diff --git a/doc/README.DeveloperNotes b/doc/README.DeveloperNotes.md similarity index 84% rename from doc/README.DeveloperNotes rename to doc/README.DeveloperNotes.md index 407991e..2f24efd 100644 --- a/doc/README.DeveloperNotes +++ b/doc/README.DeveloperNotes.md @@ -1,3 +1,5 @@ +This file collects various notes about how certain aspects are implemented. + # Full text search The pg_search Ruby gem is used for full-text searched in Rails. @@ -21,7 +23,7 @@ SELECT COUNT(*) FROM "packages" WHERE ( ) ) -# Index: +## Create search index to speed up searches significantly CREATE INDEX packages_gin ON packages USING GIN( (to_tsvector('simple', coalesce("packages"."name"::text, '')) || to_tsvector('simple', @@ -33,27 +35,21 @@ coalesce("packages"."long_description"::text, ''))) ); Used: https://github.com/semaperepelitsa/jquery.fileupload-rails Which is a gem for: https://github.com/blueimp/jQuery-File-Upload +--- + Paperclip for attachment/screenshot file handlind within ActiveRecord https://github.com/thoughtbot/paperclip --- +Rails 5 is said to contain functionality like that already. +Might be worth migrating to that at some time. -Components: - -- Rails 5 (widespread, up-to-date, solves many common problems) -- PostgreSQL (fast, easy, I don't like MySQL, good fulltext search) -- Git (most people nowadays use Git) -- jQuery (well known and easy to use) -- Zurb Foundation (integrates nicer than Twitter Bootstrap) -- Guard for automated testing (http://www.rubydoc.info/gems/guard-rails) - --- +--- Importer How Debian repositories are organized: https://wiki.debian.org/RepositoryFormat --- +--- Logging from within the application into the database's "log" table: @@ -61,7 +57,7 @@ Log.log "foo" or with section (default='frontend'): Log.log "foo", "importer" --- +--- To create admin users --------------------- diff --git a/doc/README.Development b/doc/README.Development deleted file mode 100644 index 2caf479..0000000 --- a/doc/README.Development +++ /dev/null @@ -1,5 +0,0 @@ -To run the Rails server in development mode on port 3001 with HTTPS: - - rails s puma -b 'ssl://0.0.0.0:3001?key=nginx/localhost.key&cert=nginx/localhost.crt&verify_mode=none' - -This is required to be able to use single-sign login with the different services. diff --git a/doc/README.Development.md b/doc/README.Development.md new file mode 100644 index 0000000..e3a8e36 --- /dev/null +++ b/doc/README.Development.md @@ -0,0 +1,123 @@ +# Developing/Contributing + +This document helps you set up the *debshots* Rails application on your +own Debian system if you intend to work on the source code. + +## Preparing the development environment + +Most steps required to deploy the application (for production use) are automated +using an Ansible playbook that you find at ./ansible/debshots.yml + +The following section documents the steps you need to do to get the application +running in development mode. If you are a little experienced in developing Rails +applications you may know most of that already. + +Development worked best on a Debian Jessie or Sid system. + +## Install dependencies + +These APT-gettable packages are probably required to run the application: + + apt install python-psycopg2 ruby sudo libssl-dev libreadline-dev \ + zlib1g-dev libbz2-dev libpq-dev git imagemagick + +## Prepare PostgreSQL database server and user + +PostgreSQL stores data about packages, screenshots and users. Authentication works in production +because the applications runs as the system user *debshots* that gets access to PostgreSQL via +ident-based authentication. In development mode you will likely work as your own user so you need to +create a development database in PostgreSQL and create a database user with a password to access it. +Put those credentials into ./config/database.yml + + apt install postgresql + su - postgres + createuser -P -d debshots_dev + createdb -O debshots_dev -E UTF8 -T template0 debshots_dev + +## Install the required Ruby version using rbenv + +Rails uses the *bundler* tool to download and install dependent gems/packages. To avoid installing +them system wide you should rather create an *rbenv* sandbox environment where the specific Ruby +version and the required gems are installed. That ensures stable operation of the application and +does not spoil your otherwise APT-controlled system. + +Documentation on rbenv can be found at https://github.com/rbenv/rbenv + +To install it for your current user: + + git clone https://github.com/rbenv/rbenv.git ~/.rbenv + echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile + +# Load rbenv automatically by appending +# the following to ~/.profile: + +Run "rbenv init" and do as said. + +Install the "rbenv install" (https://github.com/rbenv/ruby-build#readme) add-on: + + git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build + +## Get the application + +Clone the debshots Git repository from https://salsa.debian.org/debian/debshots + +## Install the required Ruby version and the applications' dependencies + + rbenv install + echo "gem: --no-rdoc --no-ri" > ~/.gemrc + gem install bundler + bundle install + +## Optional: copy screenshots and database from the live website + + scp screenshots.debian.net:debshots-screenshots.tar . + tar -C public/ -xvf debshots-screenshots.tar + scp screenshots.debian.net:debshots.sql . + psql debshots_dev < debshots.sql + +Make sure that the application's database schema is upgraded to reflect the latest state of +development. + + bundle exec rails db:migrate + +(The reason to prefix all commands by "bundle exec" to make sure that the Ruby version +from *rbenv* is used and that only the gems from the sandbox environment are used.) + +## Start with a blank database + +Create a blank database with the latest database schema: + + bundle exec rails db:schema:load + +If you get database access errors then check the *development* section in your +./config/database.yml file. + +## Fill/update the database with information from APT repositories + +Get the latest information on packages from the Debian repositories. + + bundle exec rails debshots:update_from_deb_repos RAILS_ENV=production + bundle exec rails debshots:update_longdescription_from_deb_repos RAILS_ENV=production + +## Run the application + + bundle exec rails s + +Point your browser to http://localhost:3000/ and you will see the web site. + +## Optional: Tidy up the screenshot data + + bundle exec rake debshots:remove_broken_screenshots + bundle exec rake debshots:remove_duplicate_images + +## Optional: Import new package information + + bundle exec rake debshots:list_deb_repos + bundle exec rake debshots:update_from_deb_repos + bundle exec debshots:update_longdescription_from_deb_repos + +To run the Rails server in development mode on port 3001 with HTTPS: + + rails s puma -b 'ssl://0.0.0.0:3001?key=nginx/localhost.key&cert=nginx/localhost.crt&verify_mode=none' + +This is required to be able to use single-sign login with the different services. diff --git a/doc/README.Installation b/doc/README.Installation deleted file mode 100644 index 19e898a..0000000 --- a/doc/README.Installation +++ /dev/null @@ -1,303 +0,0 @@ -# Installing debshots the easy way using Ansible - -Prerequisites: A Debian Jessie server. - -Install PIP to get a recent version of Ansible: - - apt install python-pip - pip install ansible - -Run the Ansible playbook that comes with the debshots repository: - - cd ansible - ansible-playbook debshots.yml - -# Installing debshots the manual way - -## Prepare PostgreSQL database server and user (ident-based authentication) - - apt install postgresql - su - postgres - createuser -P -d debshots - createdb -O debshots -E UTF8 -T template0 debshots - -## Create an application user - - adduser debshots - -Allow the user to parse access log files from Nginx: - - adduser debshots adm - su - debshots - -## Install the required Ruby version using rbenv - -Documentation: https://github.com/rbenv/rbenv - - git clone https://github.com/rbenv/rbenv.git ~/.rbenv - echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile - -# Load rbenv automatically by appending -# the following to ~/.profile: - - eval "$(rbenv init -)" - -Install the "rbenv install" add-on: - -Documentation: https://github.com/rbenv/ruby-build#readme - - git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build - -Install the "rbenv vars" add-on: - - cd ~/.rbenv/plugins - git clone https://github.com/sstephenson/rbenv-vars.git - -## Get the application - -Clone the debshots Git repository. - -## Install the Ruby dependencies - - rbenv install - echo "gem: --no-rdoc --no-ri" > ~/.gemrc - gem install bundler - bundle install --deployment - -## Optional: copy screenshots and database from the live website - - scp screenshots.debian.net:debshots-screenshots.tar . - tar -C public/ -xvf debshots-screenshots.tar - scp screenshots.debian.net:debshots.sql . - psql debshots < debshots.sql - -## Switch to production environment - - export RAILS_ENV=production - -## Migrate database - - rails db:schema:load RAILS_ENV=production - - rails db:migrate RAILS_ENV=production - - -In config/database.yml: production: user/password/host must be commented out - -## Fill/update the database with information from APT repositories - - rails debshots:update_from_deb_repos RAILS_ENV=production - rails debshots:update_longdescription_from_deb_repos RAILS_ENV=production - -## Pre-render the static assets - - rails assets:precompile RAILS_ENV=production - -## Test the application: - - rails s -b 127.0.0.1 -e production - -Point your browser to http://...:3000/ and check the web site. - -## Create a user for moderation: - -Start a Rails console: - - bundle exec rails c -e production - -Create a new user record: - - user = User.create(realname: 'Christoph Haas', password: 'foobartest', email: 'email@christoph-haas.de') - user.save! - -## Tidy up the screenshot data - - bundle exec rake debshots:remove_broken_screenshots - bundle exec rake debshots:remove_duplicate_images - -## Import new package information - - bundle exec rake debshots:list_deb_repos - bundle exec rake debshots:update_from_deb_repos - bundle exec debshots:update_longdescription_from_deb_repos - - -# Supported URL paths (aka routes) - -_For up-to-date information please check config/routes._ - -/screenshots/:package_inital/:package/:(id)_:size.png -* package = name of the package -* id = numerical ID of the screenshot -* size = "large" or "small" -* Returns a PNG image of a screenshot -* Should be served as a static asset - -/image/:(id)_:size.png -* id = numerical ID of the screenshot -* size = "large" or "small" -* Returns a PNG image of a screenshot -* Usually used for unapproved images that should just be shown to the uploader - -/about -* Return an informational HTML page - -/packages -* Return a list of packages with pagination - -/packages/with_screenshots -* Return a list of packages with pagination -* Select only those packages that have screenshots. - -/packages/without_screenshots -* Return a list of packages with pagination -* Select only those packages that do not have screenshots. - -/packages/games_without_screenshots (deprecated) -* Return a list of packages with pagination -* Select only those packages that belong to Debian's "games" section - -/json/packages -* Return a JSON data structure of all packages - -/json/screenshots -* Return a JSON data structure containing packages and screenshots - -/json/packages-without-screenshots -* Return a JSON data structure of those packages that do not have any screenshots - -/packages/moderate -* Return a HTML page showing packages that need moderation -* Must only be available to logged in moderators - -/upload -* Return a HTML page containing an upload form for new screenshots - -/guidelines (deprecated) -* Return a HTML page showing general guidelines for creating screenshots -* Should just redirect to the /upload page - -/upload/:package -* ?? - -/uploadfile -* ?? - -/login -* Show a login form - -/logout -* Logout the user by invalidating the cookie session. - -/package/:package -* Show details of a certain package - -/json/package/:package -* Return a JSON data structure containing details of a certain package - -/thumbnail/:package -/thumbnail-404/:package (deprecated) -* Return a small (160x120 pixel) PNG screenshot file of a package -* If the package does not have any screenshots then return a 404 code - -/thumbnail-with-version/:package/:version -* Return a small (160x120 pixel) PNG screenshot file of a package -* If the package does not have any screenshots then return a 404 code -* Prefer screenshots of a certain version - -/screenshot/:package -/screenshot-404/:package (deprecated) -* Return a large (320x240 pixel) PNG screenshot file of a package -* If the package does not have any screenshots then return a 404 code - -/screenshot-with-version/:package/:version -* Return a large (320x240 pixel) PNG screenshot file of a package -* If the package does not have any screenshots then return a 404 code -* Prefer screenshots of a certain version - -/delete_screenshot/:screenshot -* Users: request deletion of a screenshot -* Moderators: delete a screenshot - -/approve_screenshot/:screenshot -* Users: 403 -* Moderators: approve a screenshot - -/keep_screenshot/:screenshot -* Users: 403 -* Moderators: re-approve a screenshot that was requested for deletion - -## Cron jobs - -Parse Nginx access logs to count the number of visits of each package: - - RAILS_ENV=production bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1] - -As a cron job: - - 41 9 * * * cd $HOME/debshots ; RAILS_ENV=production /home/debshots/.rbenv/shims/bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1] - - -# Authentication - -This web application tries to avoid to create yet another directory -of user accounts. So it leverages other common web sites like StackExchange, -Debian SSO (using browser/client certificates) or GitHub as single-sign-on -services. It is still possible to create local user accounts for administrators -but registration is disabled. - -Anonymous uploads are possible but they have to be moderated by an administrator. - -# Authorization - -A user can have one of these access levels. - -## Anonymous - -Without authentication all user actions are moderated. Such users can upload -screenshots or report existing/published screenshots as inappropriate. However -a user with level 'admin' will have to approve that action. - -## Authenticated by single-sign-login (SSO) - -Users can use different authentication services to login - like Github or -StackExchange. Such users internally get an account with a random password -created but they will keep logging in via SSO. - -The first upload will have to be moderated. Subsequent uploads will be -approved automatically. - -## Authenticated by Debian signle-sign-login (SSO) - -If a user authenticates using a Debian SSO client certificate they will be -able to upload screenshots without moderation. -(Anohter idea was to restrict them to uploading only screenshots for the -packages they maintain. But that may be reliable and is not implemented at -this time.) - -## Administrator - -Such a user has an internal user account. The database record has the -'admin' field set to 1. Admins can freely upload, moderate and delete -screenshots. They can also read the log files. - - -# Nginx during development - -During development it is advised to run Nginx to proxy ports 3000 (HTTP) -and 3001 (HTTPS) to the rails application. - - cd nginx - nginx -c `pwd`/nginx.conf - -The SSL certitificate is just a self-signed certificate with the -common name "localhost". It was generated using: - - openssl req -x509 -newkey 4096 -nodes -keyout localhost.key -out localhost.crt -days 3650 - -Run "rails s" in another window. That will use the built-in Ruby 'Puma' -application server that can also be used in production. It requires less -configuration than Phusion Passenger but may be slower in regard to -performance and multi-threading / multi-core support. - -If you get "400 Bad Request / The SSL certificate error" in the browser then -please check the error log (/tmp/error*). Once cause is that the CRL of -the Debian SSO has expired and needs to be updated. diff --git a/doc/README.Installation.md b/doc/README.Installation.md new file mode 100644 index 0000000..9ff3af2 --- /dev/null +++ b/doc/README.Installation.md @@ -0,0 +1,129 @@ +# Installing debshots + +The easiest way to deploy the application is using Ansible. + +Take a Debian Stretch server (8 GB RAM recommended). + +Install PIP to get a recent version of Ansible: + + apt install python-pip + pip install ansible + +Run the Ansible playbook that comes with the debshots repository: + + cd ansible + ansible-playbook debshots.yml + +Check out the project repository from https://salsa.debian.org/debian/debshots + +Change to the *ansible* subdirectory and run the main playbook: + + cd ansible + ansible-playbook debshots.yml + +This will install PostgreSQL and Nginx, create a database, create a system user +and do various configuration. + +Make sure that you set the environment variables as described in README.SSO.md before +you start the Rails application. Otherwise most single sign-on providers cannot work. +You also need to get the https://salsa.debian.org/debsso-team/debsso/raw/master/update-debsso-ca +script and run it in /etc/nginx to update the certficate and CRL used by the Debian +single-sign-on provider. + +The production configuration uses Nginx that decrypts HTTPS and either serves static +assets (images, Javascript, CSS) itself or requests for dynamic content to the +Rails application. You will need a SSL certificate for Nginx. Just get one from +LetsEncrypt using the *certbot* tool. + +Finally create an admin user for moderation: + +Start a Rails console: + + rails c -e production + +Create a new user record: + + user = User.create(realname: 'Christoph Haas', password: 'foobartest', email: 'email@christoph-haas.de') + user.save! + +## Cron jobs + +Parse Nginx access logs to count the number of visits of each package: + + RAILS_ENV=production bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1] + +As a cron job: + + 41 9 * * * cd $HOME/debshots ; RAILS_ENV=production /home/debshots/.rbenv/shims/bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1] + +# Authentication + +This web application tries to avoid to create yet another directory +of user accounts. So it leverages other common web sites like StackExchange, +Debian SSO (using browser/client certificates) or GitHub as single-sign-on +services. It is still possible to create local user accounts for administrators +but registration is disabled. + +Anonymous uploads are possible but they have to be moderated by an administrator. + +# Authorization + +A user can have one of these access levels. + +## Anonymous + +Without authentication all user actions are moderated. Such users can upload +screenshots or report existing/published screenshots as inappropriate. However +a user with level 'admin' will have to approve that action. + +## Authenticated by single-sign-login (SSO) + +Users can use different authentication services to login - like Github or +StackExchange. Such users internally get an account with a random password +created but they will keep logging in via SSO. + +The first upload will have to be moderated. Subsequent uploads will be +approved automatically. + +## Authenticated by Debian signle-sign-login (SSO) + +If a user authenticates using a Debian SSO client certificate they will be +able to upload screenshots without moderation. +(Anohter idea was to restrict them to uploading only screenshots for the +packages they maintain. But that may be reliable and is not implemented at +this time.) + +## Administrator + +Such a user has an internal user account. The database record has the +'admin' field set to 1. Admins can freely upload, moderate and delete +screenshots. They can also read the log files. + +# Nginx during development + +During development it is advised to run Nginx to proxy ports 3000 (HTTP) +and 3001 (HTTPS) to the rails application. + + cd nginx + nginx -c `pwd`/nginx.conf + +The SSL certitificate is just a self-signed certificate with the +common name "localhost". It was generated using: + + openssl req -x509 -newkey 4096 -nodes -keyout localhost.key -out localhost.crt -days 3650 + +Run "rails s" in another window. That will use the built-in Ruby 'Puma' +application server that can also be used in production. It requires less +configuration than Phusion Passenger but may be slower in regard to +performance and multi-threading / multi-core support. + +If you get "400 Bad Request / The SSL certificate error" in the browser then +please check the error log (/tmp/error*). Once cause is that the CRL of +the Debian SSO has expired and needs to be updated. + +# Tidy up the screenshot data: + +bundle exec rake debshots:remove_broken_screenshots + +bundle exec rake debshots:remove_duplicate_images + diff --git a/doc/README.URLs.md b/doc/README.URLs.md new file mode 100644 index 0000000..d74d236 --- /dev/null +++ b/doc/README.URLs.md @@ -0,0 +1,102 @@ +# Supported URL paths (aka routes) + +/screenshots/:package_inital/:package/:(id)_:size.png +* package = name of the package +* id = numerical ID of the screenshot +* size = "large" or "small" +* Returns a PNG image of a screenshot +* Should be served as a static asset + +/image/:(id)_:size.png +* id = numerical ID of the screenshot +* size = "large" or "small" +* Returns a PNG image of a screenshot +* Usually used for unapproved images that should just be shown to the uploader + +/about +* Return an informational HTML page + +/packages +* Return a list of packages with pagination + +/packages/with_screenshots +* Return a list of packages with pagination +* Select only those packages that have screenshots. + +/packages/without_screenshots +* Return a list of packages with pagination +* Select only those packages that do not have screenshots. + +/packages/games_without_screenshots (deprecated) +* Return a list of packages with pagination +* Select only those packages that belong to Debian's "games" section + +/json/packages +* Return a JSON data structure of all packages + +/json/screenshots +* Return a JSON data structure containing packages and screenshots + +/json/packages-without-screenshots +* Return a JSON data structure of those packages that do not have any screenshots + +/packages/moderate +* Return a HTML page showing packages that need moderation +* Must only be available to logged in moderators + +/upload +* Return a HTML page containing an upload form for new screenshots + +/guidelines (deprecated) +* Return a HTML page showing general guidelines for creating screenshots +* Should just redirect to the /upload page + +/upload/:package +* ?? + +/uploadfile +* ?? + +/login +* Show a login form + +/logout +* Logout the user by invalidating the cookie session. + +/package/:package +* Show details of a certain package + +/json/package/:package +* Return a JSON data structure containing details of a certain package + +/thumbnail/:package +/thumbnail-404/:package (deprecated) +* Return a small (160x120 pixel) PNG screenshot file of a package +* If the package does not have any screenshots then return a 404 code + +/thumbnail-with-version/:package/:version +* Return a small (160x120 pixel) PNG screenshot file of a package +* If the package does not have any screenshots then return a 404 code +* Prefer screenshots of a certain version + +/screenshot/:package +/screenshot-404/:package (deprecated) +* Return a large (320x240 pixel) PNG screenshot file of a package +* If the package does not have any screenshots then return a 404 code + +/screenshot-with-version/:package/:version +* Return a large (320x240 pixel) PNG screenshot file of a package +* If the package does not have any screenshots then return a 404 code +* Prefer screenshots of a certain version + +/delete_screenshot/:screenshot +* Users: request deletion of a screenshot +* Moderators: delete a screenshot + +/approve_screenshot/:screenshot +* Users: 403 +* Moderators: approve a screenshot + +/keep_screenshot/:screenshot +* Users: 403 +* Moderators: re-approve a screenshot that was requested for deletion diff --git a/doc/README.authentication.md b/doc/README.authentication.md index 3419f07..c9f00c8 100644 --- a/doc/README.authentication.md +++ b/doc/README.authentication.md @@ -57,6 +57,7 @@ Environment variables have to be set before starting the application: export GITHUB_SECRET=… Keys can be managed at https://github.com/settings/applications +To register a new oauth key go to "Developer Settings" in your Github account. Make sure that the allowed callback URL is: https://screenshots.debian.net/users/auth/github/callback diff --git a/doc/README.md b/doc/README.md index 344397d..69d0f07 100644 --- a/doc/README.md +++ b/doc/README.md @@ -1,352 +1,19 @@ -== Installing debshots +# About debshots -=== Prepare PostgreSQL database server and user (ident-based authentication) +Debshots is a web application written in Ruby-on-Rails that powers the +screenshots.debian.net web site. Many services like packages.debian.net, +Ubuntu Software or Synaptic rely on it. -apt install postgresql +## State of the application -su - postgres +The application has been revamped a lot and does not resemble the version +still used in production. The current state is worth trying but not yet ready +for deployment. -createuser -d debshots +## Development -createdb -O debshots -E UTF8 -T template0 debshots +Check out the README.Development.md -=== Create an application user +## Deployment -adduser debshots - -Allow the user to parse access log files from Nginx: - -adduser debshots adm - -su - debshots - -=== Install the required Ruby version using rbenv - -https://github.com/rbenv/rbenv - -git clone https://github.com/rbenv/rbenv.git ~/.rbenv - -echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile - - -# Load rbenv automatically by appending -# the following to ~/.bashrc: - -eval "$(rbenv init -)" - - -https://github.com/rbenv/ruby-build#readme - -git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build - -=== Get the application - -Clone the debshots Git repository. - -=== Install the Ruby dependencies - -rbenv install - -echo "gem: --no-rdoc --no-ri" > ~/.gemrc - -gem install bundler - -bundle install --deployment - -=== Copy screenshots and database from the former live website - -scp screenshots.debian.net:debshots-screenshots.tar . - -tar -C public/ -xvf debshots-screenshots.tar - -scp screenshots.debian.net:debshots.sql . - -psql debshots < debshots.sql - -Switch to production environment: - -export RAILS_ENV=production - -Migrate database: - -bundle exec rake db:migrate RAILS_ENV=production - -(config/database.yml: production: user/password/host must be commented out) - -Convert screenshots to new format (paperclip): - -bundle exec rake debshots:screenshots_to_paperclip RAILS_ENV=production - -Remove old screenshots directory structure: - -rm -r public/live - -Render the assets: - -bundle exec rake assets:precompile RAILS_ENV=production - -Test the application: - -bundle exec rails s -b 0.0.0.0 -e production - -http://...:3000/ - -Create a user for moderation: - -bundle exec rails c -e production - -user = User.create(realname: 'Christoph Haas', password: 'foobartest', email: 'email@christoph-haas.de', provider: 'local') -user.save! - -Tidy up the screenshot data: - -bundle exec rake debshots:remove_broken_screenshots - -bundle exec rake debshots:remove_duplicate_images - -Import new package information: - -bundle exec rake debshots:list_deb_repos - -bundle exec rake debshots:update_from_deb_repos - -bundle exec debshots:update_longdescription_from_deb_repos - -=== Install passenger to run the application behind nginx - -https://www.phusionpassenger.com/library/walkthroughs/deploy/ruby/ownserver/nginx/oss/jessie/install_passenger.html - -Example nginx vhost config: - -## -# You should look at the following URL's in order to grasp a solid understanding -# of Nginx configuration files in order to fully unleash the power of Nginx. -# http://wiki.nginx.org/Pitfalls -# http://wiki.nginx.org/QuickStart -# http://wiki.nginx.org/Configuration -# -# Generally, you will want to move this file somewhere, and start with a clean -# file but keep this around for reference. Or just disable in sites-enabled. -# -# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples. -## - -#proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=assets:768m use_temp_path=off; - -#add_header X-Cache-Status $upstream_cache_status; -#add_header X-Runtime 42; -more_clear_headers 'X-Runtime'; -more_clear_headers 'X-Powered-By'; -more_clear_headers 'Server'; -server_tokens off; - -#passenger_show_version_in_header off; - -#log_format proxy '[$time_local] Cache: $upstream_cache_status $upstream_addr $upstream_response_time $status $bytes_sent $proxy_add_x_forwarded_for $request_uri "$http_referer" "$http_user_agent"'; -#access_log /var/log/nginx/debshots-access.log proxy; - -# Default server configuration -# -#passenger_log_level 5; - -server { - listen 85.25.83.22:80 default_server; - #listen 80 default_server; - #listen [::]:80 default_server; - - # SSL configuration - # - # listen 443 ssl default_server; - # listen [::]:443 ssl default_server; - # - # Self signed certs generated by the ssl-cert package - # Don't use them in a production server! - # - # include snippets/snakeoil.conf; - - passenger_enabled on; - passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby; - #passenger_pass_header X-Accel-Redirect; - - #proxy_cache_methods GET HEAD; - - root /home/debshots/debshots/public; - - # Add index.php to the list if you are using PHP - #index index.html index.htm index.nginx-debian.html; - - server_name _; - #proxy_cache assets; - #add_header X-Cache-Status $upstream_cache_status; - #proxy_ignore_headers Cache-Control; - - #add_header X-Debian rocks; - - location /assets/ { - alias /home/debshots/debshots/public/assets/; - expires 1h; - #include debshots_params; - add_header X-Coffee assets; - add_header Cache-Control public; - } - location /logo/ { - alias /home/debshots/debshots/public/logo/; - expires 1h; - add_header X-Coffee logo; - add_header Cache-Control public; - } - location /screenshots/ { - alias /home/debshots/debshots/public/screenshots/; - expires max; - add_header X-Coffee screenshots; - add_header Cache-Control public; - } - location /images/ { - alias /home/debshots/debshots/public/images/; - expires 1h; - add_header X-Coffee images; - add_header Cache-Control public; - } - - # Send thumbnails using X-Sendfile / X-Accel-Redirect - # The correct thumbnail is computed by the Rails application so it cannot be served directly. - location /thumbnail/ { - expires 1d; - add_header X-Coffee thumbnail; - add_header Cache-Control public; - - passenger_set_header X-Sendfile-Type "X-Accel-Redirect"; - passenger_env_var HTTP_X_ACCEL_MAPPING /home/debshots/debshots/public/=/__send_file_accel/; - passenger_pass_header X-Accel-Redirect; - } - - # Send public assets using X-Sendfile / X-Accel-Redirect (e.g. public/images/dummy/...) - location /public/ { - expires 1h; - add_header X-Coffee public; - add_header Cache-Control public; - - passenger_set_header X-Sendfile-Type "X-Accel-Redirect"; - passenger_env_var HTTP_X_ACCEL_MAPPING /home/debshots/debshots/public/=/__send_file_accel/; - passenger_pass_header X-Accel-Redirect; - } - - location /__send_file_accel/ { - internal; - alias /home/debshots/debshots/public/; - } -} - - -== Supported URL paths (aka routes) - -/screenshots/:package_inital/:package/:(id)_:size.png -* package = name of the package -* id = numerical ID of the screenshot -* size = "large" or "small" -* Returns a PNG image of a screenshot -* Should be served as a static asset - -/image/:(id)_:size.png -* id = numerical ID of the screenshot -* size = "large" or "small" -* Returns a PNG image of a screenshot -* Usually used for unapproved images that should just be shown to the uploader - -/about -* Return an informational HTML page - -/packages -* Return a list of packages with pagination - -/packages/with_screenshots -* Return a list of packages with pagination -* Select only those packages that have screenshots. - -/packages/without_screenshots -* Return a list of packages with pagination -* Select only those packages that do not have screenshots. - -/packages/games_without_screenshots (deprecated) -* Return a list of packages with pagination -* Select only those packages that belong to Debian's "games" section - -/json/packages -* Return a JSON data structure of all packages - -/json/screenshots -* Return a JSON data structure containing packages and screenshots - -/json/packages-without-screenshots -* Return a JSON data structure of those packages that do not have any screenshots - -/packages/moderate -* Return a HTML page showing packages that need moderation -* Must only be available to logged in moderators - -/upload -* Return a HTML page containing an upload form for new screenshots - -/guidelines (deprecated) -* Return a HTML page showing general guidelines for creating screenshots -* Should just redirect to the /upload page - -/upload/:package -* ?? - -/uploadfile -* ?? - -/login -* Show a login form - -/logout -* Logout the user by invalidating the cookie session. - -/package/:package -* Show details of a certain package - -/json/package/:package -* Return a JSON data structure containing details of a certain package - -/thumbnail/:package -/thumbnail-404/:package (deprecated) -* Return a small (160x120 pixel) PNG screenshot file of a package -* If the package does not have any screenshots then return a 404 code - -/thumbnail-with-version/:package/:version -* Return a small (160x120 pixel) PNG screenshot file of a package -* If the package does not have any screenshots then return a 404 code -* Prefer screenshots of a certain version - -/screenshot/:package -/screenshot-404/:package (deprecated) -* Return a large (320x240 pixel) PNG screenshot file of a package -* If the package does not have any screenshots then return a 404 code - -/screenshot-with-version/:package/:version -* Return a large (320x240 pixel) PNG screenshot file of a package -* If the package does not have any screenshots then return a 404 code -* Prefer screenshots of a certain version - -/delete_screenshot/:screenshot -* Users: request deletion of a screenshot -* Moderators: delete a screenshot - -/approve_screenshot/:screenshot -* Users: 403 -* Moderators: approve a screenshot - -/keep_screenshot/:screenshot -* Users: 403 -* Moderators: re-approve a screenshot that was requested for deletion - -== Cron jobs - -Parse Nginx access logs to count the number of visits of each package: - -RAILS_ENV=production bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1] - -As a cron job: - -41 9 * * * cd $HOME/debshots ; RAILS_ENV=production /home/debshots/.rbenv/shims/bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1] +Read the README.Installation.md diff --git a/nginx/debsso.crl b/nginx/debsso.crl deleted file mode 100644 index d0305d3..0000000 --- a/nginx/debsso.crl +++ /dev/null @@ -1,75 +0,0 @@ ------BEGIN X509 CRL----- -MIINnjCCDIYwDQYJKoZIhvcNAQELBQAwRDEaMBgGA1UEAxMRU1NPIENBIDIwMTUt -MDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xpZW50IGNlcnRpZmljYXRlFw0x -NzA0MjIxNDU1MDJaFw0xNzA0MjUxNDU1MDJaMIIMDzATAgIQABcNMTUwODIxMjEy -NTI4WjATAgIQARcNMTUwODIxMjA1MDUxWjATAgIQAhcNMTUwODIxMjEwNjQ3WjAT -AgIQAxcNMTUwODIxMjEwNjQ5WjATAgIQBBcNMTUwODI0MTMwMjQyWjATAgIQBRcN -MTUwODIxMjEyNTMzWjATAgIQERcNMTYwMzE0MTQxMTAzWjATAgIQEhcNMTUwODI2 -MTExODUwWjATAgIQFRcNMTYwNTE1MDE0OTA1WjATAgIQFhcNMTYwMzIzMjMyNTE3 -WjATAgIQIBcNMTUwODI0MTMwMjQ0WjATAgIQIRcNMTUwODI0MTMwMjQ2WjATAgIQ -IhcNMTUwODI0MTMwMjQ2WjATAgIQIxcNMTUwODI0MTMwMzQ2WjATAgIQJRcNMTUx -MjE2MjAyMjM5WjATAgIQKBcNMTUwODI1MTUwODA3WjATAgIQMRcNMTUwODI2MTMz -ODQ4WjATAgIQNBcNMTUwODI2MTUyODE4WjATAgIQQRcNMTUxMjE2MTI1ODE0WjAT -AgIQRxcNMTUwODI4MDgxNDQ0WjATAgIQUBcNMTUwOTAxMDc1MjMxWjATAgIQURcN -MTUwOTAxMDc1MjM4WjATAgIQWxcNMTYwODE3MTcxNjM4WjATAgIQYhcNMTUwODI4 -MTM1NjI4WjATAgIQcBcNMTUwOTE0MTIyNzUwWjATAgIQehcNMTYwNjIwMDkwNDE1 -WjATAgIQjhcNMTYwMTEwMDEwNTEwWjATAgIQnBcNMTUxMTI1MTQ0NDI5WjATAgIQ -qBcNMTUwOTAyMTU0OTAxWjATAgIQvRcNMTUxMjA5MTM0NzQyWjATAgIQyhcNMTYw -NDA2MDkyNjI3WjATAgIQzxcNMTUxMDEyMDc1ODMxWjATAgIQ1RcNMTUxMDE5MTQ0 -MjIwWjATAgIQ1hcNMTYwNDA0MDgwMTUxWjATAgIQ6RcNMTYwODE3MTcxNjQwWjAT -AgIQ9BcNMTUxMTE3MTQxMzI1WjATAgIQ+RcNMTUxMTIwMTM0OTA2WjATAgIREBcN -MTYwMjA1MjEyODAxWjATAgIREhcNMTYwMzE4MjMwMjAyWjATAgIRExcNMTYwNjEx -MjI0ODI2WjATAgIRGRcNMTYxMjEwMTUzMzE3WjATAgIRHhcNMTYwNDA5MjAwODM1 -WjATAgIRHxcNMTYwNDA5MjAwODM5WjATAgIRJhcNMTUxMjE3MTYyNzM1WjATAgIR -JxcNMTYwNzA3MTA1MTMzWjATAgIRKxcNMTYwNjIwMDkwNDE3WjATAgIROBcNMTYw -ODE3MTcxNjQzWjATAgIRRBcNMTYxMDIwMDc0NjAzWjATAgIRSBcNMTYwMTIwMjAw -MjEzWjATAgIRbRcNMTYwMjEzMTgzODI2WjATAgIRchcNMTYxMjEwMTUzMzE1WjAT -AgIRcxcNMTYxMDA5MTcwMjIxWjATAgIRexcNMTYwMjI5MjMyNjU1WjATAgIRiRcN -MTYwNzA3MTA1MTMxWjATAgIRixcNMTYwMzE0MTQxMTA4WjATAgIRkRcNMTYwNjIw -MDkwNDE5WjATAgIRkhcNMTYwMzE0MTQxMTA2WjATAgIRlRcNMTcwMTE4MTYwMDI2 -WjATAgIRnxcNMTYxMDAzMjAwNjMzWjATAgIRohcNMTYwMzE4MTQwNjE5WjATAgIR -thcNMTYwMzE5MTUzNzQ3WjATAgIRuRcNMTYwMzE5MTYyMjQzWjATAgIRwhcNMTYw -MzIwMTE1MzAzWjATAgIRwxcNMTYwNTExMjI1ODE1WjATAgIRzxcNMTYwMzI0MDEx -MzMyWjATAgIR0RcNMTcwMjA3MTk1ODI5WjATAgIR5BcNMTYwNzAyMTUxNTMzWjAT -AgIR5xcNMTYwODE4MTUzMDUzWjATAgIR6hcNMTYwMzI5MTYyMDMzWjATAgIR7xcN -MTcwMzIyMjM0MTM5WjATAgIR9RcNMTYwMzI3MDgwMzI0WjATAgIR/BcNMTYwNTI0 -MjA1MDE4WjATAgIR/xcNMTYwNTA0MTk1NDMzWjATAgISFhcNMTcwMjE2MjEyODE5 -WjATAgISIRcNMTYwNDA4MDkyMjEwWjATAgISIhcNMTYwNDA4MDkyMjEyWjATAgIS -IxcNMTYwNDA4MDkyMjE1WjATAgISJBcNMTYwNDA4MDkyMjE3WjATAgISKBcNMTYw -NTAyMDU1MDAyWjATAgISMhcNMTYwNDA5MjAyOTU3WjATAgISPRcNMTYwNDEwMTkx -MjA3WjATAgISShcNMTYxMjEwMTUzMzE0WjATAgISUhcNMTYwNDIxMTYwNDU2WjAT -AgISYhcNMTcwNDE5MDY1MDQ4WjATAgISbhcNMTYwNTE0MDE0MzEyWjATAgIScBcN -MTYwNTEzMjIyOTMyWjATAgIScRcNMTYwNTEzMjIyOTM2WjATAgIScxcNMTYwNTE0 -MDE0MzE4WjATAgISgRcNMTYwNjMwMTUwMjU1WjATAgIShRcNMTYxMDAzMjAwNjI0 -WjATAgISqBcNMTYwNjA4MTQ0NTEzWjATAgISrRcNMTYwNjExMjMwNjA4WjATAgIS -sRcNMTcwMzIyMjM0MTQ3WjATAgISsxcNMTYwNjIwMTM1MDAyWjATAgIStBcNMTYw -NjIwMTM1MDAwWjATAgIStRcNMTYwNjIwMTM0OTU4WjATAgISwRcNMTYxMTIyMTIx -NDAzWjATAgIS5BcNMTYwOTI5MTczMTA4WjATAgIS5RcNMTYwOTI5MTczMDUzWjAT -AgITBRcNMTcwNDEzMDE1NDM0WjATAgITHxcNMTYwOTA4MDg1MDIzWjATAgITIBcN -MTcwMTA2MjExMDU3WjATAgITIxcNMTYxMTMwMTAzOTI1WjATAgITPBcNMTYwOTI5 -MTc0NzI3WjATAgITQhcNMTYwOTI5MTczNTQ1WjATAgITThcNMTYxMDA5MjA0NTQy -WjATAgITTxcNMTYxMDA5MTcxMjIxWjATAgITVRcNMTYxMDEyMTQwMDIwWjATAgIT -XBcNMTYxMjI4MTg0NzMxWjATAgITXRcNMTYxMDE2MTU1NzM2WjATAgITYxcNMTYx -MDE4MTcwNzE0WjATAgITaxcNMTcwNDE3MTA1MTIxWjATAgITbhcNMTYxMjE4MTYw -NTI0WjATAgITchcNMTYxMDI0MjA1MjU3WjATAgITfhcNMTcwMTE3MTAzMzMzWjAT -AgITghcNMTYxMDMwMTgzODQyWjATAgIThxcNMTYxMDMxMjE0NzUyWjATAgITiBcN -MTYxMDMxMjE0MzE4WjATAgITixcNMTYxMTAyMTkyOTIxWjATAgITmBcNMTYxMTA4 -MTkyODE2WjATAgITmRcNMTYxMTA4MTkzNTExWjATAgITmhcNMTYxMTA4MTkzNTEy -WjATAgITnRcNMTcwMTA2MjExMDU2WjATAgITpRcNMTYxMTEwMjE1NjA5WjATAgIT -phcNMTYxMTEwMjIxODE1WjATAgITuxcNMTcwMTAxMTAwNDQxWjATAgIT5hcNMTcw -MTA2MjExMDU1WjATAgIT6BcNMTcwNDIyMTQxMzUzWjATAgIT8xcNMTYxMjIxMjEz -MjQ0WjATAgIT+BcNMTYxMjIzMjIzNTQ0WjATAgIT+RcNMTYxMjIzMjIzNTQzWjAT -AgIUABcNMTYxMjMwMDA1NjM2WjATAgIUCBcNMTcwMTEwMDk1MzQwWjATAgIUERcN -MTcwMTA0MTMzMjI1WjATAgIUEhcNMTcwMTA0MTMzMzU3WjATAgIUExcNMTcwMTA0 -MTMzODI2WjATAgIURRcNMTcwMjA1MTYxNTE0WjATAgIURhcNMTcwMjA1MTYyMDIy -WjATAgIUXxcNMTcwMjEzMTYyMzQ5WjATAgIUbBcNMTcwMjI0MDc0MTU4WjATAgIU -fxcNMTcwMzA5MTAxNTI2WjATAgIUhxcNMTcwMzE1MDczNzE3WjATAgIUtxcNMTcw -MzMwMTcxODQxWjATAgIUuBcNMTcwMzMwMTcxODI5WjATAgIUuRcNMTcwMzMwMTcy -MDIzWjATAgIU4hcNMTcwNDEzMDc1MDE3WjATAgIVLBcNMTcwNDIyMTQ1NTAyWjAN -BgkqhkiG9w0BAQsFAAOCAQEAuSmMXKr6dqDRi149DwlVFYBz8mskPPr61EzJKoYk -K4rAGBzlY7Ekcz57h881KxCFv7aFGmKA8DdnAOga4lr7/4c1tuoGTqqKDaS5/oOf -jgf7koLMWt9uqx6f5w491XkJqVCKXETfxUwpxRclyTFgcUWchTHnBEH98K/jrYG4 -WcqN2Xi2pxAaLM8V7E0CN9TETKRRO3WlbGfGMP8SqqHyOVRQBOuFQpaPyFSf+AXe -vRN4jih1Zfvg7WttKrjq+s04dPXM6nzUGnc9UeBHAif2FHY/qaT3mgw7ou22yS17 -E7KTGCnXjoLg+g9e+A2vBXzjHhm1u/GAwMZVzzGGfRdi9g== ------END X509 CRL----- diff --git a/nginx/debsso.crt b/nginx/debsso.crt deleted file mode 100644 index 48ae9e0..0000000 --- a/nginx/debsso.crt +++ /dev/null @@ -1,22 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDlzCCAn+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBEMRowGAYDVQQDExFTU08g -Q0EgMjAxNS0wOC0yMTEmMCQGA1UEChMdRGViaWFuIFNTTyBjbGllbnQgY2VydGlm -aWNhdGUwIhgPMjAxNTA4MjEyMDQzMzVaGA85OTk5MTIzMTIzNTk1OVowRDEaMBgG -A1UEAxMRU1NPIENBIDIwMTUtMDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xp -ZW50IGNlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA -1SUMNiEVMlycwDPlJhgJ099VorLDTW556XvbWSw8l7cnygs8V9bN83f6W2P8x328 -dz+U1OxEZ/PnS+/zMwco03XQggXcNN+UjHwUu9WP5koNsPFH6HRbvUy5oBDfbdVN -EzBE2gXE4WYFoj45U9rSU6qLEnT4QKxJ/CbTeMGvLKzuXdCv6W+UxUfbh186kSqM -tfDtY3aQ+L6MuPA1a+bumUh9EGVZrrIMbjgm1xrQohQBJC75X10dnicUliGZ+7C0 -h7pUQlIY+/IxREQ46xBY1CNYeZNMEI9ErMbiFiShsc3mP3aLxTAQ4KzHCDtIuzwD -ElH8aMPxIQOUyL/FLx8ZTQIDAQABo4GPMIGMMA8GA1UdEwEB/wQFMAMBAf8wEwYD -VR0lBAwwCgYIKwYBBQUHAwkwDwYDVR0PAQH/BAUDAwcGADAdBgNVHQ4EFgQU0OJ+ -JoHgzarLNF+2eiay11GCk44wNAYDVR0fBC0wKzApoCegJYYjaHR0cHM6Ly9zc28u -ZGViaWFuLm9yZy9zcGthYy9jYS5jcmwwDQYJKoZIhvcNAQELBQADggEBAKynxkRr -7w85LHYzH5q9xVHXX6+K6r1mA3b+OAopNMJZTCTn7v9UVDncp26wOeHOUEvawWaQ -21HBd70CiFH0XGDow0/K68ite/0RHxq1WAuggBc678d/0yDkoWdFHAf9n5Agzf4J -rXov++XmBXYHRXiHunuSLnM3i8HToejZMCC7P9nqpPo0tK7O22calbZn20Pdve6k -KrKxwwjxpuNxezr6uYGuNTLJOZtyjF09FuAebSlHvX6VYPl7FnMUDcS6QerEyocL -Bv7pbsNWehIfvfjqPJQwqznieieZGL6s1zB8/XWQw37C0i28LqJ8DTvEjgmF44RP -6JhTYDnI06pKfQY= ------END CERTIFICATE----- diff --git a/nginx/dhparams.pem b/nginx/dhparams.pem deleted file mode 100644 index d273d31..0000000 --- a/nginx/dhparams.pem +++ /dev/null @@ -1,8 +0,0 @@ ------BEGIN DH PARAMETERS----- -MIIBCAKCAQEA8kUEh2+7OSDG3BQ22cJBlBM0jp+AWW8Wa64J0hE/gQaR8jw9VSQW -a+WBaDQ+FAcxOmAeVvrX4owvBocHBcVPmU4NEnkWe77qsCG56wEJWco+DgN3cq43 -SYbhI3s2HNQwLCzUYLAMZVXcUDH4Nn3cRTTl3ZNpB99XhAio20frNpGQrQeUb0Of -dDj3QpLL1k09b+OVnAh+3KFHawrjzzyFf9pZMsrmK/wZR5SSds1TTisHjVaJe4zN -dcOfvQr5dUHl1mvwxYPnpbXmXdlDmdBU6/HCqkXpUcfl18bhwKG1UT7wmWuInizT -AsNFRK393l5eqlE+AFvWZpacMGGMGJhd+wIBAg== ------END DH PARAMETERS----- diff --git a/nginx/localhost.crt b/nginx/localhost.crt deleted file mode 100644 index f100704..0000000 --- a/nginx/localhost.crt +++ /dev/null @@ -1,32 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFhTCCA22gAwIBAgIJAJdnIw1IRbAAMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV -BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX -aWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xNzA0MjIxNTI3 -MTlaFw0yNzA0MjAxNTI3MTlaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21l -LVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNV -BAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ8c -28eoDXVGRYtXPMHa7L3v4pCdJQQthpiVULT108yDGHfCc8XJkjFqrk2GBH8Pvsk7 -a9us/aad5G+6dQ+a6w8QG1U4grYyaO28QhSSy7ZP1l7rl5XAmYlU5aFVPPgJEnlT -QGc1lArEJH0mDREdagwNzD03NsWYGUOkdTgldQxO1zTmJWTr77/StP0fFYAff8Sb -gYoKEM1ZN0mNgt3Ts9tO7UZmEvglMvWa3OS8mJsrkBiU2yqou+R4sevdyC3TBFE3 -yawahizt69NGR21LzBmlBewQwQ9eXmT8qPiRGplo1Rb4+UB6sMsESQDzCkyH09p0 -T0fGoAXQrkthZRTsH6LAhR6nQzopuw7ZsyMNAjWQ5ksKED0tmbVGBKmXCz3CWetO -qu25mnNV9P/X+5Rl3vUXOpBcZOZYzG2lM4PmsYWpH40l0tbcBGvB1/nxT4+Ztqf4 -+9LB0/bROYnBXoEAa8x1kXqiptk3pAko+U0AsQch26bF8sKKCZk+0aWiC7PXE5O6 -2k9pPnA4fE+fmPPcYQQQXZ4D31afxQsGdbqklWNT2QdzVUyveL0tqDVSZMiTSK5j -sc5kEjLSfPoR0xgiFF/y81pzKWJwvI7DDI8q5ggWklrTqroms+riCLE+ko4ClLRa -ETc/iNGSQeMZD7xauqUuv8hGdtpyaVj12OZvWzarAgMBAAGjUDBOMB0GA1UdDgQW -BBQH5Z7WecoPmPYfrDvc/kYnUDxo3TAfBgNVHSMEGDAWgBQH5Z7WecoPmPYfrDvc -/kYnUDxo3TAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQA6kFmAEcQw -JMM02H1MM3RHBr0ZWDo6wSAT72kdLZnhOTdbCRiQ1Fm9dltNEuHHJIKhdWykCMjy -1uULsukBPDjomO8cB+K2vA4HAWcKtg64NnnVNFK70ZIdazwfYPwqddykgE6uWHc6 -nQskGD3B+zQwartpThHvmw0V5HccIKoiHIy7qD9g8P+ovRg+6l+kaBELQiFUxDGm -lIxK2VgrYWxKoT3IBp1C5yNKJORc6Hc0m6r/Uf8uA3oLGkjvAmoY41lr/7ThIo8/ -gd/Vk4EXjMdwfevIhHbjC2s2dxrV94f+TI54y9UPo4dOZJ9DMtmwvE2sTm1ROJfr -Wvufx0OUzMY0iGO2YEAglhk1NTf0ryyNh5sNWVx2YYaiRrzEmrtE3xYILBHyr4rF -dYWOg3IbXzVdL2oUsYrZwUtO35zw0ewuFKAnOO53N2+I3q2abq/jKvojACB6v+lf -k60Q8d07iBhkDrk1NI71SDyxSMrYqYxobI7AenFb196+9q3s1dS3ddIFiS8JL1le -JjvKo2HdQ64Yz/1qpgjAQD8xptSdwy4IPaef6kpMHylQ+V7BxwhGy6pZnKoXP6qE -VliHUJUzy4Dn4IgNLTx3MXLBObb6H63JqZE6DpfoKrNPAaL2zy9xv6ELkUPTsGVr -F/a83GfM+wAzDJB50cfuaOOR+QvCTdy0pg== ------END CERTIFICATE----- diff --git a/nginx/localhost.key b/nginx/localhost.key deleted file mode 100644 index 8d18334..0000000 --- a/nginx/localhost.key +++ /dev/null @@ -1,52 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIJQAIBADANBgkqhkiG9w0BAQEFAASCCSowggkmAgEAAoICAQCfHNvHqA11RkWL -VzzB2uy97+KQnSUELYaYlVC09dPMgxh3wnPFyZIxaq5NhgR/D77JO2vbrP2mneRv -unUPmusPEBtVOIK2MmjtvEIUksu2T9Ze65eVwJmJVOWhVTz4CRJ5U0BnNZQKxCR9 -Jg0RHWoMDcw9NzbFmBlDpHU4JXUMTtc05iVk6++/0rT9HxWAH3/Em4GKChDNWTdJ -jYLd07PbTu1GZhL4JTL1mtzkvJibK5AYlNsqqLvkeLHr3cgt0wRRN8msGoYs7evT -RkdtS8wZpQXsEMEPXl5k/Kj4kRqZaNUW+PlAerDLBEkA8wpMh9PadE9HxqAF0K5L -YWUU7B+iwIUep0M6KbsO2bMjDQI1kOZLChA9LZm1RgSplws9wlnrTqrtuZpzVfT/ -1/uUZd71FzqQXGTmWMxtpTOD5rGFqR+NJdLW3ARrwdf58U+Pmban+PvSwdP20TmJ -wV6BAGvMdZF6oqbZN6QJKPlNALEHIdumxfLCigmZPtGloguz1xOTutpPaT5wOHxP -n5jz3GEEEF2eA99Wn8ULBnW6pJVjU9kHc1VMr3i9Lag1UmTIk0iuY7HOZBIy0nz6 -EdMYIhRf8vNacylicLyOwwyPKuYIFpJa06q6JrPq4gixPpKOApS0WhE3P4jRkkHj -GQ+8WrqlLr/IRnbacmlY9djmb1s2qwIDAQABAoICACAEqqVux+aFkZEMqQlJiMJf -93Oqa7x/fMpPocIIheptpwrScoGmomiXUyP+iAEZpgbQkk/Oa+yPcVyaZNwTDKIn -V5i6mnMXic3tSE7ji2LQhg7r0cEs1LiyANOKV46CJNmNSzR5r6TK+5zDf3WmOaTb -UfIvnjH8/XiDK6N0xi0H4H6goX3BjKlJOWqGSslRjWB++n5QsDjibyG5/E+vPk4v -f8fe2opc0fhihXjyCrOO/Jw1uDTJZ6X+M6+HHbU69W9yjn63h7Ca4A3P4qe3zQaM -ErkCVhdFojEoNshuSq/8TIUm7OFwzwrLffVW8webfaJELYAAFEuXRrucib7AFU1V -uNgNP8ul0dSCyRjzxuXO2ar9dTAv9qcYvi1sLEkpl7dqdNwf3Lg2sfcvDv5C/c3h -TRJOMX3ciMfc59ZJlMB78K5c1LqQWMsOQUL8i6lFtf4BcRJItCgtSTvyTe7Wc5oZ -LXRS+EUj75EcnjYxUtHLkVwAC9eNrmpIYre/ng2fSs293BDEPE9oSD6Yw7xj3V8b -FdMCGM5/rFn0c5L52fNEL8JUzqfK6Dfu0f5Ox1tpVHT7Tlf6Di13ViZnsZ96lCS7 -QUV0MGR0o86djDFR6YIQhHvdAgbIrdzvImyYozcxx8x5GuMExSmyE6cFvknbWi8N -C8YudEbHY0moquO2VothAoIBAQDOfzAYkKuy3D2MZcS9vYR+nMQtMBVEi0CpFRwy -APME2+jD1zqXvemqe7YQifWHlhnaUfX8yRVoA00DUZHt+wRSn+SJWc93ZLnPqgpJ -KsByWSxey9JFSUIdQvuA8zsLmoQ+GMbXQbby52kc7l5BmM6baWF20wqyUU/29UYJ -iKm7MuLnKI5Y3FSJwbKJDB2Dlhhh0ckCovyN+XeLW6F0JnBTb0l7Dy4YxtAXco1i -9cMZ8+drDsA/B5L4O5xYtTvrtCLEswR+1w83MqjYq/m1ydY1XG1r4DdzGWHKEADj -k+dzNYbpnNiAnf9d4IrOjS8luc1KQaEjlEp+TiP6IefZ1XM/AoIBAQDFQa9j6tUr -NtLD6iQ2lGdZ4yc4Lyr+boW0+zwhiEk6fFwan2TF6WzzuGDR9iMjnxrFHuKtLmlS -Ljcd95/LTvZqRp8b6HaPzsKokIXeDn1JsvoZY9/+8LdQoERDfQg4Uo12S8soZ2Iq -3epF+uIFgA0TFI9bPWMF9XjmtLGLgoyvFj8jylErdf4WeKLQd8XQ4JqcNCDxyagY -Qx6vZ+lA9D8NtaGeL1uCvVzWqFFYOVNDIvYHjuGRZNvYAtO1sxzPbJkgKI/th8+Y -G1gbZS/a7V/iey42D4rNSsLrubkR7uRFAZHlZwM1F2t+Rf32FTu5Y7fW7W9huxgS -+CsLnyZQrx2VAoH/PuqBvPpXVifEmQJo72bO98TMAPilgjzrdpj3/kRLxy85vHHX -aGR0zXzj/CYMqUMSnXJbgKnD2+0lid1QmTHiH0qYV0EF9Vq7QoqMl75u5GhHHJr9 -dh7cBg5ikueJFf/+Su1BqFRdaaUYYbg+/72PNcrl505l8+7SbmxM6pq5HFBk0gmJ -VYnMOCzMOPV4CJ+yzhsdI7CFQry/r7Y7eyg7ETDXMqdtZB8vR/WfHofC6iVmXTgh -WxLztK509JJDr40zCruAoyTjfe3xhBLiAoF8wsVmkXe/bVJOeUJnAvANlQy6DnO7 -g3SgWfoQUN6zfssdwYI9lpmYGOO2EoBCJBzlAoIBAQCXOhiA/dSX4NwNH0DMJ1Jk -82VqCZ9omMshSUt8WcPqdtUWBAV6Rc8lusFfttiRwrT/UwJtyxsrygqvityTPeJk -7+ejucDL17QdD0/SQkGDcxeSx6M/DMU9puEu7HiU1ZVmkA0c2MXGH4QwSntlxBpB -+o09Yf683sjl9rn3PwskYGXfxogcTcWS7MHGGU0rKkbeYoivVe7tSugHih6lkZuV -ox5Y6+24efznBPv4K1rOKct9V+lPUofJP8GXl84KqDNtGCvf6zMYZj5SIm1h5oKQ -W+e9woSjhyGRHz3npcKTtPRpb2RiG6ZplLdzJiw3oV+cA0RVJN78DA7URhtV2CtR -AoIBAHkflDjX9FICWvxo3jJkHWm4OKULXqT4nVsP3ua9uGsLCxDFneivKdj3kJjI -iZh3HHzXybeoGyt8jCBKDIjugbnGDaaW4zQOIeN5afsUIyDppRtCspoBD48Hy7g6 -9tjg6Ko0iHPONayhsxegchltPhplBlGVnPnzE5/n+FMCyj1LnNOq81VhaSS6t/AW -hgTxz2QzdDsWIxBiJ6KJoXIOBWpHu1sudHgGmpQo6w3yyLYhCJXHyMP9oUi7fBEm -w+DjxmiNCPPWVs+EmL6MiEmqp/Pd0v0wpUOARV2Bnr62OMNyIXNebPpGqlBHPxFW -iD5mKOq6Z4Rivbd2DN+0aIoCgWI= ------END PRIVATE KEY----- diff --git a/nginx/mime.types b/nginx/mime.types deleted file mode 100644 index 89be9a4..0000000 --- a/nginx/mime.types +++ /dev/null @@ -1,89 +0,0 @@ - -types { - text/html html htm shtml; - text/css css; - text/xml xml; - image/gif gif; - image/jpeg jpeg jpg; - application/javascript js; - application/atom+xml atom; - application/rss+xml rss; - - text/mathml mml; - text/plain txt; - text/vnd.sun.j2me.app-descriptor jad; - text/vnd.wap.wml wml; - text/x-component htc; - - image/png png; - image/tiff tif tiff; - image/vnd.wap.wbmp wbmp; - image/x-icon ico; - image/x-jng jng; - image/x-ms-bmp bmp; - image/svg+xml svg svgz; - image/webp webp; - - application/font-woff woff; - application/java-archive jar war ear; - application/json json; - application/mac-binhex40 hqx; - application/msword doc; - application/pdf pdf; - application/postscript ps eps ai; - application/rtf rtf; - application/vnd.apple.mpegurl m3u8; - application/vnd.ms-excel xls; - application/vnd.ms-fontobject eot; - application/vnd.ms-powerpoint ppt; - application/vnd.wap.wmlc wmlc; - application/vnd.google-earth.kml+xml kml; - application/vnd.google-earth.kmz kmz; - application/x-7z-compressed 7z; - application/x-cocoa cco; - application/x-java-archive-diff jardiff; - application/x-java-jnlp-file jnlp; - application/x-makeself run; - application/x-perl pl pm; - application/x-pilot prc pdb; - application/x-rar-compressed rar; - application/x-redhat-package-manager rpm; - application/x-sea sea; - application/x-shockwave-flash swf; - application/x-stuffit sit; - application/x-tcl tcl tk; - application/x-x509-ca-cert der pem crt; - application/x-xpinstall xpi; - application/xhtml+xml xhtml; - application/xspf+xml xspf; - application/zip zip; - - application/octet-stream bin exe dll; - application/octet-stream deb; - application/octet-stream dmg; - application/octet-stream iso img; - application/octet-stream msi msp msm; - - application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; - application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; - - audio/midi mid midi kar; - audio/mpeg mp3; - audio/ogg ogg; - audio/x-m4a m4a; - audio/x-realaudio ra; - - video/3gpp 3gpp 3gp; - video/mp2t ts; - video/mp4 mp4; - video/mpeg mpeg mpg; - video/quicktime mov; - video/webm webm; - video/x-flv flv; - video/x-m4v m4v; - video/x-mng mng; - video/x-ms-asf asx asf; - video/x-ms-wmv wmv; - video/x-msvideo avi; -} diff --git a/nginx/sophisticated-nginx.conf b/nginx/sophisticated-nginx.conf deleted file mode 100644 index 949e284..0000000 --- a/nginx/sophisticated-nginx.conf +++ /dev/null @@ -1,119 +0,0 @@ -#user www-data; -#worker_processes 4; -pid /tmp/nginx.pid; -error_log /tmp/error-foo; - -#events { -# worker_connections 768; -#} - -http { - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 20; - types_hash_max_size 2048; - - include mime.types; - default_type application/octet-stream; - - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE - ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; - ssl_dhparam dhparams.pem; - - ssl_prefer_server_ciphers on; - ssl_session_cache shared:SSL:20m; - ssl_session_timeout 180m; - - ## - # Logging Settings - ## - - access_log /tmp/access-main; - error_log /tmp/error-main; - - ## - # Gzip Settings - ## - - gzip on; - - ## - # Phusion Passenger config - ## - # Uncomment it if you installed passenger or passenger-enterprise - ## - - #passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini; - #passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby; - - - server { - listen *:8000 default_server; - listen *:8443 ssl; - ssl_certificate screenshots.debian.net.crt; - ssl_certificate_key screenshots.debian.net.key; - ssl_client_certificate debsso.crt; - ssl_crl debsso.crl; - ssl_verify_client optional; - ssl_verify_depth 1; - - root ../public; - server_name _; - access_log /tmp/access-front; - error_log /tmp/error-front; - - # Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite - # redirection loop because the backend assumes that HTTP was spoken behind the - # proxy. - proxy_set_header X-Forwarded-Proto $scheme; - - # Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs - proxy_set_header Host $host; - - gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; - gzip_proxied any; - - location / { - try_files /maintenance.html @backend; - add_header X-Coffee main; - } - - location /json/ { - try_files /maintenance.html @backend; - add_header X-Coffee json; - } - - location /favicon.ico { - # try_files /maintenance.html @backend; - alias ../public/favicon.ico; - } - - location @backend { - proxy_set_header x_debian_sso_dn $ssl_client_s_dn; - proxy_pass http://127.0.0.1:3000; - } - - #location /assets/ { - # alias ../public/assets/; - # expires 1h; - # add_header X-Coffee assets; - #} - location /logo/ { - alias ../public/logo/; - expires 1h; - add_header X-Coffee logo; - } - location /screenshots/ { - alias ../public/screenshots/; - expires max; - add_header X-Coffee screenshots; - } - location /images/ { - alias ../public/images/; - expires 1h; - add_header X-Coffee images; - } - } -} - diff --git a/nginx/update-debsso-ca b/nginx/update-debsso-ca deleted file mode 100755 index 90e2a5b..0000000 --- a/nginx/update-debsso-ca +++ /dev/null @@ -1,111 +0,0 @@ -#!/usr/bin/python3 - -# Download new versions of the CA certificate and Certificate Revocation List -# from sso.debian.org and write them out atomically. - -import requests -import tempfile -import argparse -import os -import subprocess -import ssl - -class atomic_writer(object): - """ - Atomically write to a file - """ - def __init__(self, fname, mode, osmode=0o644, sync=True, **kw): - self.fname = fname - self.osmode = osmode - self.sync = sync - dirname = os.path.dirname(self.fname) - self.fd, self.abspath = tempfile.mkstemp(dir=dirname, text="b" not in mode) - self.outfd = open(self.fd, mode, closefd=True, **kw) - - def __enter__(self): - return self.outfd - - def __exit__(self, exc_type, exc_val, exc_tb): - if exc_type is None: - self.outfd.flush() - if self.sync: os.fdatasync(self.fd) - os.fchmod(self.fd, self.osmode) - os.rename(self.abspath, self.fname) - else: - os.unlink(self.abspath) - self.outfd.close() - return False - - -def get_url(url): - """ - Fetch a URL and return the raw result as bytes - """ - bundle='/etc/ssl/ca-debian/ca-certificates.crt' - if os.path.exists(bundle): - res = requests.get(url, verify=bundle) - else: - res = requests.get(url) - res.raise_for_status() - return res.content - - -def update_file(pathname, content, validate=None): - """ - Write content on pathname atomically, and do nothing if pathname exists and - has the same content as `content`. - - Returns True if the file has been updated, else False. - """ - try: - with open(pathname, "rb") as fd: - existing = fd.read() - except OSError: - existing = None - - if existing == content: return False - - # Validate the contents - if validate: - validate(content) - - with atomic_writer(pathname, "wb", osmode=0o644) as out: - out.write(content) - return True - -def validate_crt(data): - ssl.PEM_cert_to_DER_cert(data.decode("utf-8")) - -def validate_crl(data): - if not data.startswith(b"-----BEGIN X509 CRL-----"): - raise RuntimeError("Data does not begin with a CRL signature") - if not data.endswith(b"-----END X509 CRL-----\n"): - raise RuntimeError("Data does not end with a CRL footer") - -def update(destdir): - # Fetch the certificate and the CRL - cert = get_url("https://sso.debian.org/ca/ca.pem") - crl = get_url("https://sso.debian.org/ca/ca.crl") - - # Write them out atomically - - updated = False - updated = update_file(os.path.join(destdir, "debsso.crt"), cert, validate=validate_crt) or updated - updated = update_file(os.path.join(destdir, "debsso.crl"), crl, validate=validate_crl) or updated - return updated - - -def main(): - parser = argparse.ArgumentParser() - parser.add_argument("--destdir", default=".", help="destination directory. Default: .") - parser.add_argument("--onupdate", help="command to run if the file has been updated. Default: do not run anything.") - args = parser.parse_args() - - if update(args.destdir): - if args.onupdate: - subprocess.check_call(["sh", "-c", args.onupdate]) - - - -if __name__ == "__main__": - main()