4MjMwMjAyWjATAgIRExcNMTYwNjEx
MjI0ODI2WjATAgIRGRcNMTYxMjEwMTUzMzE3WjATAgIRHhcNMTYwNDA5MjAwODM1
WjATAgIRHxcNMTYwNDA5MjAwODM5WjATAgIRJhcNMTUxMjE3MTYyNzM1WjATAgIR
JxcNMTYwNzA3MTA1MTMzWjATAgIRKxcNMTYwNjIwMDkwNDE3WjATAgIROBcNMTYw
ODE3MTcxNjQzWjATAgIRRBcNMTYxMDIwMDc0NjAzWjATAgIRSBcNMTYwMTIwMjAw
MjEzWjATAgIRbRcNMTYwMjEzMTgzODI2WjATAgIRchcNMTYxMjEwMTUzMzE1WjAT
AgIRcxcNMTYxMDA5MTcwMjIxWjATAgIRexcNMTYwMjI5MjMyNjU1WjATAgIRiRcN
MTYwNzA3MTA1MTMxWjATAgIRixcNMTYwMzE0MTQxMTA4WjATAgIRkRcNMTYwNjIw
MDkwNDE5WjATAgIRkhcNMTYwMzE0MTQxMTA2WjATAgIRlRcNMTcwMTE4MTYwMDI2
WjATAgIRnxcNMTYxMDAzMjAwNjMzWjATAgIRohcNMTYwMzE4MTQwNjE5WjATAgIR
thcNMTYwMzE5MTUzNzQ3WjATAgIRuRcNMTYwMzE5MTYyMjQzWjATAgIRwhcNMTYw
MzIwMTE1MzAzWjATAgIRwxcNMTYwNTExMjI1ODE1WjATAgIRzxcNMTYwMzI0MDEx
MzMyWjATAgIR0RcNMTcwMjA3MTk1ODI5WjATAgIR5BcNMTYwNzAyMTUxNTMzWjAT
AgIR5xcNMTYwODE4MTUzMDUzWjATAgIR6hcNMTYwMzI5MTYyMDMzWjATAgIR7xcN
MTcwMzIyMjM0MTM5WjATAgIR9RcNMTYwMzI3MDgwMzI0WjATAgIR/BcNMTYwNTI0
MjA1MDE4WjATAgIR/xcNMTYwNTA0MTk1NDMzWjATAgISFhcNMTcwMjE2MjEyODE5
WjATAgISIRcNMTYwNDA4MDkyMjEwWjATAgISIhcNMTYwNDA4MDkyMjEyWjATAgIS
IxcNMTYwNDA4MDkyMjE1WjATAgISJBcNMTYwNDA4MDkyMjE3WjATAgISKBcNMTYw
NTAyMDU1MDAyWjATAgISMhcNMTYwNDA5MjAyOTU3WjATAgISPRcNMTYwNDEwMTkx
MjA3WjATAgISShcNMTYxMjEwMTUzMzE0WjATAgISUhcNMTYwNDIxMTYwNDU2WjAT
AgISbhcNMTYwNTE0MDE0MzEyWjATAgIScBcNMTYwNTEzMjIyOTMyWjATAgIScRcN
MTYwNTEzMjIyOTM2WjATAgIScxcNMTYwNTE0MDE0MzE4WjATAgISgRcNMTYwNjMw
MTUwMjU1WjATAgIShRcNMTYxMDAzMjAwNjI0WjATAgISqBcNMTYwNjA4MTQ0NTEz
WjATAgISrRcNMTYwNjExMjMwNjA4WjATAgISsRcNMTcwMzIyMjM0MTQ3WjATAgIS
sxcNMTYwNjIwMTM1MDAyWjATAgIStBcNMTYwNjIwMTM1MDAwWjATAgIStRcNMTYw
NjIwMTM0OTU4WjATAgISwRcNMTYxMTIyMTIxNDAzWjATAgIS5BcNMTYwOTI5MTcz
MTA4WjATAgIS5RcNMTYwOTI5MTczMDUzWjATAgITBRcNMTcwNDEzMDE1NDM0WjAT
AgITHxcNMTYwOTA4MDg1MDIzWjATAgITIBcNMTcwMTA2MjExMDU3WjATAgITIxcN
MTYxMTMwMTAzOTI1WjATAgITPBcNMTYwOTI5MTc0NzI3WjATAgITQhcNMTYwOTI5
MTczNTQ1WjATAgITThcNMTYxMDA5MjA0NTQyWjATAgITTxcNMTYxMDA5MTcxMjIx
WjATAgITVRcNMTYxMDEyMTQwMDIwWjATAgITXBcNMTYxMjI4MTg0NzMxWjATAgIT
XRcNMTYxMDE2MTU1NzM2WjATAgITYxcNMTYxMDE4MTcwNzE0WjATAgITaxcNMTcw
NDE3MTA1MTIxWjATAgITbhcNMTYxMjE4MTYwNTI0WjATAgITchcNMTYxMDI0MjA1
MjU3WjATAgITfhcNMTcwMTE3MTAzMzMzWjATAgITghcNMTYxMDMwMTgzODQyWjAT
AgIThxcNMTYxMDMxMjE0NzUyWjATAgITiBcNMTYxMDMxMjE0MzE4WjATAgITixcN
MTYxMTAyMTkyOTIxWjATAgITmBcNMTYxMTA4MTkyODE2WjATAgITmRcNMTYxMTA4
MTkzNTExWjATAgITmhcNMTYxMTA4MTkzNTEyWjATAgITnRcNMTcwMTA2MjExMDU2
WjATAgITpRcNMTYxMTEwMjE1NjA5WjATAgITphcNMTYxMTEwMjIxODE1WjATAgIT
uxcNMTcwMTAxMTAwNDQxWjATAgIT5hcNMTcwMTA2MjExMDU1WjATAgIT8xcNMTYx
MjIxMjEzMjQ0WjATAgIT+BcNMTYxMjIzMjIzNTQ0WjATAgIT+RcNMTYxMjIzMjIz
NTQzWjATAgIUABcNMTYxMjMwMDA1NjM2WjATAgIUCBcNMTcwMTEwMDk1MzQwWjAT
AgIUERcNMTcwMTA0MTMzMjI1WjATAgIUEhcNMTcwMTA0MTMzMzU3WjATAgIUExcN
MTcwMTA0MTMzODI2WjATAgIURRcNMTcwMjA1MTYxNTE0WjATAgIURhcNMTcwMjA1
MTYyMDIyWjATAgIUXxcNMTcwMjEzMTYyMzQ5WjATAgIUbBcNMTcwMjI0MDc0MTU4
WjATAgIUfxcNMTcwMzA5MTAxNTI2WjATAgIUhxcNMTcwMzE1MDczNzE3WjATAgIU
txcNMTcwMzMwMTcxODQxWjATAgIUuBcNMTcwMzMwMTcxODI5WjATAgIUuRcNMTcw
MzMwMTcyMDIzWjATAgIU4hcNMTcwNDEzMDc1MDE3WjANBgkqhkiG9w0BAQsFAAOC
AQEAplaw9kFqKl3k/pF679iDMaLEVVyPg1yRnhO9a18D4FjCR/ZsDHOwdpows472
+/V1oPLQH9uISKfNWXAjBBMLP+XG4rQehvE45mvwTnCTe8LZ7rXipIjOc5BFDj4H
c57/eLB6e9NW++wng+mfKXzzhNKonfg9957PDC19Q4OZJT5J2g8xRQLfk86jGglv
hEK3Pn3xW5Hww7sN0BbKr4+gCasl6xw2ZMD0JxNcdPfLR+S9Er7aqVHCvncCR9ua
0ZRe1XeUFCwEb2269yhRG0qSMEHeFOs7ZvFqN+LSJQ0z8XBNtvSmLHbIszMJ+OJp
dZJOfdUZhmtxop0YahWKyDsdYw==
-----END X509 CRL-----

22
nginx/debsso.crt Normal file
View file

@ -0,0 +1,22 @@
-----BEGIN CERTIFICATE-----
MIIDlzCCAn+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBEMRowGAYDVQQDExFTU08g
Q0EgMjAxNS0wOC0yMTEmMCQGA1UEChMdRGViaWFuIFNTTyBjbGllbnQgY2VydGlm
aWNhdGUwIhgPMjAxNTA4MjEyMDQzMzVaGA85OTk5MTIzMTIzNTk1OVowRDEaMBgG
A1UEAxMRU1NPIENBIDIwMTUtMDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xp
ZW50IGNlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
1SUMNiEVMlycwDPlJhgJ099VorLDTW556XvbWSw8l7cnygs8V9bN83f6W2P8x328
dz+U1OxEZ/PnS+/zMwco03XQggXcNN+UjHwUu9WP5koNsPFH6HRbvUy5oBDfbdVN
EzBE2gXE4WYFoj45U9rSU6qLEnT4QKxJ/CbTeMGvLKzuXdCv6W+UxUfbh186kSqM
tfDtY3aQ+L6MuPA1a+bumUh9EGVZrrIMbjgm1xrQohQBJC75X10dnicUliGZ+7C0
h7pUQlIY+/IxREQ46xBY1CNYeZNMEI9ErMbiFiShsc3mP3aLxTAQ4KzHCDtIuzwD
ElH8aMPxIQOUyL/FLx8ZTQIDAQABo4GPMIGMMA8GA1UdEwEB/wQFMAMBAf8wEwYD
VR0lBAwwCgYIKwYBBQUHAwkwDwYDVR0PAQH/BAUDAwcGADAdBgNVHQ4EFgQU0OJ+
JoHgzarLNF+2eiay11GCk44wNAYDVR0fBC0wKzApoCegJYYjaHR0cHM6Ly9zc28u
ZGViaWFuLm9yZy9zcGthYy9jYS5jcmwwDQYJKoZIhvcNAQELBQADggEBAKynxkRr
7w85LHYzH5q9xVHXX6+K6r1mA3b+OAopNMJZTCTn7v9UVDncp26wOeHOUEvawWaQ
21HBd70CiFH0XGDow0/K68ite/0RHxq1WAuggBc678d/0yDkoWdFHAf9n5Agzf4J
rXov++XmBXYHRXiHunuSLnM3i8HToejZMCC7P9nqpPo0tK7O22calbZn20Pdve6k
KrKxwwjxpuNxezr6uYGuNTLJOZtyjF09FuAebSlHvX6VYPl7FnMUDcS6QerEyocL
Bv7pbsNWehIfvfjqPJQwqznieieZGL6s1zB8/XWQw37C0i28LqJ8DTvEjgmF44RP
6JhTYDnI06pKfQY=
-----END CERTIFICATE-----

8
nginx/dhparams.pem Normal file
View file

@ -0,0 +1,8 @@
-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEA8kUEh2+7OSDG3BQ22cJBlBM0jp+AWW8Wa64J0hE/gQaR8jw9VSQW
a+WBaDQ+FAcxOmAeVvrX4owvBocHBcVPmU4NEnkWe77qsCG56wEJWco+DgN3cq43
SYbhI3s2HNQwLCzUYLAMZVXcUDH4Nn3cRTTl3ZNpB99XhAio20frNpGQrQeUb0Of
dDj3QpLL1k09b+OVnAh+3KFHawrjzzyFf9pZMsrmK/wZR5SSds1TTisHjVaJe4zN
dcOfvQr5dUHl1mvwxYPnpbXmXdlDmdBU6/HCqkXpUcfl18bhwKG1UT7wmWuInizT
AsNFRK393l5eqlE+AFvWZpacMGGMGJhd+wIBAg==
-----END DH PARAMETERS-----

89
nginx/mime.types Normal file
View file

@ -0,0 +1,89 @@
types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;
image/png png;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;
image/svg+xml svg svgz;
image/webp webp;
application/font-woff woff;
application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.wap.wmlc wmlc;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xspf+xml xspf;
application/zip zip;
application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;
video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;
}

60
nginx/nginx.conf Normal file
View file

@ -0,0 +1,60 @@
events {
worker_connections 768;
}
pid /tmp/nginx.pid;
error_log /tmp/error;
http {
include mime.types;
default_type application/octet-stream;
ssl_dhparam dhparams.pem;
##
# Logging Settings
##
access_log /tmp/access-main;
#passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini;
#passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby;
##
# Gzip Settings
##
gzip on;
server {
listen *:3001 ssl;
ssl_certificate screenshots.debian.net.crt;
ssl_certificate_key screenshots.debian.net.key;
ssl_client_certificate debsso.crt;
ssl_crl debsso.crl;
ssl_verify_client optional;
ssl_verify_depth 1;
proxy_set_header X-Debian-SSO-DN $ssl_client_s_dn;
root ../public;
server_name _;
access_log /tmp/access-front;
# Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite
# redirection loop because the backend assumes that HTTP was spoken behind the
# proxy.
proxy_set_header X-Forwarded-Proto $scheme;
# Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs
proxy_set_header Host $host:$server_port;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
gzip_proxied any;
location / {
proxy_pass http://127.0.0.1:3000/;
}
}
}

View file

@ -0,0 +1,98 @@
-----BEGIN CERTIFICATE-----
MIIFEjCCA/qgAwIBAgIRAL/YYnl8IOX8JwWB+NpqTN4wDQYJKoZIhvcNAQELBQAw
XzELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBhcmlzMQ4wDAYDVQQHEwVQYXJpczEO
MAwGA1UEChMFR2FuZGkxIDAeBgNVBAMTF0dhbmRpIFN0YW5kYXJkIFNTTCBDQSAy
MB4XDTE1MDExMzAwMDAwMFoXDTE3MDMxMjIzNTk1OVowYTEhMB8GA1UECxMYRG9t
YWluIENvbnRyb2wgVmFsaWRhdGVkMRswGQYDVQQLExJHYW5kaSBTdGFuZGFyZCBT
U0wxHzAdBgNVBAMTFnNjcmVlbnNob3RzLmRlYmlhbi5uZXQwggEiMA0GCSqGSIb3
DQEBAQUAA4IBDwAwggEKAoIBAQC0QybbIT5MMZgmDONX2hY/oezY5pz9p3CfcQkc
I4y5GcWRtTKDn46y+gmcQA9wHZTHKMT7tEsGAx7/55KaG2TtNqoZnhmyRYG7MDIg
bztbdYA0/RwlVp/iVmqsc5Wsq7/ZmU/aIB2WDH6V2cWJgJoJ0LQMj/nCBRqS4n3+
YZxSr0fTrmBROHjw6pIp7AouVJ0NVeG8lnkhYXlqBpK+qmCyhj54UpvXVAYeoiS5
Qbld8kpQKZYvUdOnJyY2xUIaeGbIrQFRS6QAkSgi7B+ZkJkt06mGKwB6hLH6M2kL
UlKANIIEYVuMEYk2jYQL+pIdBDRlHpp5r3H6F11ZPctYP+INAgMBAAGjggHFMIIB
wTAfBgNVHSMEGDAWgBSzkKfYya9OzWE8n3ytXX9B/Wkw6jAdBgNVHQ4EFgQUxfoL
wPdHyJb6SwhYF0uesh28NlwwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAw
HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEsGA1UdIAREMEIwNgYLKwYB
BAGyMQECAhowJzAlBggrBgEFBQcCARYZaHR0cHM6Ly9jcHMudXNlcnRydXN0LmNv
bTAIBgZngQwBAgEwQQYDVR0fBDowODA2oDSgMoYwaHR0cDovL2NybC51c2VydHJ1
c3QuY29tL0dhbmRpU3RhbmRhcmRTU0xDQTIuY3JsMHMGCCsGAQUFBwEBBGcwZTA8
BggrBgEFBQcwAoYwaHR0cDovL2NydC51c2VydHJ1c3QuY29tL0dhbmRpU3RhbmRh
cmRTU0xDQTIuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3Qu
Y29tMD0GA1UdEQQ2MDSCFnNjcmVlbnNob3RzLmRlYmlhbi5uZXSCGnd3dy5zY3Jl
ZW5zaG90cy5kZWJpYW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQAtcPKcIeq6iFap
EaEuVIOpbfPQn1sF3tsKWGb9waHFBZX35BSXoie/IoxJk5m+MIu8UH+PTgcXPIGc
95eNxbLa+59RjTd3GRyLr7Gscfl1JuR1HzpBiW77q4nJUQoh+kNaeOmqHESi8kGv
2Fe6mVINlkyWyK2Gx337kUvQYKuowgqprVsrHNi9YI1H7d8VhaAiWQeD1AyAvi8W
roF9FiMmkOkTtAkoo28D2L1OkBW7PLgAT2J/zSI4Nf26duZmvETNn85NfLicGuTh
z3z+p6RVI6Rl7LitFvbnuaVCe7xysseCuXYg8uZAjQq+mN1LkdrDKbY+5e1/9ghl
yeR6Uwhu
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIF6TCCA9GgAwIBAgIQBeTcO5Q4qzuFl8umoZhQ4zANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQw
OTEyMDAwMDAwWhcNMjQwOTExMjM1OTU5WjBfMQswCQYDVQQGEwJGUjEOMAwGA1UE
CBMFUGFyaXMxDjAMBgNVBAcTBVBhcmlzMQ4wDAYDVQQKEwVHYW5kaTEgMB4GA1UE
AxMXR2FuZGkgU3RhbmRhcmQgU1NMIENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQCUBC2meZV0/9UAPPWu2JSxKXzAjwsLibmCg5duNyj1ohrP0pIL
m6jTh5RzhBCf3DXLwi2SrCG5yzv8QMHBgyHwv/j2nPqcghDA0I5O5Q1MsJFckLSk
QFEW2uSEEi0FXKEfFxkkUap66uEHG4aNAXLy59SDIzme4OFMH2sio7QQZrDtgpbX
bmq08j+1QvzdirWrui0dOnWbMdw+naxb00ENbLAb9Tr1eeohovj0M1JLJC0epJmx
bUi8uBL+cnB89/sCdfSN3tbawKAyGlLfOGsuRTg/PwSWAP2h9KK71RfWJ3wbWFmV
XooS/ZyrgT5SKEhRhWvzkbKGPym1bgNi7tYFAgMBAAGjggF1MIIBcTAfBgNVHSME
GDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUs5Cn2MmvTs1hPJ98
rV1/Qf1pMOowDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYD
VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIGA1UdIAQbMBkwDQYLKwYBBAGy
MQECAhowCAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNl
cnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNy
bDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRy
dXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZ
aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAWGf9
crJq13xhlhl+2UNG0SZ9yFP6ZrBrLafTqlb3OojQO3LJUP33WbKqaPWMcwO7lWUX
zi8c3ZgTopHJ7qFAbjyY1lzzsiI8Le4bpOHeICQW8owRc5E69vrOJAKHypPstLbI
FhfFcvwnQPYT/pOmnVHvPCvYd1ebjGU6NSU2t7WKY28HJ5OxYI2A25bUeo8tqxyI
yW5+1mUfr13KFj8oRtygNeX56eXVlogMT8a3d2dIhCe2H7Bo26y/d7CQuKLJHDJd
ArolQ4FCR7vY4Y8MDEZf7kYzawMUgtN+zY+vkNaOJH1AQrRqahfGlZfh8jjNp+20
J0CT33KpuMZmYzc4ZCIwojvxuch7yPspOqsactIGEk72gtQjbz7Dk+XYtsDe3CMW
1hMwt6CaDixVBgBwAc/qOR2A24j3pSC4W/0xJmmPLQphgzpHphNULB7j7UTKvGof
KA5R2d4On3XNDgOVyvnFqSot/kGkoUeuDcL5OWYzSlvhhChZbH2UF3bkRYKtcCD9
0m9jqNf6oDP6N8v3smWe2lBvP+Sn845dWDKXcCMu5/3EFZucJ48y7RetWIExKREa
m9T8bJUox04FB6b9HbwZ4ui3uRGKLXASUoWNjDNKD/yZkuBjcNqllEdjB+dYxzFf
BT02Vf6Dsuimrdfp5gJ0iHRc2jTbkNJtUQoj1iM=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFdzCCBF+gAwIBAgIQE+oocFv07O0MNmMJgGFDNjANBgkqhkiG9w0BAQwFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow
gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjAN
BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sIs9CsVw127c0n00yt
UINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnGvDoZtF+mvX2do2NC
tnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQIjy8/hPwhxR79uQf
jtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfbIWax1Jt4A8BQOujM
8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0tyA9yn8iNK5+O2hm
AUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97Exwzf4TKuzJM7UXiV
Z4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNVicQNwZNUMBkTrNN9
N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5D9kCnusSTJV882sF
qV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJWBp/kjbmUZIO8yZ9
HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ5lhCLkMaTLTwJUdZ
+gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzGKAgEJTm4Diup8kyX
HAc/DVL17e8vgg8CAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTv
A73gJMtUGjAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/
BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1Ud
HwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4
dGVybmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0
dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAJNl9jeD
lQ9ew4IcH9Z35zyKwKoJ8OkLJvHgwmp1ocd5yblSYMgpEg7wrQPWCcR23+WmgZWn
RtqCV6mVksW2jwMibDN3wXsyF24HzloUQToFJBv2FAY7qCUkDrvMKnXduXBBP3zQ
YzYhBx9G/2CkkeFnvN4ffhkUyWNnkepnB2u0j4vAbkN9w6GAbLIevFOFfdyQoaS8
Le9Gclc1Bb+7RrtubTeZtv8jkpHGbkD4jylW6l/VXxRTrPBPYer3IsynVgviuDQf
Jtl7GQVoP7o81DgGotPmjw7jtHFtQELFhLRAlSv0ZaBIefYdgWOWnU914Ph85I6p
0fKtirOMxyHNwu8=
-----END CERTIFICATE-----

View file

@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC0QybbIT5MMZgm
DONX2hY/oezY5pz9p3CfcQkcI4y5GcWRtTKDn46y+gmcQA9wHZTHKMT7tEsGAx7/
55KaG2TtNqoZnhmyRYG7MDIgbztbdYA0/RwlVp/iVmqsc5Wsq7/ZmU/aIB2WDH6V
2cWJgJoJ0LQMj/nCBRqS4n3+YZxSr0fTrmBROHjw6pIp7AouVJ0NVeG8lnkhYXlq
BpK+qmCyhj54UpvXVAYeoiS5Qbld8kpQKZYvUdOnJyY2xUIaeGbIrQFRS6QAkSgi
7B+ZkJkt06mGKwB6hLH6M2kLUlKANIIEYVuMEYk2jYQL+pIdBDRlHpp5r3H6F11Z
PctYP+INAgMBAAECggEAdU+GR/EYc8mKtKiKgy/AbuTYGEfsPv7qwjhzr0ZLXGKz
OqHrH9GEsmEaQ/9EjLgTjJCxsQSiFmWNlQiFVZkiU2XRyR4kpumpBcLVvFnnDRwo
tVNLL9lx74BBp70I2PhkwB2P4+omlvHGp4qzjUqN9HlH0y0XYvajVpfjWtr3Oq8S
8WlIE25fi0l8NGeMZg/pvX9I42+Os46kH/Cpmw+wZY2wptTosMe2IUFwTkMUyEuT
I3oJnz3VQ24d7Q01rQdllkRpg68HBtv99k7fIPs2pSwhiBXpM39jneeFfdY7GdKB
spyAipfmOkw8COuhXNbaewl+GBAkugNT9Bbgc+XmwQKBgQDnj5GNEJv9RgXQasYY
5opNCZhlPsfOVlyhqYc/niatnMRK6L6PRgDswbfNixa3bbymMCkjgTip7U0XsbWc
8ueq+b3CnutrM5p8R9LceStDdU4oB+Tt4egqH1VkezwqD9s9OgbPYnCRTjJ1JDXH
HtjY87XhSDABSoue3R+XVAb+WQKBgQDHSZLJTuf5htltbShc1TEP11ER01Bjlid6
bIs5XdnDsShl8DsPqrAnaiWrnHJegp3YYAcXi3fRIsO1Nbow/uk6fu9wNBt3fWPu
3T4Vf2MLUDtrsQJGQYB7JW79dbzo02Cz1tA4+b1LZil9JkRjmwub33G4Ww5+zWOi
+TzlW2wS1QKBgQDThDkX+gwDFmtJLb82D6BVLmaeVPJ+cDS9FvYMDpKWE5TaOC+Z
AADoQyt5/YsKkpq301ZAsFDqJ3E8K4ARlXA4pVfI5xF0IvcCfzkFW0lBnW1+83cS
NEC1+VkvJ8KVSVaiXtbJqMnacOt2RVU6Rdsekb+ZwS7Yfxd6TdIFkSOyQQKBgANc
MTZltzGU3Xuj2IdgLNiYh8xmJLfZI0dEJ0DLXU2YYhb96vEDrr6rYoE3PRJs315z
mAsElfuXu3cFteL3mVUcKMtahZAJNDMl1dMk97WMH8RcEq6+kf0Bj5KEdq/ySHIf
0Bj11QQ9b7uldoe7aIGzTcaO+nqW2fQ4gZdYaEUVAoGBAK5SPXvZPTPeloTrTT6T
ialF4hH8+8oibHqIac91tKFjHvP2eyJKreJ5DnLa/qGki8WCcc5BWvZtGwlc+2JV
0o9rqurSIsztr+nbXye1rdwG82pTdud50m0YM0VtXOEJ16l+d+hd9muB0ZaHp3t/
L3FxwwYVzwm+5QfHADevnvMN
-----END PRIVATE KEY-----

View file

@ -0,0 +1,122 @@
#user www-data;
#worker_processes 4;
pid /tmp/nginx.pid;
error_log /tmp/error-foo;
#events {
# worker_connections 768;
#}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 20;
types_hash_max_size 2048;
include mime.types;
default_type application/octet-stream;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_dhparam dhparams.pem;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 180m;
##
# Logging Settings
##
access_log /tmp/access-main;
error_log /tmp/error-main;
##
# Gzip Settings
##
gzip on;
##
# Phusion Passenger config
##
# Uncomment it if you installed passenger or passenger-enterprise
##
#passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini;
#passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby;
server {
listen *:8000 default_server;
listen *:8443 ssl;
ssl_certificate screenshots.debian.net.crt;
ssl_certificate_key screenshots.debian.net.key;
ssl_client_certificate debsso.crt;
ssl_crl debsso.crl;
ssl_verify_client optional;
ssl_verify_depth 1;
root ../public;
server_name _;
access_log /tmp/access-front;
error_log /tmp/error-front;
# Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite
# redirection loop because the backend assumes that HTTP was spoken behind the
# proxy.
proxy_set_header X-Forwarded-Proto $scheme;
# Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs
proxy_set_header Host $host;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
gzip_proxied any;
location / {
try_files /maintenance.html @backend;
add_header X-Coffee main;
}
location /json/ {
try_files /maintenance.html @backend;
add_header X-Coffee json;
}
location /favicon.ico {
# try_files /maintenance.html @backend;
alias ../public/favicon.ico;
}
location @backend {
proxy_pass http://127.0.0.1:3000;
}
#location /assets/ {
# alias ../public/assets/;
# expires 1h;
# add_header X-Coffee assets;
#}
location /logo/ {
alias ../public/logo/;
expires 1h;
add_header X-Coffee logo;
}
location /screenshots/ {
alias ../public/screenshots/;
expires max;
add_header X-Coffee screenshots;
}
location /images/ {
alias ../public/images/;
expires 1h;
add_header X-Coffee images;
}
location /debian_sso/ {
#
}
}
}

111
nginx/update-debsso-ca Executable file
View file

@ -0,0 +1,111 @@
#!/usr/bin/python3
# Download new versions of the CA certificate and Certificate Revocation List
# from sso.debian.org and write them out atomically.
import requests
import tempfile
import argparse
import os
import subprocess
import ssl
class atomic_writer(object):
"""
Atomically write to a file
"""
def __init__(self, fname, mode, osmode=0o644, sync=True, **kw):
self.fname = fname
self.osmode = osmode
self.sync = sync
dirname = os.path.dirname(self.fname)
self.fd, self.abspath = tempfile.mkstemp(dir=dirname, text="b" not in mode)
self.outfd = open(self.fd, mode, closefd=True, **kw)
def __enter__(self):
return self.outfd
def __exit__(self, exc_type, exc_val, exc_tb):
if exc_type is None:
self.outfd.flush()
if self.sync: os.fdatasync(self.fd)
os.fchmod(self.fd, self.osmode)
os.rename(self.abspath, self.fname)
else:
os.unlink(self.abspath)
self.outfd.close()
return False
def get_url(url):
"""
Fetch a URL and return the raw result as bytes
"""
bundle='/etc/ssl/ca-debian/ca-certificates.crt'
if os.path.exists(bundle):
res = requests.get(url, verify=bundle)
else:
res = requests.get(url)
res.raise_for_status()
return res.content
def update_file(pathname, content, validate=None):
"""
Write content on pathname atomically, and do nothing if pathname exists and
has the same content as `content`.
Returns True if the file has been updated, else False.
"""
try:
with open(pathname, "rb") as fd:
existing = fd.read()
except OSError:
existing = None
if existing == content: return False
# Validate the contents
if validate:
validate(content)
with atomic_writer(pathname, "wb", osmode=0o644) as out:
out.write(content)
return True
def validate_crt(data):
ssl.PEM_cert_to_DER_cert(data.decode("utf-8"))
def validate_crl(data):
if not data.startswith(b"-----BEGIN X509 CRL-----"):
raise RuntimeError("Data does not begin with a CRL signature")
if not data.endswith(b"-----END X509 CRL-----\n"):
raise RuntimeError("Data does not end with a CRL footer")
def update(destdir):
# Fetch the certificate and the CRL
cert = get_url("https://sso.debian.org/ca/ca.pem")
crl = get_url("https://sso.debian.org/ca/ca.crl")
# Write them out atomically
updated = False
updated = update_file(os.path.join(destdir, "debsso.crt"), cert, validate=validate_crt) or updated
updated = update_file(os.path.join(destdir, "debsso.crl"), crl, validate=validate_crl) or updated
return updated
def main():
parser = argparse.ArgumentParser()
parser.add_argument("--destdir", default=".", help="destination directory. Default: .")
parser.add_argument("--onupdate", help="command to run if the file has been updated. Default: do not run anything.")
args = parser.parse_args()
if update(args.destdir):
if args.onupdate:
subprocess.check_call(["sh", "-c", args.onupdate])
if __name__ == "__main__":
main()