diff --git a/nginx/debsso.crl b/nginx/debsso.crl new file mode 100644 index 0000000..feca8ce --- /dev/null +++ b/nginx/debsso.crl @@ -0,0 +1,74 @@ +-----BEGIN X509 CRL----- +MIINXzCCDEcwDQYJKoZIhvcNAQELBQAwRDEaMBgGA1UEAxMRU1NPIENBIDIwMTUt +MDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xpZW50IGNlcnRpZmljYXRlFw0x +NzA0MTcxMjAwMDFaFw0xNzA0MjAxMjAwMDFaMIIL0DATAgIQABcNMTUwODIxMjEy +NTI4WjATAgIQARcNMTUwODIxMjA1MDUxWjATAgIQAhcNMTUwODIxMjEwNjQ3WjAT +AgIQAxcNMTUwODIxMjEwNjQ5WjATAgIQBBcNMTUwODI0MTMwMjQyWjATAgIQBRcN +MTUwODIxMjEyNTMzWjATAgIQERcNMTYwMzE0MTQxMTAzWjATAgIQEhcNMTUwODI2 +MTExODUwWjATAgIQFRcNMTYwNTE1MDE0OTA1WjATAgIQFhcNMTYwMzIzMjMyNTE3 +WjATAgIQIBcNMTUwODI0MTMwMjQ0WjATAgIQIRcNMTUwODI0MTMwMjQ2WjATAgIQ +IhcNMTUwODI0MTMwMjQ2WjATAgIQIxcNMTUwODI0MTMwMzQ2WjATAgIQJRcNMTUx +MjE2MjAyMjM5WjATAgIQKBcNMTUwODI1MTUwODA3WjATAgIQMRcNMTUwODI2MTMz +ODQ4WjATAgIQNBcNMTUwODI2MTUyODE4WjATAgIQQRcNMTUxMjE2MTI1ODE0WjAT +AgIQRxcNMTUwODI4MDgxNDQ0WjATAgIQUBcNMTUwOTAxMDc1MjMxWjATAgIQURcN +MTUwOTAxMDc1MjM4WjATAgIQWxcNMTYwODE3MTcxNjM4WjATAgIQYhcNMTUwODI4 +MTM1NjI4WjATAgIQcBcNMTUwOTE0MTIyNzUwWjATAgIQehcNMTYwNjIwMDkwNDE1 +WjATAgIQjhcNMTYwMTEwMDEwNTEwWjATAgIQnBcNMTUxMTI1MTQ0NDI5WjATAgIQ +qBcNMTUwOTAyMTU0OTAxWjATAgIQvRcNMTUxMjA5MTM0NzQyWjATAgIQyhcNMTYw +NDA2MDkyNjI3WjATAgIQzxcNMTUxMDEyMDc1ODMxWjATAgIQ1RcNMTUxMDE5MTQ0 +MjIwWjATAgIQ1hcNMTYwNDA0MDgwMTUxWjATAgIQ6RcNMTYwODE3MTcxNjQwWjAT +AgIQ9BcNMTUxMTE3MTQxMzI1WjATAgIQ+RcNMTUxMTIwMTM0OTA2WjATAgIREBcN +MTYwMjA1MjEyODAxWjATAgIREhcNMTYwMzE4MjMwMjAyWjATAgIRExcNMTYwNjEx +MjI0ODI2WjATAgIRGRcNMTYxMjEwMTUzMzE3WjATAgIRHhcNMTYwNDA5MjAwODM1 +WjATAgIRHxcNMTYwNDA5MjAwODM5WjATAgIRJhcNMTUxMjE3MTYyNzM1WjATAgIR +JxcNMTYwNzA3MTA1MTMzWjATAgIRKxcNMTYwNjIwMDkwNDE3WjATAgIROBcNMTYw +ODE3MTcxNjQzWjATAgIRRBcNMTYxMDIwMDc0NjAzWjATAgIRSBcNMTYwMTIwMjAw +MjEzWjATAgIRbRcNMTYwMjEzMTgzODI2WjATAgIRchcNMTYxMjEwMTUzMzE1WjAT +AgIRcxcNMTYxMDA5MTcwMjIxWjATAgIRexcNMTYwMjI5MjMyNjU1WjATAgIRiRcN +MTYwNzA3MTA1MTMxWjATAgIRixcNMTYwMzE0MTQxMTA4WjATAgIRkRcNMTYwNjIw +MDkwNDE5WjATAgIRkhcNMTYwMzE0MTQxMTA2WjATAgIRlRcNMTcwMTE4MTYwMDI2 +WjATAgIRnxcNMTYxMDAzMjAwNjMzWjATAgIRohcNMTYwMzE4MTQwNjE5WjATAgIR +thcNMTYwMzE5MTUzNzQ3WjATAgIRuRcNMTYwMzE5MTYyMjQzWjATAgIRwhcNMTYw +MzIwMTE1MzAzWjATAgIRwxcNMTYwNTExMjI1ODE1WjATAgIRzxcNMTYwMzI0MDEx +MzMyWjATAgIR0RcNMTcwMjA3MTk1ODI5WjATAgIR5BcNMTYwNzAyMTUxNTMzWjAT +AgIR5xcNMTYwODE4MTUzMDUzWjATAgIR6hcNMTYwMzI5MTYyMDMzWjATAgIR7xcN +MTcwMzIyMjM0MTM5WjATAgIR9RcNMTYwMzI3MDgwMzI0WjATAgIR/BcNMTYwNTI0 +MjA1MDE4WjATAgIR/xcNMTYwNTA0MTk1NDMzWjATAgISFhcNMTcwMjE2MjEyODE5 +WjATAgISIRcNMTYwNDA4MDkyMjEwWjATAgISIhcNMTYwNDA4MDkyMjEyWjATAgIS +IxcNMTYwNDA4MDkyMjE1WjATAgISJBcNMTYwNDA4MDkyMjE3WjATAgISKBcNMTYw +NTAyMDU1MDAyWjATAgISMhcNMTYwNDA5MjAyOTU3WjATAgISPRcNMTYwNDEwMTkx +MjA3WjATAgISShcNMTYxMjEwMTUzMzE0WjATAgISUhcNMTYwNDIxMTYwNDU2WjAT +AgISbhcNMTYwNTE0MDE0MzEyWjATAgIScBcNMTYwNTEzMjIyOTMyWjATAgIScRcN +MTYwNTEzMjIyOTM2WjATAgIScxcNMTYwNTE0MDE0MzE4WjATAgISgRcNMTYwNjMw +MTUwMjU1WjATAgIShRcNMTYxMDAzMjAwNjI0WjATAgISqBcNMTYwNjA4MTQ0NTEz +WjATAgISrRcNMTYwNjExMjMwNjA4WjATAgISsRcNMTcwMzIyMjM0MTQ3WjATAgIS +sxcNMTYwNjIwMTM1MDAyWjATAgIStBcNMTYwNjIwMTM1MDAwWjATAgIStRcNMTYw +NjIwMTM0OTU4WjATAgISwRcNMTYxMTIyMTIxNDAzWjATAgIS5BcNMTYwOTI5MTcz +MTA4WjATAgIS5RcNMTYwOTI5MTczMDUzWjATAgITBRcNMTcwNDEzMDE1NDM0WjAT +AgITHxcNMTYwOTA4MDg1MDIzWjATAgITIBcNMTcwMTA2MjExMDU3WjATAgITIxcN +MTYxMTMwMTAzOTI1WjATAgITPBcNMTYwOTI5MTc0NzI3WjATAgITQhcNMTYwOTI5 +MTczNTQ1WjATAgITThcNMTYxMDA5MjA0NTQyWjATAgITTxcNMTYxMDA5MTcxMjIx +WjATAgITVRcNMTYxMDEyMTQwMDIwWjATAgITXBcNMTYxMjI4MTg0NzMxWjATAgIT +XRcNMTYxMDE2MTU1NzM2WjATAgITYxcNMTYxMDE4MTcwNzE0WjATAgITaxcNMTcw +NDE3MTA1MTIxWjATAgITbhcNMTYxMjE4MTYwNTI0WjATAgITchcNMTYxMDI0MjA1 +MjU3WjATAgITfhcNMTcwMTE3MTAzMzMzWjATAgITghcNMTYxMDMwMTgzODQyWjAT +AgIThxcNMTYxMDMxMjE0NzUyWjATAgITiBcNMTYxMDMxMjE0MzE4WjATAgITixcN +MTYxMTAyMTkyOTIxWjATAgITmBcNMTYxMTA4MTkyODE2WjATAgITmRcNMTYxMTA4 +MTkzNTExWjATAgITmhcNMTYxMTA4MTkzNTEyWjATAgITnRcNMTcwMTA2MjExMDU2 +WjATAgITpRcNMTYxMTEwMjE1NjA5WjATAgITphcNMTYxMTEwMjIxODE1WjATAgIT +uxcNMTcwMTAxMTAwNDQxWjATAgIT5hcNMTcwMTA2MjExMDU1WjATAgIT8xcNMTYx +MjIxMjEzMjQ0WjATAgIT+BcNMTYxMjIzMjIzNTQ0WjATAgIT+RcNMTYxMjIzMjIz +NTQzWjATAgIUABcNMTYxMjMwMDA1NjM2WjATAgIUCBcNMTcwMTEwMDk1MzQwWjAT +AgIUERcNMTcwMTA0MTMzMjI1WjATAgIUEhcNMTcwMTA0MTMzMzU3WjATAgIUExcN +MTcwMTA0MTMzODI2WjATAgIURRcNMTcwMjA1MTYxNTE0WjATAgIURhcNMTcwMjA1 +MTYyMDIyWjATAgIUXxcNMTcwMjEzMTYyMzQ5WjATAgIUbBcNMTcwMjI0MDc0MTU4 +WjATAgIUfxcNMTcwMzA5MTAxNTI2WjATAgIUhxcNMTcwMzE1MDczNzE3WjATAgIU +txcNMTcwMzMwMTcxODQxWjATAgIUuBcNMTcwMzMwMTcxODI5WjATAgIUuRcNMTcw +MzMwMTcyMDIzWjATAgIU4hcNMTcwNDEzMDc1MDE3WjANBgkqhkiG9w0BAQsFAAOC +AQEAplaw9kFqKl3k/pF679iDMaLEVVyPg1yRnhO9a18D4FjCR/ZsDHOwdpows472 ++/V1oPLQH9uISKfNWXAjBBMLP+XG4rQehvE45mvwTnCTe8LZ7rXipIjOc5BFDj4H +c57/eLB6e9NW++wng+mfKXzzhNKonfg9957PDC19Q4OZJT5J2g8xRQLfk86jGglv +hEK3Pn3xW5Hww7sN0BbKr4+gCasl6xw2ZMD0JxNcdPfLR+S9Er7aqVHCvncCR9ua +0ZRe1XeUFCwEb2269yhRG0qSMEHeFOs7ZvFqN+LSJQ0z8XBNtvSmLHbIszMJ+OJp +dZJOfdUZhmtxop0YahWKyDsdYw== +-----END X509 CRL----- diff --git a/nginx/debsso.crt b/nginx/debsso.crt new file mode 100644 index 0000000..48ae9e0 --- /dev/null +++ b/nginx/debsso.crt @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDlzCCAn+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBEMRowGAYDVQQDExFTU08g +Q0EgMjAxNS0wOC0yMTEmMCQGA1UEChMdRGViaWFuIFNTTyBjbGllbnQgY2VydGlm +aWNhdGUwIhgPMjAxNTA4MjEyMDQzMzVaGA85OTk5MTIzMTIzNTk1OVowRDEaMBgG +A1UEAxMRU1NPIENBIDIwMTUtMDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xp +ZW50IGNlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +1SUMNiEVMlycwDPlJhgJ099VorLDTW556XvbWSw8l7cnygs8V9bN83f6W2P8x328 +dz+U1OxEZ/PnS+/zMwco03XQggXcNN+UjHwUu9WP5koNsPFH6HRbvUy5oBDfbdVN +EzBE2gXE4WYFoj45U9rSU6qLEnT4QKxJ/CbTeMGvLKzuXdCv6W+UxUfbh186kSqM +tfDtY3aQ+L6MuPA1a+bumUh9EGVZrrIMbjgm1xrQohQBJC75X10dnicUliGZ+7C0 +h7pUQlIY+/IxREQ46xBY1CNYeZNMEI9ErMbiFiShsc3mP3aLxTAQ4KzHCDtIuzwD +ElH8aMPxIQOUyL/FLx8ZTQIDAQABo4GPMIGMMA8GA1UdEwEB/wQFMAMBAf8wEwYD +VR0lBAwwCgYIKwYBBQUHAwkwDwYDVR0PAQH/BAUDAwcGADAdBgNVHQ4EFgQU0OJ+ +JoHgzarLNF+2eiay11GCk44wNAYDVR0fBC0wKzApoCegJYYjaHR0cHM6Ly9zc28u +ZGViaWFuLm9yZy9zcGthYy9jYS5jcmwwDQYJKoZIhvcNAQELBQADggEBAKynxkRr +7w85LHYzH5q9xVHXX6+K6r1mA3b+OAopNMJZTCTn7v9UVDncp26wOeHOUEvawWaQ +21HBd70CiFH0XGDow0/K68ite/0RHxq1WAuggBc678d/0yDkoWdFHAf9n5Agzf4J +rXov++XmBXYHRXiHunuSLnM3i8HToejZMCC7P9nqpPo0tK7O22calbZn20Pdve6k +KrKxwwjxpuNxezr6uYGuNTLJOZtyjF09FuAebSlHvX6VYPl7FnMUDcS6QerEyocL +Bv7pbsNWehIfvfjqPJQwqznieieZGL6s1zB8/XWQw37C0i28LqJ8DTvEjgmF44RP +6JhTYDnI06pKfQY= +-----END CERTIFICATE----- diff --git a/nginx/dhparams.pem b/nginx/dhparams.pem new file mode 100644 index 0000000..d273d31 --- /dev/null +++ b/nginx/dhparams.pem @@ -0,0 +1,8 @@ +-----BEGIN DH PARAMETERS----- +MIIBCAKCAQEA8kUEh2+7OSDG3BQ22cJBlBM0jp+AWW8Wa64J0hE/gQaR8jw9VSQW +a+WBaDQ+FAcxOmAeVvrX4owvBocHBcVPmU4NEnkWe77qsCG56wEJWco+DgN3cq43 +SYbhI3s2HNQwLCzUYLAMZVXcUDH4Nn3cRTTl3ZNpB99XhAio20frNpGQrQeUb0Of +dDj3QpLL1k09b+OVnAh+3KFHawrjzzyFf9pZMsrmK/wZR5SSds1TTisHjVaJe4zN +dcOfvQr5dUHl1mvwxYPnpbXmXdlDmdBU6/HCqkXpUcfl18bhwKG1UT7wmWuInizT +AsNFRK393l5eqlE+AFvWZpacMGGMGJhd+wIBAg== +-----END DH PARAMETERS----- diff --git a/nginx/mime.types b/nginx/mime.types new file mode 100644 index 0000000..89be9a4 --- /dev/null +++ b/nginx/mime.types @@ -0,0 +1,89 @@ + +types { + text/html html htm shtml; + text/css css; + text/xml xml; + image/gif gif; + image/jpeg jpeg jpg; + application/javascript js; + application/atom+xml atom; + application/rss+xml rss; + + text/mathml mml; + text/plain txt; + text/vnd.sun.j2me.app-descriptor jad; + text/vnd.wap.wml wml; + text/x-component htc; + + image/png png; + image/tiff tif tiff; + image/vnd.wap.wbmp wbmp; + image/x-icon ico; + image/x-jng jng; + image/x-ms-bmp bmp; + image/svg+xml svg svgz; + image/webp webp; + + application/font-woff woff; + application/java-archive jar war ear; + application/json json; + application/mac-binhex40 hqx; + application/msword doc; + application/pdf pdf; + application/postscript ps eps ai; + application/rtf rtf; + application/vnd.apple.mpegurl m3u8; + application/vnd.ms-excel xls; + application/vnd.ms-fontobject eot; + application/vnd.ms-powerpoint ppt; + application/vnd.wap.wmlc wmlc; + application/vnd.google-earth.kml+xml kml; + application/vnd.google-earth.kmz kmz; + application/x-7z-compressed 7z; + application/x-cocoa cco; + application/x-java-archive-diff jardiff; + application/x-java-jnlp-file jnlp; + application/x-makeself run; + application/x-perl pl pm; + application/x-pilot prc pdb; + application/x-rar-compressed rar; + application/x-redhat-package-manager rpm; + application/x-sea sea; + application/x-shockwave-flash swf; + application/x-stuffit sit; + application/x-tcl tcl tk; + application/x-x509-ca-cert der pem crt; + application/x-xpinstall xpi; + application/xhtml+xml xhtml; + application/xspf+xml xspf; + application/zip zip; + + application/octet-stream bin exe dll; + application/octet-stream deb; + application/octet-stream dmg; + application/octet-stream iso img; + application/octet-stream msi msp msm; + + application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; + application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; + application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; + + audio/midi mid midi kar; + audio/mpeg mp3; + audio/ogg ogg; + audio/x-m4a m4a; + audio/x-realaudio ra; + + video/3gpp 3gpp 3gp; + video/mp2t ts; + video/mp4 mp4; + video/mpeg mpeg mpg; + video/quicktime mov; + video/webm webm; + video/x-flv flv; + video/x-m4v m4v; + video/x-mng mng; + video/x-ms-asf asx asf; + video/x-ms-wmv wmv; + video/x-msvideo avi; +} diff --git a/nginx/nginx.conf b/nginx/nginx.conf new file mode 100644 index 0000000..b8eb866 --- /dev/null +++ b/nginx/nginx.conf @@ -0,0 +1,60 @@ +events { + worker_connections 768; +} + +pid /tmp/nginx.pid; +error_log /tmp/error; + +http { + include mime.types; + default_type application/octet-stream; + + ssl_dhparam dhparams.pem; + + ## + # Logging Settings + ## + + access_log /tmp/access-main; + + + #passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini; + #passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby; + + + ## + # Gzip Settings + ## + + gzip on; + + server { + listen *:3001 ssl; + ssl_certificate screenshots.debian.net.crt; + ssl_certificate_key screenshots.debian.net.key; + ssl_client_certificate debsso.crt; + ssl_crl debsso.crl; + ssl_verify_client optional; + ssl_verify_depth 1; + proxy_set_header X-Debian-SSO-DN $ssl_client_s_dn; + + root ../public; + server_name _; + access_log /tmp/access-front; + + # Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite + # redirection loop because the backend assumes that HTTP was spoken behind the + # proxy. + proxy_set_header X-Forwarded-Proto $scheme; + + # Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs + proxy_set_header Host $host:$server_port; + + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; + gzip_proxied any; + + location / { + proxy_pass http://127.0.0.1:3000/; + } + } +} diff --git a/nginx/screenshots.debian.net.crt b/nginx/screenshots.debian.net.crt new file mode 100644 index 0000000..b5460bd --- /dev/null +++ b/nginx/screenshots.debian.net.crt @@ -0,0 +1,98 @@ +-----BEGIN CERTIFICATE----- +MIIFEjCCA/qgAwIBAgIRAL/YYnl8IOX8JwWB+NpqTN4wDQYJKoZIhvcNAQELBQAw +XzELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBhcmlzMQ4wDAYDVQQHEwVQYXJpczEO +MAwGA1UEChMFR2FuZGkxIDAeBgNVBAMTF0dhbmRpIFN0YW5kYXJkIFNTTCBDQSAy +MB4XDTE1MDExMzAwMDAwMFoXDTE3MDMxMjIzNTk1OVowYTEhMB8GA1UECxMYRG9t +YWluIENvbnRyb2wgVmFsaWRhdGVkMRswGQYDVQQLExJHYW5kaSBTdGFuZGFyZCBT +U0wxHzAdBgNVBAMTFnNjcmVlbnNob3RzLmRlYmlhbi5uZXQwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQC0QybbIT5MMZgmDONX2hY/oezY5pz9p3CfcQkc +I4y5GcWRtTKDn46y+gmcQA9wHZTHKMT7tEsGAx7/55KaG2TtNqoZnhmyRYG7MDIg +bztbdYA0/RwlVp/iVmqsc5Wsq7/ZmU/aIB2WDH6V2cWJgJoJ0LQMj/nCBRqS4n3+ +YZxSr0fTrmBROHjw6pIp7AouVJ0NVeG8lnkhYXlqBpK+qmCyhj54UpvXVAYeoiS5 +Qbld8kpQKZYvUdOnJyY2xUIaeGbIrQFRS6QAkSgi7B+ZkJkt06mGKwB6hLH6M2kL +UlKANIIEYVuMEYk2jYQL+pIdBDRlHpp5r3H6F11ZPctYP+INAgMBAAGjggHFMIIB +wTAfBgNVHSMEGDAWgBSzkKfYya9OzWE8n3ytXX9B/Wkw6jAdBgNVHQ4EFgQUxfoL +wPdHyJb6SwhYF0uesh28NlwwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAw +HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEsGA1UdIAREMEIwNgYLKwYB +BAGyMQECAhowJzAlBggrBgEFBQcCARYZaHR0cHM6Ly9jcHMudXNlcnRydXN0LmNv +bTAIBgZngQwBAgEwQQYDVR0fBDowODA2oDSgMoYwaHR0cDovL2NybC51c2VydHJ1 +c3QuY29tL0dhbmRpU3RhbmRhcmRTU0xDQTIuY3JsMHMGCCsGAQUFBwEBBGcwZTA8 +BggrBgEFBQcwAoYwaHR0cDovL2NydC51c2VydHJ1c3QuY29tL0dhbmRpU3RhbmRh +cmRTU0xDQTIuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3Qu +Y29tMD0GA1UdEQQ2MDSCFnNjcmVlbnNob3RzLmRlYmlhbi5uZXSCGnd3dy5zY3Jl +ZW5zaG90cy5kZWJpYW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQAtcPKcIeq6iFap +EaEuVIOpbfPQn1sF3tsKWGb9waHFBZX35BSXoie/IoxJk5m+MIu8UH+PTgcXPIGc +95eNxbLa+59RjTd3GRyLr7Gscfl1JuR1HzpBiW77q4nJUQoh+kNaeOmqHESi8kGv +2Fe6mVINlkyWyK2Gx337kUvQYKuowgqprVsrHNi9YI1H7d8VhaAiWQeD1AyAvi8W +roF9FiMmkOkTtAkoo28D2L1OkBW7PLgAT2J/zSI4Nf26duZmvETNn85NfLicGuTh +z3z+p6RVI6Rl7LitFvbnuaVCe7xysseCuXYg8uZAjQq+mN1LkdrDKbY+5e1/9ghl +yeR6Uwhu +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF6TCCA9GgAwIBAgIQBeTcO5Q4qzuFl8umoZhQ4zANBgkqhkiG9w0BAQwFADCB +iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl +cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV +BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQw +OTEyMDAwMDAwWhcNMjQwOTExMjM1OTU5WjBfMQswCQYDVQQGEwJGUjEOMAwGA1UE +CBMFUGFyaXMxDjAMBgNVBAcTBVBhcmlzMQ4wDAYDVQQKEwVHYW5kaTEgMB4GA1UE +AxMXR2FuZGkgU3RhbmRhcmQgU1NMIENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IB +DwAwggEKAoIBAQCUBC2meZV0/9UAPPWu2JSxKXzAjwsLibmCg5duNyj1ohrP0pIL +m6jTh5RzhBCf3DXLwi2SrCG5yzv8QMHBgyHwv/j2nPqcghDA0I5O5Q1MsJFckLSk +QFEW2uSEEi0FXKEfFxkkUap66uEHG4aNAXLy59SDIzme4OFMH2sio7QQZrDtgpbX +bmq08j+1QvzdirWrui0dOnWbMdw+naxb00ENbLAb9Tr1eeohovj0M1JLJC0epJmx +bUi8uBL+cnB89/sCdfSN3tbawKAyGlLfOGsuRTg/PwSWAP2h9KK71RfWJ3wbWFmV +XooS/ZyrgT5SKEhRhWvzkbKGPym1bgNi7tYFAgMBAAGjggF1MIIBcTAfBgNVHSME +GDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUs5Cn2MmvTs1hPJ98 +rV1/Qf1pMOowDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYD +VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIGA1UdIAQbMBkwDQYLKwYBBAGy +MQECAhowCAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNl +cnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNy +bDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRy +dXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZ +aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAWGf9 +crJq13xhlhl+2UNG0SZ9yFP6ZrBrLafTqlb3OojQO3LJUP33WbKqaPWMcwO7lWUX +zi8c3ZgTopHJ7qFAbjyY1lzzsiI8Le4bpOHeICQW8owRc5E69vrOJAKHypPstLbI +FhfFcvwnQPYT/pOmnVHvPCvYd1ebjGU6NSU2t7WKY28HJ5OxYI2A25bUeo8tqxyI +yW5+1mUfr13KFj8oRtygNeX56eXVlogMT8a3d2dIhCe2H7Bo26y/d7CQuKLJHDJd +ArolQ4FCR7vY4Y8MDEZf7kYzawMUgtN+zY+vkNaOJH1AQrRqahfGlZfh8jjNp+20 +J0CT33KpuMZmYzc4ZCIwojvxuch7yPspOqsactIGEk72gtQjbz7Dk+XYtsDe3CMW +1hMwt6CaDixVBgBwAc/qOR2A24j3pSC4W/0xJmmPLQphgzpHphNULB7j7UTKvGof +KA5R2d4On3XNDgOVyvnFqSot/kGkoUeuDcL5OWYzSlvhhChZbH2UF3bkRYKtcCD9 +0m9jqNf6oDP6N8v3smWe2lBvP+Sn845dWDKXcCMu5/3EFZucJ48y7RetWIExKREa +m9T8bJUox04FB6b9HbwZ4ui3uRGKLXASUoWNjDNKD/yZkuBjcNqllEdjB+dYxzFf +BT02Vf6Dsuimrdfp5gJ0iHRc2jTbkNJtUQoj1iM= +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIFdzCCBF+gAwIBAgIQE+oocFv07O0MNmMJgGFDNjANBgkqhkiG9w0BAQwFADBv +MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk +ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF +eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow +gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK +ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD +VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjAN +BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sIs9CsVw127c0n00yt +UINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnGvDoZtF+mvX2do2NC +tnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQIjy8/hPwhxR79uQf +jtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfbIWax1Jt4A8BQOujM +8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0tyA9yn8iNK5+O2hm +AUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97Exwzf4TKuzJM7UXiV +Z4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNVicQNwZNUMBkTrNN9 +N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5D9kCnusSTJV882sF +qV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJWBp/kjbmUZIO8yZ9 +HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ5lhCLkMaTLTwJUdZ ++gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzGKAgEJTm4Diup8kyX +HAc/DVL17e8vgg8CAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTv +A73gJMtUGjAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/ +BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1Ud +HwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4 +dGVybmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0 +dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAJNl9jeD +lQ9ew4IcH9Z35zyKwKoJ8OkLJvHgwmp1ocd5yblSYMgpEg7wrQPWCcR23+WmgZWn +RtqCV6mVksW2jwMibDN3wXsyF24HzloUQToFJBv2FAY7qCUkDrvMKnXduXBBP3zQ +YzYhBx9G/2CkkeFnvN4ffhkUyWNnkepnB2u0j4vAbkN9w6GAbLIevFOFfdyQoaS8 +Le9Gclc1Bb+7RrtubTeZtv8jkpHGbkD4jylW6l/VXxRTrPBPYer3IsynVgviuDQf +Jtl7GQVoP7o81DgGotPmjw7jtHFtQELFhLRAlSv0ZaBIefYdgWOWnU914Ph85I6p +0fKtirOMxyHNwu8= +-----END CERTIFICATE----- + diff --git a/nginx/screenshots.debian.net.key b/nginx/screenshots.debian.net.key new file mode 100644 index 0000000..f1476b2 --- /dev/null +++ b/nginx/screenshots.debian.net.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC0QybbIT5MMZgm +DONX2hY/oezY5pz9p3CfcQkcI4y5GcWRtTKDn46y+gmcQA9wHZTHKMT7tEsGAx7/ +55KaG2TtNqoZnhmyRYG7MDIgbztbdYA0/RwlVp/iVmqsc5Wsq7/ZmU/aIB2WDH6V +2cWJgJoJ0LQMj/nCBRqS4n3+YZxSr0fTrmBROHjw6pIp7AouVJ0NVeG8lnkhYXlq +BpK+qmCyhj54UpvXVAYeoiS5Qbld8kpQKZYvUdOnJyY2xUIaeGbIrQFRS6QAkSgi +7B+ZkJkt06mGKwB6hLH6M2kLUlKANIIEYVuMEYk2jYQL+pIdBDRlHpp5r3H6F11Z +PctYP+INAgMBAAECggEAdU+GR/EYc8mKtKiKgy/AbuTYGEfsPv7qwjhzr0ZLXGKz +OqHrH9GEsmEaQ/9EjLgTjJCxsQSiFmWNlQiFVZkiU2XRyR4kpumpBcLVvFnnDRwo +tVNLL9lx74BBp70I2PhkwB2P4+omlvHGp4qzjUqN9HlH0y0XYvajVpfjWtr3Oq8S +8WlIE25fi0l8NGeMZg/pvX9I42+Os46kH/Cpmw+wZY2wptTosMe2IUFwTkMUyEuT +I3oJnz3VQ24d7Q01rQdllkRpg68HBtv99k7fIPs2pSwhiBXpM39jneeFfdY7GdKB +spyAipfmOkw8COuhXNbaewl+GBAkugNT9Bbgc+XmwQKBgQDnj5GNEJv9RgXQasYY +5opNCZhlPsfOVlyhqYc/niatnMRK6L6PRgDswbfNixa3bbymMCkjgTip7U0XsbWc +8ueq+b3CnutrM5p8R9LceStDdU4oB+Tt4egqH1VkezwqD9s9OgbPYnCRTjJ1JDXH +HtjY87XhSDABSoue3R+XVAb+WQKBgQDHSZLJTuf5htltbShc1TEP11ER01Bjlid6 +bIs5XdnDsShl8DsPqrAnaiWrnHJegp3YYAcXi3fRIsO1Nbow/uk6fu9wNBt3fWPu +3T4Vf2MLUDtrsQJGQYB7JW79dbzo02Cz1tA4+b1LZil9JkRjmwub33G4Ww5+zWOi ++TzlW2wS1QKBgQDThDkX+gwDFmtJLb82D6BVLmaeVPJ+cDS9FvYMDpKWE5TaOC+Z +AADoQyt5/YsKkpq301ZAsFDqJ3E8K4ARlXA4pVfI5xF0IvcCfzkFW0lBnW1+83cS +NEC1+VkvJ8KVSVaiXtbJqMnacOt2RVU6Rdsekb+ZwS7Yfxd6TdIFkSOyQQKBgANc +MTZltzGU3Xuj2IdgLNiYh8xmJLfZI0dEJ0DLXU2YYhb96vEDrr6rYoE3PRJs315z +mAsElfuXu3cFteL3mVUcKMtahZAJNDMl1dMk97WMH8RcEq6+kf0Bj5KEdq/ySHIf +0Bj11QQ9b7uldoe7aIGzTcaO+nqW2fQ4gZdYaEUVAoGBAK5SPXvZPTPeloTrTT6T +ialF4hH8+8oibHqIac91tKFjHvP2eyJKreJ5DnLa/qGki8WCcc5BWvZtGwlc+2JV +0o9rqurSIsztr+nbXye1rdwG82pTdud50m0YM0VtXOEJ16l+d+hd9muB0ZaHp3t/ +L3FxwwYVzwm+5QfHADevnvMN +-----END PRIVATE KEY----- diff --git a/nginx/sophisticated-nginx.conf b/nginx/sophisticated-nginx.conf new file mode 100644 index 0000000..c8f113a --- /dev/null +++ b/nginx/sophisticated-nginx.conf @@ -0,0 +1,122 @@ +#user www-data; +#worker_processes 4; +pid /tmp/nginx.pid; +error_log /tmp/error-foo; + +#events { +# worker_connections 768; +#} + +http { + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 20; + types_hash_max_size 2048; + + include mime.types; + default_type application/octet-stream; + + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE + ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; + ssl_dhparam dhparams.pem; + + ssl_prefer_server_ciphers on; + ssl_session_cache shared:SSL:20m; + ssl_session_timeout 180m; + + ## + # Logging Settings + ## + + access_log /tmp/access-main; + error_log /tmp/error-main; + + ## + # Gzip Settings + ## + + gzip on; + + ## + # Phusion Passenger config + ## + # Uncomment it if you installed passenger or passenger-enterprise + ## + + #passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini; + #passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby; + + + server { + listen *:8000 default_server; + listen *:8443 ssl; + ssl_certificate screenshots.debian.net.crt; + ssl_certificate_key screenshots.debian.net.key; + ssl_client_certificate debsso.crt; + ssl_crl debsso.crl; + ssl_verify_client optional; + ssl_verify_depth 1; + + root ../public; + server_name _; + access_log /tmp/access-front; + error_log /tmp/error-front; + + # Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite + # redirection loop because the backend assumes that HTTP was spoken behind the + # proxy. + proxy_set_header X-Forwarded-Proto $scheme; + + # Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs + proxy_set_header Host $host; + + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; + gzip_proxied any; + + location / { + try_files /maintenance.html @backend; + add_header X-Coffee main; + } + + location /json/ { + try_files /maintenance.html @backend; + add_header X-Coffee json; + } + + location /favicon.ico { + # try_files /maintenance.html @backend; + alias ../public/favicon.ico; + } + + location @backend { + proxy_pass http://127.0.0.1:3000; + } + + #location /assets/ { + # alias ../public/assets/; + # expires 1h; + # add_header X-Coffee assets; + #} + location /logo/ { + alias ../public/logo/; + expires 1h; + add_header X-Coffee logo; + } + location /screenshots/ { + alias ../public/screenshots/; + expires max; + add_header X-Coffee screenshots; + } + location /images/ { + alias ../public/images/; + expires 1h; + add_header X-Coffee images; + } + + location /debian_sso/ { + # + } + } +} + diff --git a/nginx/update-debsso-ca b/nginx/update-debsso-ca new file mode 100755 index 0000000..90e2a5b --- /dev/null +++ b/nginx/update-debsso-ca @@ -0,0 +1,111 @@ +#!/usr/bin/python3 + +# Download new versions of the CA certificate and Certificate Revocation List +# from sso.debian.org and write them out atomically. + +import requests +import tempfile +import argparse +import os +import subprocess +import ssl + +class atomic_writer(object): + """ + Atomically write to a file + """ + def __init__(self, fname, mode, osmode=0o644, sync=True, **kw): + self.fname = fname + self.osmode = osmode + self.sync = sync + dirname = os.path.dirname(self.fname) + self.fd, self.abspath = tempfile.mkstemp(dir=dirname, text="b" not in mode) + self.outfd = open(self.fd, mode, closefd=True, **kw) + + def __enter__(self): + return self.outfd + + def __exit__(self, exc_type, exc_val, exc_tb): + if exc_type is None: + self.outfd.flush() + if self.sync: os.fdatasync(self.fd) + os.fchmod(self.fd, self.osmode) + os.rename(self.abspath, self.fname) + else: + os.unlink(self.abspath) + self.outfd.close() + return False + + +def get_url(url): + """ + Fetch a URL and return the raw result as bytes + """ + bundle='/etc/ssl/ca-debian/ca-certificates.crt' + if os.path.exists(bundle): + res = requests.get(url, verify=bundle) + else: + res = requests.get(url) + res.raise_for_status() + return res.content + + +def update_file(pathname, content, validate=None): + """ + Write content on pathname atomically, and do nothing if pathname exists and + has the same content as `content`. + + Returns True if the file has been updated, else False. + """ + try: + with open(pathname, "rb") as fd: + existing = fd.read() + except OSError: + existing = None + + if existing == content: return False + + # Validate the contents + if validate: + validate(content) + + with atomic_writer(pathname, "wb", osmode=0o644) as out: + out.write(content) + return True + +def validate_crt(data): + ssl.PEM_cert_to_DER_cert(data.decode("utf-8")) + +def validate_crl(data): + if not data.startswith(b"-----BEGIN X509 CRL-----"): + raise RuntimeError("Data does not begin with a CRL signature") + if not data.endswith(b"-----END X509 CRL-----\n"): + raise RuntimeError("Data does not end with a CRL footer") + +def update(destdir): + # Fetch the certificate and the CRL + cert = get_url("https://sso.debian.org/ca/ca.pem") + crl = get_url("https://sso.debian.org/ca/ca.crl") + + # Write them out atomically + + updated = False + updated = update_file(os.path.join(destdir, "debsso.crt"), cert, validate=validate_crt) or updated + updated = update_file(os.path.join(destdir, "debsso.crl"), crl, validate=validate_crl) or updated + return updated + + +def main(): + parser = argparse.ArgumentParser() + parser.add_argument("--destdir", default=".", help="destination directory. Default: .") + parser.add_argument("--onupdate", help="command to run if the file has been updated. Default: do not run anything.") + args = parser.parse_args() + + if update(args.destdir): + if args.onupdate: + subprocess.check_call(["sh", "-c", args.onupdate]) + + + +if __name__ == "__main__": + main()