Documentation revamped
This commit is contained in:
parent
844feb7f0e
commit
fbee80f5f1
16 changed files with 377 additions and 1175 deletions
|
|
@ -1,3 +1,5 @@
|
||||||
|
This file collects various notes about how certain aspects are implemented.
|
||||||
|
|
||||||
# Full text search
|
# Full text search
|
||||||
|
|
||||||
The pg_search Ruby gem is used for full-text searched in Rails.
|
The pg_search Ruby gem is used for full-text searched in Rails.
|
||||||
|
|
@ -21,7 +23,7 @@ SELECT COUNT(*) FROM "packages" WHERE (
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
||||||
# Index:
|
## Create search index to speed up searches significantly
|
||||||
|
|
||||||
CREATE INDEX packages_gin ON packages USING GIN( (to_tsvector('simple',
|
CREATE INDEX packages_gin ON packages USING GIN( (to_tsvector('simple',
|
||||||
coalesce("packages"."name"::text, '')) || to_tsvector('simple',
|
coalesce("packages"."name"::text, '')) || to_tsvector('simple',
|
||||||
|
|
@ -33,27 +35,21 @@ coalesce("packages"."long_description"::text, ''))) );
|
||||||
Used: https://github.com/semaperepelitsa/jquery.fileupload-rails
|
Used: https://github.com/semaperepelitsa/jquery.fileupload-rails
|
||||||
Which is a gem for: https://github.com/blueimp/jQuery-File-Upload
|
Which is a gem for: https://github.com/blueimp/jQuery-File-Upload
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
Paperclip for attachment/screenshot file handlind within ActiveRecord
|
Paperclip for attachment/screenshot file handlind within ActiveRecord
|
||||||
https://github.com/thoughtbot/paperclip
|
https://github.com/thoughtbot/paperclip
|
||||||
|
|
||||||
--
|
Rails 5 is said to contain functionality like that already.
|
||||||
|
Might be worth migrating to that at some time.
|
||||||
|
|
||||||
Components:
|
---
|
||||||
|
|
||||||
- Rails 5 (widespread, up-to-date, solves many common problems)
|
|
||||||
- PostgreSQL (fast, easy, I don't like MySQL, good fulltext search)
|
|
||||||
- Git (most people nowadays use Git)
|
|
||||||
- jQuery (well known and easy to use)
|
|
||||||
- Zurb Foundation (integrates nicer than Twitter Bootstrap)
|
|
||||||
- Guard for automated testing (http://www.rubydoc.info/gems/guard-rails)
|
|
||||||
|
|
||||||
--
|
|
||||||
|
|
||||||
Importer
|
Importer
|
||||||
|
|
||||||
How Debian repositories are organized: https://wiki.debian.org/RepositoryFormat
|
How Debian repositories are organized: https://wiki.debian.org/RepositoryFormat
|
||||||
|
|
||||||
--
|
---
|
||||||
|
|
||||||
Logging from within the application into the database's "log" table:
|
Logging from within the application into the database's "log" table:
|
||||||
|
|
||||||
|
|
@ -61,7 +57,7 @@ Log.log "foo"
|
||||||
or with section (default='frontend'):
|
or with section (default='frontend'):
|
||||||
Log.log "foo", "importer"
|
Log.log "foo", "importer"
|
||||||
|
|
||||||
--
|
---
|
||||||
|
|
||||||
To create admin users
|
To create admin users
|
||||||
---------------------
|
---------------------
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
To run the Rails server in development mode on port 3001 with HTTPS:
|
|
||||||
|
|
||||||
rails s puma -b 'ssl://0.0.0.0:3001?key=nginx/localhost.key&cert=nginx/localhost.crt&verify_mode=none'
|
|
||||||
|
|
||||||
This is required to be able to use single-sign login with the different services.
|
|
||||||
123
doc/README.Development.md
Normal file
123
doc/README.Development.md
Normal file
|
|
@ -0,0 +1,123 @@
|
||||||
|
# Developing/Contributing
|
||||||
|
|
||||||
|
This document helps you set up the *debshots* Rails application on your
|
||||||
|
own Debian system if you intend to work on the source code.
|
||||||
|
|
||||||
|
## Preparing the development environment
|
||||||
|
|
||||||
|
Most steps required to deploy the application (for production use) are automated
|
||||||
|
using an Ansible playbook that you find at ./ansible/debshots.yml
|
||||||
|
|
||||||
|
The following section documents the steps you need to do to get the application
|
||||||
|
running in development mode. If you are a little experienced in developing Rails
|
||||||
|
applications you may know most of that already.
|
||||||
|
|
||||||
|
Development worked best on a Debian Jessie or Sid system.
|
||||||
|
|
||||||
|
## Install dependencies
|
||||||
|
|
||||||
|
These APT-gettable packages are probably required to run the application:
|
||||||
|
|
||||||
|
apt install python-psycopg2 ruby sudo libssl-dev libreadline-dev \
|
||||||
|
zlib1g-dev libbz2-dev libpq-dev git imagemagick
|
||||||
|
|
||||||
|
## Prepare PostgreSQL database server and user
|
||||||
|
|
||||||
|
PostgreSQL stores data about packages, screenshots and users. Authentication works in production
|
||||||
|
because the applications runs as the system user *debshots* that gets access to PostgreSQL via
|
||||||
|
ident-based authentication. In development mode you will likely work as your own user so you need to
|
||||||
|
create a development database in PostgreSQL and create a database user with a password to access it.
|
||||||
|
Put those credentials into ./config/database.yml
|
||||||
|
|
||||||
|
apt install postgresql
|
||||||
|
su - postgres
|
||||||
|
createuser -P -d debshots_dev
|
||||||
|
createdb -O debshots_dev -E UTF8 -T template0 debshots_dev
|
||||||
|
|
||||||
|
## Install the required Ruby version using rbenv
|
||||||
|
|
||||||
|
Rails uses the *bundler* tool to download and install dependent gems/packages. To avoid installing
|
||||||
|
them system wide you should rather create an *rbenv* sandbox environment where the specific Ruby
|
||||||
|
version and the required gems are installed. That ensures stable operation of the application and
|
||||||
|
does not spoil your otherwise APT-controlled system.
|
||||||
|
|
||||||
|
Documentation on rbenv can be found at https://github.com/rbenv/rbenv
|
||||||
|
|
||||||
|
To install it for your current user:
|
||||||
|
|
||||||
|
git clone https://github.com/rbenv/rbenv.git ~/.rbenv
|
||||||
|
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile
|
||||||
|
|
||||||
|
# Load rbenv automatically by appending
|
||||||
|
# the following to ~/.profile:
|
||||||
|
|
||||||
|
Run "rbenv init" and do as said.
|
||||||
|
|
||||||
|
Install the "rbenv install" (https://github.com/rbenv/ruby-build#readme) add-on:
|
||||||
|
|
||||||
|
git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
|
||||||
|
|
||||||
|
## Get the application
|
||||||
|
|
||||||
|
Clone the debshots Git repository from https://salsa.debian.org/debian/debshots
|
||||||
|
|
||||||
|
## Install the required Ruby version and the applications' dependencies
|
||||||
|
|
||||||
|
rbenv install
|
||||||
|
echo "gem: --no-rdoc --no-ri" > ~/.gemrc
|
||||||
|
gem install bundler
|
||||||
|
bundle install
|
||||||
|
|
||||||
|
## Optional: copy screenshots and database from the live website
|
||||||
|
|
||||||
|
scp screenshots.debian.net:debshots-screenshots.tar .
|
||||||
|
tar -C public/ -xvf debshots-screenshots.tar
|
||||||
|
scp screenshots.debian.net:debshots.sql .
|
||||||
|
psql debshots_dev < debshots.sql
|
||||||
|
|
||||||
|
Make sure that the application's database schema is upgraded to reflect the latest state of
|
||||||
|
development.
|
||||||
|
|
||||||
|
bundle exec rails db:migrate
|
||||||
|
|
||||||
|
(The reason to prefix all commands by "bundle exec" to make sure that the Ruby version
|
||||||
|
from *rbenv* is used and that only the gems from the sandbox environment are used.)
|
||||||
|
|
||||||
|
## Start with a blank database
|
||||||
|
|
||||||
|
Create a blank database with the latest database schema:
|
||||||
|
|
||||||
|
bundle exec rails db:schema:load
|
||||||
|
|
||||||
|
If you get database access errors then check the *development* section in your
|
||||||
|
./config/database.yml file.
|
||||||
|
|
||||||
|
## Fill/update the database with information from APT repositories
|
||||||
|
|
||||||
|
Get the latest information on packages from the Debian repositories.
|
||||||
|
|
||||||
|
bundle exec rails debshots:update_from_deb_repos RAILS_ENV=production
|
||||||
|
bundle exec rails debshots:update_longdescription_from_deb_repos RAILS_ENV=production
|
||||||
|
|
||||||
|
## Run the application
|
||||||
|
|
||||||
|
bundle exec rails s
|
||||||
|
|
||||||
|
Point your browser to http://localhost:3000/ and you will see the web site.
|
||||||
|
|
||||||
|
## Optional: Tidy up the screenshot data
|
||||||
|
|
||||||
|
bundle exec rake debshots:remove_broken_screenshots
|
||||||
|
bundle exec rake debshots:remove_duplicate_images
|
||||||
|
|
||||||
|
## Optional: Import new package information
|
||||||
|
|
||||||
|
bundle exec rake debshots:list_deb_repos
|
||||||
|
bundle exec rake debshots:update_from_deb_repos
|
||||||
|
bundle exec debshots:update_longdescription_from_deb_repos
|
||||||
|
|
||||||
|
To run the Rails server in development mode on port 3001 with HTTPS:
|
||||||
|
|
||||||
|
rails s puma -b 'ssl://0.0.0.0:3001?key=nginx/localhost.key&cert=nginx/localhost.crt&verify_mode=none'
|
||||||
|
|
||||||
|
This is required to be able to use single-sign login with the different services.
|
||||||
|
|
@ -1,303 +0,0 @@
|
||||||
# Installing debshots the easy way using Ansible
|
|
||||||
|
|
||||||
Prerequisites: A Debian Jessie server.
|
|
||||||
|
|
||||||
Install PIP to get a recent version of Ansible:
|
|
||||||
|
|
||||||
apt install python-pip
|
|
||||||
pip install ansible
|
|
||||||
|
|
||||||
Run the Ansible playbook that comes with the debshots repository:
|
|
||||||
|
|
||||||
cd ansible
|
|
||||||
ansible-playbook debshots.yml
|
|
||||||
|
|
||||||
# Installing debshots the manual way
|
|
||||||
|
|
||||||
## Prepare PostgreSQL database server and user (ident-based authentication)
|
|
||||||
|
|
||||||
apt install postgresql
|
|
||||||
su - postgres
|
|
||||||
createuser -P -d debshots
|
|
||||||
createdb -O debshots -E UTF8 -T template0 debshots
|
|
||||||
|
|
||||||
## Create an application user
|
|
||||||
|
|
||||||
adduser debshots
|
|
||||||
|
|
||||||
Allow the user to parse access log files from Nginx:
|
|
||||||
|
|
||||||
adduser debshots adm
|
|
||||||
su - debshots
|
|
||||||
|
|
||||||
## Install the required Ruby version using rbenv
|
|
||||||
|
|
||||||
Documentation: https://github.com/rbenv/rbenv
|
|
||||||
|
|
||||||
git clone https://github.com/rbenv/rbenv.git ~/.rbenv
|
|
||||||
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile
|
|
||||||
|
|
||||||
# Load rbenv automatically by appending
|
|
||||||
# the following to ~/.profile:
|
|
||||||
|
|
||||||
eval "$(rbenv init -)"
|
|
||||||
|
|
||||||
Install the "rbenv install" add-on:
|
|
||||||
|
|
||||||
Documentation: https://github.com/rbenv/ruby-build#readme
|
|
||||||
|
|
||||||
git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
|
|
||||||
|
|
||||||
Install the "rbenv vars" add-on:
|
|
||||||
|
|
||||||
cd ~/.rbenv/plugins
|
|
||||||
git clone https://github.com/sstephenson/rbenv-vars.git
|
|
||||||
|
|
||||||
## Get the application
|
|
||||||
|
|
||||||
Clone the debshots Git repository.
|
|
||||||
|
|
||||||
## Install the Ruby dependencies
|
|
||||||
|
|
||||||
rbenv install
|
|
||||||
echo "gem: --no-rdoc --no-ri" > ~/.gemrc
|
|
||||||
gem install bundler
|
|
||||||
bundle install --deployment
|
|
||||||
|
|
||||||
## Optional: copy screenshots and database from the live website
|
|
||||||
|
|
||||||
scp screenshots.debian.net:debshots-screenshots.tar .
|
|
||||||
tar -C public/ -xvf debshots-screenshots.tar
|
|
||||||
scp screenshots.debian.net:debshots.sql .
|
|
||||||
psql debshots < debshots.sql
|
|
||||||
|
|
||||||
## Switch to production environment
|
|
||||||
|
|
||||||
export RAILS_ENV=production
|
|
||||||
|
|
||||||
## Migrate database
|
|
||||||
|
|
||||||
rails db:schema:load RAILS_ENV=production
|
|
||||||
- rails db:migrate RAILS_ENV=production -
|
|
||||||
|
|
||||||
In config/database.yml: production: user/password/host must be commented out
|
|
||||||
|
|
||||||
## Fill/update the database with information from APT repositories
|
|
||||||
|
|
||||||
rails debshots:update_from_deb_repos RAILS_ENV=production
|
|
||||||
rails debshots:update_longdescription_from_deb_repos RAILS_ENV=production
|
|
||||||
|
|
||||||
## Pre-render the static assets
|
|
||||||
|
|
||||||
rails assets:precompile RAILS_ENV=production
|
|
||||||
|
|
||||||
## Test the application:
|
|
||||||
|
|
||||||
rails s -b 127.0.0.1 -e production
|
|
||||||
|
|
||||||
Point your browser to http://...:3000/ and check the web site.
|
|
||||||
|
|
||||||
## Create a user for moderation:
|
|
||||||
|
|
||||||
Start a Rails console:
|
|
||||||
|
|
||||||
bundle exec rails c -e production
|
|
||||||
|
|
||||||
Create a new user record:
|
|
||||||
|
|
||||||
user = User.create(realname: 'Christoph Haas', password: 'foobartest', email: 'email@christoph-haas.de')
|
|
||||||
user.save!
|
|
||||||
|
|
||||||
## Tidy up the screenshot data
|
|
||||||
|
|
||||||
bundle exec rake debshots:remove_broken_screenshots
|
|
||||||
bundle exec rake debshots:remove_duplicate_images
|
|
||||||
|
|
||||||
## Import new package information
|
|
||||||
|
|
||||||
bundle exec rake debshots:list_deb_repos
|
|
||||||
bundle exec rake debshots:update_from_deb_repos
|
|
||||||
bundle exec debshots:update_longdescription_from_deb_repos
|
|
||||||
|
|
||||||
|
|
||||||
# Supported URL paths (aka routes)
|
|
||||||
|
|
||||||
_For up-to-date information please check config/routes._
|
|
||||||
|
|
||||||
/screenshots/:package_inital/:package/:(id)_:size.png
|
|
||||||
* package = name of the package
|
|
||||||
* id = numerical ID of the screenshot
|
|
||||||
* size = "large" or "small"
|
|
||||||
* Returns a PNG image of a screenshot
|
|
||||||
* Should be served as a static asset
|
|
||||||
|
|
||||||
/image/:(id)_:size.png
|
|
||||||
* id = numerical ID of the screenshot
|
|
||||||
* size = "large" or "small"
|
|
||||||
* Returns a PNG image of a screenshot
|
|
||||||
* Usually used for unapproved images that should just be shown to the uploader
|
|
||||||
|
|
||||||
/about
|
|
||||||
* Return an informational HTML page
|
|
||||||
|
|
||||||
/packages
|
|
||||||
* Return a list of packages with pagination
|
|
||||||
|
|
||||||
/packages/with_screenshots
|
|
||||||
* Return a list of packages with pagination
|
|
||||||
* Select only those packages that have screenshots.
|
|
||||||
|
|
||||||
/packages/without_screenshots
|
|
||||||
* Return a list of packages with pagination
|
|
||||||
* Select only those packages that do not have screenshots.
|
|
||||||
|
|
||||||
/packages/games_without_screenshots (deprecated)
|
|
||||||
* Return a list of packages with pagination
|
|
||||||
* Select only those packages that belong to Debian's "games" section
|
|
||||||
|
|
||||||
/json/packages
|
|
||||||
* Return a JSON data structure of all packages
|
|
||||||
|
|
||||||
/json/screenshots
|
|
||||||
* Return a JSON data structure containing packages and screenshots
|
|
||||||
|
|
||||||
/json/packages-without-screenshots
|
|
||||||
* Return a JSON data structure of those packages that do not have any screenshots
|
|
||||||
|
|
||||||
/packages/moderate
|
|
||||||
* Return a HTML page showing packages that need moderation
|
|
||||||
* Must only be available to logged in moderators
|
|
||||||
|
|
||||||
/upload
|
|
||||||
* Return a HTML page containing an upload form for new screenshots
|
|
||||||
|
|
||||||
/guidelines (deprecated)
|
|
||||||
* Return a HTML page showing general guidelines for creating screenshots
|
|
||||||
* Should just redirect to the /upload page
|
|
||||||
|
|
||||||
/upload/:package
|
|
||||||
* ??
|
|
||||||
|
|
||||||
/uploadfile
|
|
||||||
* ??
|
|
||||||
|
|
||||||
/login
|
|
||||||
* Show a login form
|
|
||||||
|
|
||||||
/logout
|
|
||||||
* Logout the user by invalidating the cookie session.
|
|
||||||
|
|
||||||
/package/:package
|
|
||||||
* Show details of a certain package
|
|
||||||
|
|
||||||
/json/package/:package
|
|
||||||
* Return a JSON data structure containing details of a certain package
|
|
||||||
|
|
||||||
/thumbnail/:package
|
|
||||||
/thumbnail-404/:package (deprecated)
|
|
||||||
* Return a small (160x120 pixel) PNG screenshot file of a package
|
|
||||||
* If the package does not have any screenshots then return a 404 code
|
|
||||||
|
|
||||||
/thumbnail-with-version/:package/:version
|
|
||||||
* Return a small (160x120 pixel) PNG screenshot file of a package
|
|
||||||
* If the package does not have any screenshots then return a 404 code
|
|
||||||
* Prefer screenshots of a certain version
|
|
||||||
|
|
||||||
/screenshot/:package
|
|
||||||
/screenshot-404/:package (deprecated)
|
|
||||||
* Return a large (320x240 pixel) PNG screenshot file of a package
|
|
||||||
* If the package does not have any screenshots then return a 404 code
|
|
||||||
|
|
||||||
/screenshot-with-version/:package/:version
|
|
||||||
* Return a large (320x240 pixel) PNG screenshot file of a package
|
|
||||||
* If the package does not have any screenshots then return a 404 code
|
|
||||||
* Prefer screenshots of a certain version
|
|
||||||
|
|
||||||
/delete_screenshot/:screenshot
|
|
||||||
* Users: request deletion of a screenshot
|
|
||||||
* Moderators: delete a screenshot
|
|
||||||
|
|
||||||
/approve_screenshot/:screenshot
|
|
||||||
* Users: 403
|
|
||||||
* Moderators: approve a screenshot
|
|
||||||
|
|
||||||
/keep_screenshot/:screenshot
|
|
||||||
* Users: 403
|
|
||||||
* Moderators: re-approve a screenshot that was requested for deletion
|
|
||||||
|
|
||||||
## Cron jobs
|
|
||||||
|
|
||||||
Parse Nginx access logs to count the number of visits of each package:
|
|
||||||
|
|
||||||
RAILS_ENV=production bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
|
|
||||||
|
|
||||||
As a cron job:
|
|
||||||
|
|
||||||
41 9 * * * cd $HOME/debshots ; RAILS_ENV=production /home/debshots/.rbenv/shims/bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
|
|
||||||
|
|
||||||
|
|
||||||
# Authentication
|
|
||||||
|
|
||||||
This web application tries to avoid to create yet another directory
|
|
||||||
of user accounts. So it leverages other common web sites like StackExchange,
|
|
||||||
Debian SSO (using browser/client certificates) or GitHub as single-sign-on
|
|
||||||
services. It is still possible to create local user accounts for administrators
|
|
||||||
but registration is disabled.
|
|
||||||
|
|
||||||
Anonymous uploads are possible but they have to be moderated by an administrator.
|
|
||||||
|
|
||||||
# Authorization
|
|
||||||
|
|
||||||
A user can have one of these access levels.
|
|
||||||
|
|
||||||
## Anonymous
|
|
||||||
|
|
||||||
Without authentication all user actions are moderated. Such users can upload
|
|
||||||
screenshots or report existing/published screenshots as inappropriate. However
|
|
||||||
a user with level 'admin' will have to approve that action.
|
|
||||||
|
|
||||||
## Authenticated by single-sign-login (SSO)
|
|
||||||
|
|
||||||
Users can use different authentication services to login - like Github or
|
|
||||||
StackExchange. Such users internally get an account with a random password
|
|
||||||
created but they will keep logging in via SSO.
|
|
||||||
|
|
||||||
The first upload will have to be moderated. Subsequent uploads will be
|
|
||||||
approved automatically.
|
|
||||||
|
|
||||||
## Authenticated by Debian signle-sign-login (SSO)
|
|
||||||
|
|
||||||
If a user authenticates using a Debian SSO client certificate they will be
|
|
||||||
able to upload screenshots without moderation.
|
|
||||||
(Anohter idea was to restrict them to uploading only screenshots for the
|
|
||||||
packages they maintain. But that may be reliable and is not implemented at
|
|
||||||
this time.)
|
|
||||||
|
|
||||||
## Administrator
|
|
||||||
|
|
||||||
Such a user has an internal user account. The database record has the
|
|
||||||
'admin' field set to 1. Admins can freely upload, moderate and delete
|
|
||||||
screenshots. They can also read the log files.
|
|
||||||
|
|
||||||
|
|
||||||
# Nginx during development
|
|
||||||
|
|
||||||
During development it is advised to run Nginx to proxy ports 3000 (HTTP)
|
|
||||||
and 3001 (HTTPS) to the rails application.
|
|
||||||
|
|
||||||
cd nginx
|
|
||||||
nginx -c `pwd`/nginx.conf
|
|
||||||
|
|
||||||
The SSL certitificate is just a self-signed certificate with the
|
|
||||||
common name "localhost". It was generated using:
|
|
||||||
|
|
||||||
openssl req -x509 -newkey 4096 -nodes -keyout localhost.key -out localhost.crt -days 3650
|
|
||||||
|
|
||||||
Run "rails s" in another window. That will use the built-in Ruby 'Puma'
|
|
||||||
application server that can also be used in production. It requires less
|
|
||||||
configuration than Phusion Passenger but may be slower in regard to
|
|
||||||
performance and multi-threading / multi-core support.
|
|
||||||
|
|
||||||
If you get "400 Bad Request / The SSL certificate error" in the browser then
|
|
||||||
please check the error log (/tmp/error*). Once cause is that the CRL of
|
|
||||||
the Debian SSO has expired and needs to be updated.
|
|
||||||
129
doc/README.Installation.md
Normal file
129
doc/README.Installation.md
Normal file
|
|
@ -0,0 +1,129 @@
|
||||||
|
# Installing debshots
|
||||||
|
|
||||||
|
The easiest way to deploy the application is using Ansible.
|
||||||
|
|
||||||
|
Take a Debian Stretch server (8 GB RAM recommended).
|
||||||
|
|
||||||
|
Install PIP to get a recent version of Ansible:
|
||||||
|
|
||||||
|
apt install python-pip
|
||||||
|
pip install ansible
|
||||||
|
|
||||||
|
Run the Ansible playbook that comes with the debshots repository:
|
||||||
|
|
||||||
|
cd ansible
|
||||||
|
ansible-playbook debshots.yml
|
||||||
|
|
||||||
|
Check out the project repository from https://salsa.debian.org/debian/debshots
|
||||||
|
|
||||||
|
Change to the *ansible* subdirectory and run the main playbook:
|
||||||
|
|
||||||
|
cd ansible
|
||||||
|
ansible-playbook debshots.yml
|
||||||
|
|
||||||
|
This will install PostgreSQL and Nginx, create a database, create a system user
|
||||||
|
and do various configuration.
|
||||||
|
|
||||||
|
Make sure that you set the environment variables as described in README.SSO.md before
|
||||||
|
you start the Rails application. Otherwise most single sign-on providers cannot work.
|
||||||
|
You also need to get the https://salsa.debian.org/debsso-team/debsso/raw/master/update-debsso-ca
|
||||||
|
script and run it in /etc/nginx to update the certficate and CRL used by the Debian
|
||||||
|
single-sign-on provider.
|
||||||
|
|
||||||
|
The production configuration uses Nginx that decrypts HTTPS and either serves static
|
||||||
|
assets (images, Javascript, CSS) itself or requests for dynamic content to the
|
||||||
|
Rails application. You will need a SSL certificate for Nginx. Just get one from
|
||||||
|
LetsEncrypt using the *certbot* tool.
|
||||||
|
|
||||||
|
Finally create an admin user for moderation:
|
||||||
|
|
||||||
|
Start a Rails console:
|
||||||
|
|
||||||
|
rails c -e production
|
||||||
|
|
||||||
|
Create a new user record:
|
||||||
|
|
||||||
|
user = User.create(realname: 'Christoph Haas', password: 'foobartest', email: 'email@christoph-haas.de')
|
||||||
|
user.save!
|
||||||
|
|
||||||
|
## Cron jobs
|
||||||
|
|
||||||
|
Parse Nginx access logs to count the number of visits of each package:
|
||||||
|
|
||||||
|
RAILS_ENV=production bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
|
||||||
|
|
||||||
|
As a cron job:
|
||||||
|
|
||||||
|
41 9 * * * cd $HOME/debshots ; RAILS_ENV=production /home/debshots/.rbenv/shims/bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
|
||||||
|
|
||||||
|
# Authentication
|
||||||
|
|
||||||
|
This web application tries to avoid to create yet another directory
|
||||||
|
of user accounts. So it leverages other common web sites like StackExchange,
|
||||||
|
Debian SSO (using browser/client certificates) or GitHub as single-sign-on
|
||||||
|
services. It is still possible to create local user accounts for administrators
|
||||||
|
but registration is disabled.
|
||||||
|
|
||||||
|
Anonymous uploads are possible but they have to be moderated by an administrator.
|
||||||
|
|
||||||
|
# Authorization
|
||||||
|
|
||||||
|
A user can have one of these access levels.
|
||||||
|
|
||||||
|
## Anonymous
|
||||||
|
|
||||||
|
Without authentication all user actions are moderated. Such users can upload
|
||||||
|
screenshots or report existing/published screenshots as inappropriate. However
|
||||||
|
a user with level 'admin' will have to approve that action.
|
||||||
|
|
||||||
|
## Authenticated by single-sign-login (SSO)
|
||||||
|
|
||||||
|
Users can use different authentication services to login - like Github or
|
||||||
|
StackExchange. Such users internally get an account with a random password
|
||||||
|
created but they will keep logging in via SSO.
|
||||||
|
|
||||||
|
The first upload will have to be moderated. Subsequent uploads will be
|
||||||
|
approved automatically.
|
||||||
|
|
||||||
|
## Authenticated by Debian signle-sign-login (SSO)
|
||||||
|
|
||||||
|
If a user authenticates using a Debian SSO client certificate they will be
|
||||||
|
able to upload screenshots without moderation.
|
||||||
|
(Anohter idea was to restrict them to uploading only screenshots for the
|
||||||
|
packages they maintain. But that may be reliable and is not implemented at
|
||||||
|
this time.)
|
||||||
|
|
||||||
|
## Administrator
|
||||||
|
|
||||||
|
Such a user has an internal user account. The database record has the
|
||||||
|
'admin' field set to 1. Admins can freely upload, moderate and delete
|
||||||
|
screenshots. They can also read the log files.
|
||||||
|
|
||||||
|
# Nginx during development
|
||||||
|
|
||||||
|
During development it is advised to run Nginx to proxy ports 3000 (HTTP)
|
||||||
|
and 3001 (HTTPS) to the rails application.
|
||||||
|
|
||||||
|
cd nginx
|
||||||
|
nginx -c `pwd`/nginx.conf
|
||||||
|
|
||||||
|
The SSL certitificate is just a self-signed certificate with the
|
||||||
|
common name "localhost". It was generated using:
|
||||||
|
|
||||||
|
openssl req -x509 -newkey 4096 -nodes -keyout localhost.key -out localhost.crt -days 3650
|
||||||
|
|
||||||
|
Run "rails s" in another window. That will use the built-in Ruby 'Puma'
|
||||||
|
application server that can also be used in production. It requires less
|
||||||
|
configuration than Phusion Passenger but may be slower in regard to
|
||||||
|
performance and multi-threading / multi-core support.
|
||||||
|
|
||||||
|
If you get "400 Bad Request / The SSL certificate error" in the browser then
|
||||||
|
please check the error log (/tmp/error*). Once cause is that the CRL of
|
||||||
|
the Debian SSO has expired and needs to be updated.
|
||||||
|
|
||||||
|
# Tidy up the screenshot data:
|
||||||
|
|
||||||
|
bundle exec rake debshots:remove_broken_screenshots
|
||||||
|
|
||||||
|
bundle exec rake debshots:remove_duplicate_images
|
||||||
|
|
||||||
102
doc/README.URLs.md
Normal file
102
doc/README.URLs.md
Normal file
|
|
@ -0,0 +1,102 @@
|
||||||
|
# Supported URL paths (aka routes)
|
||||||
|
|
||||||
|
/screenshots/:package_inital/:package/:(id)_:size.png
|
||||||
|
* package = name of the package
|
||||||
|
* id = numerical ID of the screenshot
|
||||||
|
* size = "large" or "small"
|
||||||
|
* Returns a PNG image of a screenshot
|
||||||
|
* Should be served as a static asset
|
||||||
|
|
||||||
|
/image/:(id)_:size.png
|
||||||
|
* id = numerical ID of the screenshot
|
||||||
|
* size = "large" or "small"
|
||||||
|
* Returns a PNG image of a screenshot
|
||||||
|
* Usually used for unapproved images that should just be shown to the uploader
|
||||||
|
|
||||||
|
/about
|
||||||
|
* Return an informational HTML page
|
||||||
|
|
||||||
|
/packages
|
||||||
|
* Return a list of packages with pagination
|
||||||
|
|
||||||
|
/packages/with_screenshots
|
||||||
|
* Return a list of packages with pagination
|
||||||
|
* Select only those packages that have screenshots.
|
||||||
|
|
||||||
|
/packages/without_screenshots
|
||||||
|
* Return a list of packages with pagination
|
||||||
|
* Select only those packages that do not have screenshots.
|
||||||
|
|
||||||
|
/packages/games_without_screenshots (deprecated)
|
||||||
|
* Return a list of packages with pagination
|
||||||
|
* Select only those packages that belong to Debian's "games" section
|
||||||
|
|
||||||
|
/json/packages
|
||||||
|
* Return a JSON data structure of all packages
|
||||||
|
|
||||||
|
/json/screenshots
|
||||||
|
* Return a JSON data structure containing packages and screenshots
|
||||||
|
|
||||||
|
/json/packages-without-screenshots
|
||||||
|
* Return a JSON data structure of those packages that do not have any screenshots
|
||||||
|
|
||||||
|
/packages/moderate
|
||||||
|
* Return a HTML page showing packages that need moderation
|
||||||
|
* Must only be available to logged in moderators
|
||||||
|
|
||||||
|
/upload
|
||||||
|
* Return a HTML page containing an upload form for new screenshots
|
||||||
|
|
||||||
|
/guidelines (deprecated)
|
||||||
|
* Return a HTML page showing general guidelines for creating screenshots
|
||||||
|
* Should just redirect to the /upload page
|
||||||
|
|
||||||
|
/upload/:package
|
||||||
|
* ??
|
||||||
|
|
||||||
|
/uploadfile
|
||||||
|
* ??
|
||||||
|
|
||||||
|
/login
|
||||||
|
* Show a login form
|
||||||
|
|
||||||
|
/logout
|
||||||
|
* Logout the user by invalidating the cookie session.
|
||||||
|
|
||||||
|
/package/:package
|
||||||
|
* Show details of a certain package
|
||||||
|
|
||||||
|
/json/package/:package
|
||||||
|
* Return a JSON data structure containing details of a certain package
|
||||||
|
|
||||||
|
/thumbnail/:package
|
||||||
|
/thumbnail-404/:package (deprecated)
|
||||||
|
* Return a small (160x120 pixel) PNG screenshot file of a package
|
||||||
|
* If the package does not have any screenshots then return a 404 code
|
||||||
|
|
||||||
|
/thumbnail-with-version/:package/:version
|
||||||
|
* Return a small (160x120 pixel) PNG screenshot file of a package
|
||||||
|
* If the package does not have any screenshots then return a 404 code
|
||||||
|
* Prefer screenshots of a certain version
|
||||||
|
|
||||||
|
/screenshot/:package
|
||||||
|
/screenshot-404/:package (deprecated)
|
||||||
|
* Return a large (320x240 pixel) PNG screenshot file of a package
|
||||||
|
* If the package does not have any screenshots then return a 404 code
|
||||||
|
|
||||||
|
/screenshot-with-version/:package/:version
|
||||||
|
* Return a large (320x240 pixel) PNG screenshot file of a package
|
||||||
|
* If the package does not have any screenshots then return a 404 code
|
||||||
|
* Prefer screenshots of a certain version
|
||||||
|
|
||||||
|
/delete_screenshot/:screenshot
|
||||||
|
* Users: request deletion of a screenshot
|
||||||
|
* Moderators: delete a screenshot
|
||||||
|
|
||||||
|
/approve_screenshot/:screenshot
|
||||||
|
* Users: 403
|
||||||
|
* Moderators: approve a screenshot
|
||||||
|
|
||||||
|
/keep_screenshot/:screenshot
|
||||||
|
* Users: 403
|
||||||
|
* Moderators: re-approve a screenshot that was requested for deletion
|
||||||
|
|
@ -57,6 +57,7 @@ Environment variables have to be set before starting the application:
|
||||||
export GITHUB_SECRET=…
|
export GITHUB_SECRET=…
|
||||||
|
|
||||||
Keys can be managed at https://github.com/settings/applications
|
Keys can be managed at https://github.com/settings/applications
|
||||||
|
To register a new oauth key go to "Developer Settings" in your Github account.
|
||||||
|
|
||||||
Make sure that the allowed callback URL is:
|
Make sure that the allowed callback URL is:
|
||||||
https://screenshots.debian.net/users/auth/github/callback
|
https://screenshots.debian.net/users/auth/github/callback
|
||||||
|
|
|
||||||
357
doc/README.md
357
doc/README.md
|
|
@ -1,352 +1,19 @@
|
||||||
== Installing debshots
|
# About debshots
|
||||||
|
|
||||||
=== Prepare PostgreSQL database server and user (ident-based authentication)
|
Debshots is a web application written in Ruby-on-Rails that powers the
|
||||||
|
screenshots.debian.net web site. Many services like packages.debian.net,
|
||||||
|
Ubuntu Software or Synaptic rely on it.
|
||||||
|
|
||||||
apt install postgresql
|
## State of the application
|
||||||
|
|
||||||
su - postgres
|
The application has been revamped a lot and does not resemble the version
|
||||||
|
still used in production. The current state is worth trying but not yet ready
|
||||||
|
for deployment.
|
||||||
|
|
||||||
createuser -d debshots
|
## Development
|
||||||
|
|
||||||
createdb -O debshots -E UTF8 -T template0 debshots
|
Check out the README.Development.md
|
||||||
|
|
||||||
=== Create an application user
|
## Deployment
|
||||||
|
|
||||||
adduser debshots
|
Read the README.Installation.md
|
||||||
|
|
||||||
Allow the user to parse access log files from Nginx:
|
|
||||||
|
|
||||||
adduser debshots adm
|
|
||||||
|
|
||||||
su - debshots
|
|
||||||
|
|
||||||
=== Install the required Ruby version using rbenv
|
|
||||||
|
|
||||||
https://github.com/rbenv/rbenv
|
|
||||||
|
|
||||||
git clone https://github.com/rbenv/rbenv.git ~/.rbenv
|
|
||||||
|
|
||||||
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile
|
|
||||||
|
|
||||||
|
|
||||||
# Load rbenv automatically by appending
|
|
||||||
# the following to ~/.bashrc:
|
|
||||||
|
|
||||||
eval "$(rbenv init -)"
|
|
||||||
|
|
||||||
|
|
||||||
https://github.com/rbenv/ruby-build#readme
|
|
||||||
|
|
||||||
git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
|
|
||||||
|
|
||||||
=== Get the application
|
|
||||||
|
|
||||||
Clone the debshots Git repository.
|
|
||||||
|
|
||||||
=== Install the Ruby dependencies
|
|
||||||
|
|
||||||
rbenv install
|
|
||||||
|
|
||||||
echo "gem: --no-rdoc --no-ri" > ~/.gemrc
|
|
||||||
|
|
||||||
gem install bundler
|
|
||||||
|
|
||||||
bundle install --deployment
|
|
||||||
|
|
||||||
=== Copy screenshots and database from the former live website
|
|
||||||
|
|
||||||
scp screenshots.debian.net:debshots-screenshots.tar .
|
|
||||||
|
|
||||||
tar -C public/ -xvf debshots-screenshots.tar
|
|
||||||
|
|
||||||
scp screenshots.debian.net:debshots.sql .
|
|
||||||
|
|
||||||
psql debshots < debshots.sql
|
|
||||||
|
|
||||||
Switch to production environment:
|
|
||||||
|
|
||||||
export RAILS_ENV=production
|
|
||||||
|
|
||||||
Migrate database:
|
|
||||||
|
|
||||||
bundle exec rake db:migrate RAILS_ENV=production
|
|
||||||
|
|
||||||
(config/database.yml: production: user/password/host must be commented out)
|
|
||||||
|
|
||||||
Convert screenshots to new format (paperclip):
|
|
||||||
|
|
||||||
bundle exec rake debshots:screenshots_to_paperclip RAILS_ENV=production
|
|
||||||
|
|
||||||
Remove old screenshots directory structure:
|
|
||||||
|
|
||||||
rm -r public/live
|
|
||||||
|
|
||||||
Render the assets:
|
|
||||||
|
|
||||||
bundle exec rake assets:precompile RAILS_ENV=production
|
|
||||||
|
|
||||||
Test the application:
|
|
||||||
|
|
||||||
bundle exec rails s -b 0.0.0.0 -e production
|
|
||||||
|
|
||||||
http://...:3000/
|
|
||||||
|
|
||||||
Create a user for moderation:
|
|
||||||
|
|
||||||
bundle exec rails c -e production
|
|
||||||
|
|
||||||
user = User.create(realname: 'Christoph Haas', password: 'foobartest', email: 'email@christoph-haas.de', provider: 'local')
|
|
||||||
user.save!
|
|
||||||
|
|
||||||
Tidy up the screenshot data:
|
|
||||||
|
|
||||||
bundle exec rake debshots:remove_broken_screenshots
|
|
||||||
|
|
||||||
bundle exec rake debshots:remove_duplicate_images
|
|
||||||
|
|
||||||
Import new package information:
|
|
||||||
|
|
||||||
bundle exec rake debshots:list_deb_repos
|
|
||||||
|
|
||||||
bundle exec rake debshots:update_from_deb_repos
|
|
||||||
|
|
||||||
bundle exec debshots:update_longdescription_from_deb_repos
|
|
||||||
|
|
||||||
=== Install passenger to run the application behind nginx
|
|
||||||
|
|
||||||
https://www.phusionpassenger.com/library/walkthroughs/deploy/ruby/ownserver/nginx/oss/jessie/install_passenger.html
|
|
||||||
|
|
||||||
Example nginx vhost config:
|
|
||||||
|
|
||||||
##
|
|
||||||
# You should look at the following URL's in order to grasp a solid understanding
|
|
||||||
# of Nginx configuration files in order to fully unleash the power of Nginx.
|
|
||||||
# http://wiki.nginx.org/Pitfalls
|
|
||||||
# http://wiki.nginx.org/QuickStart
|
|
||||||
# http://wiki.nginx.org/Configuration
|
|
||||||
#
|
|
||||||
# Generally, you will want to move this file somewhere, and start with a clean
|
|
||||||
# file but keep this around for reference. Or just disable in sites-enabled.
|
|
||||||
#
|
|
||||||
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
|
|
||||||
##
|
|
||||||
|
|
||||||
#proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=assets:768m use_temp_path=off;
|
|
||||||
|
|
||||||
#add_header X-Cache-Status $upstream_cache_status;
|
|
||||||
#add_header X-Runtime 42;
|
|
||||||
more_clear_headers 'X-Runtime';
|
|
||||||
more_clear_headers 'X-Powered-By';
|
|
||||||
more_clear_headers 'Server';
|
|
||||||
server_tokens off;
|
|
||||||
|
|
||||||
#passenger_show_version_in_header off;
|
|
||||||
|
|
||||||
#log_format proxy '[$time_local] Cache: $upstream_cache_status $upstream_addr $upstream_response_time $status $bytes_sent $proxy_add_x_forwarded_for $request_uri "$http_referer" "$http_user_agent"';
|
|
||||||
#access_log /var/log/nginx/debshots-access.log proxy;
|
|
||||||
|
|
||||||
# Default server configuration
|
|
||||||
#
|
|
||||||
#passenger_log_level 5;
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 85.25.83.22:80 default_server;
|
|
||||||
#listen 80 default_server;
|
|
||||||
#listen [::]:80 default_server;
|
|
||||||
|
|
||||||
# SSL configuration
|
|
||||||
#
|
|
||||||
# listen 443 ssl default_server;
|
|
||||||
# listen [::]:443 ssl default_server;
|
|
||||||
#
|
|
||||||
# Self signed certs generated by the ssl-cert package
|
|
||||||
# Don't use them in a production server!
|
|
||||||
#
|
|
||||||
# include snippets/snakeoil.conf;
|
|
||||||
|
|
||||||
passenger_enabled on;
|
|
||||||
passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby;
|
|
||||||
#passenger_pass_header X-Accel-Redirect;
|
|
||||||
|
|
||||||
#proxy_cache_methods GET HEAD;
|
|
||||||
|
|
||||||
root /home/debshots/debshots/public;
|
|
||||||
|
|
||||||
# Add index.php to the list if you are using PHP
|
|
||||||
#index index.html index.htm index.nginx-debian.html;
|
|
||||||
|
|
||||||
server_name _;
|
|
||||||
#proxy_cache assets;
|
|
||||||
#add_header X-Cache-Status $upstream_cache_status;
|
|
||||||
#proxy_ignore_headers Cache-Control;
|
|
||||||
|
|
||||||
#add_header X-Debian rocks;
|
|
||||||
|
|
||||||
location /assets/ {
|
|
||||||
alias /home/debshots/debshots/public/assets/;
|
|
||||||
expires 1h;
|
|
||||||
#include debshots_params;
|
|
||||||
add_header X-Coffee assets;
|
|
||||||
add_header Cache-Control public;
|
|
||||||
}
|
|
||||||
location /logo/ {
|
|
||||||
alias /home/debshots/debshots/public/logo/;
|
|
||||||
expires 1h;
|
|
||||||
add_header X-Coffee logo;
|
|
||||||
add_header Cache-Control public;
|
|
||||||
}
|
|
||||||
location /screenshots/ {
|
|
||||||
alias /home/debshots/debshots/public/screenshots/;
|
|
||||||
expires max;
|
|
||||||
add_header X-Coffee screenshots;
|
|
||||||
add_header Cache-Control public;
|
|
||||||
}
|
|
||||||
location /images/ {
|
|
||||||
alias /home/debshots/debshots/public/images/;
|
|
||||||
expires 1h;
|
|
||||||
add_header X-Coffee images;
|
|
||||||
add_header Cache-Control public;
|
|
||||||
}
|
|
||||||
|
|
||||||
# Send thumbnails using X-Sendfile / X-Accel-Redirect
|
|
||||||
# The correct thumbnail is computed by the Rails application so it cannot be served directly.
|
|
||||||
location /thumbnail/ {
|
|
||||||
expires 1d;
|
|
||||||
add_header X-Coffee thumbnail;
|
|
||||||
add_header Cache-Control public;
|
|
||||||
|
|
||||||
passenger_set_header X-Sendfile-Type "X-Accel-Redirect";
|
|
||||||
passenger_env_var HTTP_X_ACCEL_MAPPING /home/debshots/debshots/public/=/__send_file_accel/;
|
|
||||||
passenger_pass_header X-Accel-Redirect;
|
|
||||||
}
|
|
||||||
|
|
||||||
# Send public assets using X-Sendfile / X-Accel-Redirect (e.g. public/images/dummy/...)
|
|
||||||
location /public/ {
|
|
||||||
expires 1h;
|
|
||||||
add_header X-Coffee public;
|
|
||||||
add_header Cache-Control public;
|
|
||||||
|
|
||||||
passenger_set_header X-Sendfile-Type "X-Accel-Redirect";
|
|
||||||
passenger_env_var HTTP_X_ACCEL_MAPPING /home/debshots/debshots/public/=/__send_file_accel/;
|
|
||||||
passenger_pass_header X-Accel-Redirect;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /__send_file_accel/ {
|
|
||||||
internal;
|
|
||||||
alias /home/debshots/debshots/public/;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
== Supported URL paths (aka routes)
|
|
||||||
|
|
||||||
/screenshots/:package_inital/:package/:(id)_:size.png
|
|
||||||
* package = name of the package
|
|
||||||
* id = numerical ID of the screenshot
|
|
||||||
* size = "large" or "small"
|
|
||||||
* Returns a PNG image of a screenshot
|
|
||||||
* Should be served as a static asset
|
|
||||||
|
|
||||||
/image/:(id)_:size.png
|
|
||||||
* id = numerical ID of the screenshot
|
|
||||||
* size = "large" or "small"
|
|
||||||
* Returns a PNG image of a screenshot
|
|
||||||
* Usually used for unapproved images that should just be shown to the uploader
|
|
||||||
|
|
||||||
/about
|
|
||||||
* Return an informational HTML page
|
|
||||||
|
|
||||||
/packages
|
|
||||||
* Return a list of packages with pagination
|
|
||||||
|
|
||||||
/packages/with_screenshots
|
|
||||||
* Return a list of packages with pagination
|
|
||||||
* Select only those packages that have screenshots.
|
|
||||||
|
|
||||||
/packages/without_screenshots
|
|
||||||
* Return a list of packages with pagination
|
|
||||||
* Select only those packages that do not have screenshots.
|
|
||||||
|
|
||||||
/packages/games_without_screenshots (deprecated)
|
|
||||||
* Return a list of packages with pagination
|
|
||||||
* Select only those packages that belong to Debian's "games" section
|
|
||||||
|
|
||||||
/json/packages
|
|
||||||
* Return a JSON data structure of all packages
|
|
||||||
|
|
||||||
/json/screenshots
|
|
||||||
* Return a JSON data structure containing packages and screenshots
|
|
||||||
|
|
||||||
/json/packages-without-screenshots
|
|
||||||
* Return a JSON data structure of those packages that do not have any screenshots
|
|
||||||
|
|
||||||
/packages/moderate
|
|
||||||
* Return a HTML page showing packages that need moderation
|
|
||||||
* Must only be available to logged in moderators
|
|
||||||
|
|
||||||
/upload
|
|
||||||
* Return a HTML page containing an upload form for new screenshots
|
|
||||||
|
|
||||||
/guidelines (deprecated)
|
|
||||||
* Return a HTML page showing general guidelines for creating screenshots
|
|
||||||
* Should just redirect to the /upload page
|
|
||||||
|
|
||||||
/upload/:package
|
|
||||||
* ??
|
|
||||||
|
|
||||||
/uploadfile
|
|
||||||
* ??
|
|
||||||
|
|
||||||
/login
|
|
||||||
* Show a login form
|
|
||||||
|
|
||||||
/logout
|
|
||||||
* Logout the user by invalidating the cookie session.
|
|
||||||
|
|
||||||
/package/:package
|
|
||||||
* Show details of a certain package
|
|
||||||
|
|
||||||
/json/package/:package
|
|
||||||
* Return a JSON data structure containing details of a certain package
|
|
||||||
|
|
||||||
/thumbnail/:package
|
|
||||||
/thumbnail-404/:package (deprecated)
|
|
||||||
* Return a small (160x120 pixel) PNG screenshot file of a package
|
|
||||||
* If the package does not have any screenshots then return a 404 code
|
|
||||||
|
|
||||||
/thumbnail-with-version/:package/:version
|
|
||||||
* Return a small (160x120 pixel) PNG screenshot file of a package
|
|
||||||
* If the package does not have any screenshots then return a 404 code
|
|
||||||
* Prefer screenshots of a certain version
|
|
||||||
|
|
||||||
/screenshot/:package
|
|
||||||
/screenshot-404/:package (deprecated)
|
|
||||||
* Return a large (320x240 pixel) PNG screenshot file of a package
|
|
||||||
* If the package does not have any screenshots then return a 404 code
|
|
||||||
|
|
||||||
/screenshot-with-version/:package/:version
|
|
||||||
* Return a large (320x240 pixel) PNG screenshot file of a package
|
|
||||||
* If the package does not have any screenshots then return a 404 code
|
|
||||||
* Prefer screenshots of a certain version
|
|
||||||
|
|
||||||
/delete_screenshot/:screenshot
|
|
||||||
* Users: request deletion of a screenshot
|
|
||||||
* Moderators: delete a screenshot
|
|
||||||
|
|
||||||
/approve_screenshot/:screenshot
|
|
||||||
* Users: 403
|
|
||||||
* Moderators: approve a screenshot
|
|
||||||
|
|
||||||
/keep_screenshot/:screenshot
|
|
||||||
* Users: 403
|
|
||||||
* Moderators: re-approve a screenshot that was requested for deletion
|
|
||||||
|
|
||||||
== Cron jobs
|
|
||||||
|
|
||||||
Parse Nginx access logs to count the number of visits of each package:
|
|
||||||
|
|
||||||
RAILS_ENV=production bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
|
|
||||||
|
|
||||||
As a cron job:
|
|
||||||
|
|
||||||
41 9 * * * cd $HOME/debshots ; RAILS_ENV=production /home/debshots/.rbenv/shims/bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
|
|
||||||
|
|
|
||||||
|
|
@ -1,75 +0,0 @@
|
||||||
-----BEGIN X509 CRL-----
|
|
||||||
MIINnjCCDIYwDQYJKoZIhvcNAQELBQAwRDEaMBgGA1UEAxMRU1NPIENBIDIwMTUt
|
|
||||||
MDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xpZW50IGNlcnRpZmljYXRlFw0x
|
|
||||||
NzA0MjIxNDU1MDJaFw0xNzA0MjUxNDU1MDJaMIIMDzATAgIQABcNMTUwODIxMjEy
|
|
||||||
NTI4WjATAgIQARcNMTUwODIxMjA1MDUxWjATAgIQAhcNMTUwODIxMjEwNjQ3WjAT
|
|
||||||
AgIQAxcNMTUwODIxMjEwNjQ5WjATAgIQBBcNMTUwODI0MTMwMjQyWjATAgIQBRcN
|
|
||||||
MTUwODIxMjEyNTMzWjATAgIQERcNMTYwMzE0MTQxMTAzWjATAgIQEhcNMTUwODI2
|
|
||||||
MTExODUwWjATAgIQFRcNMTYwNTE1MDE0OTA1WjATAgIQFhcNMTYwMzIzMjMyNTE3
|
|
||||||
WjATAgIQIBcNMTUwODI0MTMwMjQ0WjATAgIQIRcNMTUwODI0MTMwMjQ2WjATAgIQ
|
|
||||||
IhcNMTUwODI0MTMwMjQ2WjATAgIQIxcNMTUwODI0MTMwMzQ2WjATAgIQJRcNMTUx
|
|
||||||
MjE2MjAyMjM5WjATAgIQKBcNMTUwODI1MTUwODA3WjATAgIQMRcNMTUwODI2MTMz
|
|
||||||
ODQ4WjATAgIQNBcNMTUwODI2MTUyODE4WjATAgIQQRcNMTUxMjE2MTI1ODE0WjAT
|
|
||||||
AgIQRxcNMTUwODI4MDgxNDQ0WjATAgIQUBcNMTUwOTAxMDc1MjMxWjATAgIQURcN
|
|
||||||
MTUwOTAxMDc1MjM4WjATAgIQWxcNMTYwODE3MTcxNjM4WjATAgIQYhcNMTUwODI4
|
|
||||||
MTM1NjI4WjATAgIQcBcNMTUwOTE0MTIyNzUwWjATAgIQehcNMTYwNjIwMDkwNDE1
|
|
||||||
WjATAgIQjhcNMTYwMTEwMDEwNTEwWjATAgIQnBcNMTUxMTI1MTQ0NDI5WjATAgIQ
|
|
||||||
qBcNMTUwOTAyMTU0OTAxWjATAgIQvRcNMTUxMjA5MTM0NzQyWjATAgIQyhcNMTYw
|
|
||||||
NDA2MDkyNjI3WjATAgIQzxcNMTUxMDEyMDc1ODMxWjATAgIQ1RcNMTUxMDE5MTQ0
|
|
||||||
MjIwWjATAgIQ1hcNMTYwNDA0MDgwMTUxWjATAgIQ6RcNMTYwODE3MTcxNjQwWjAT
|
|
||||||
AgIQ9BcNMTUxMTE3MTQxMzI1WjATAgIQ+RcNMTUxMTIwMTM0OTA2WjATAgIREBcN
|
|
||||||
MTYwMjA1MjEyODAxWjATAgIREhcNMTYwMzE4MjMwMjAyWjATAgIRExcNMTYwNjEx
|
|
||||||
MjI0ODI2WjATAgIRGRcNMTYxMjEwMTUzMzE3WjATAgIRHhcNMTYwNDA5MjAwODM1
|
|
||||||
WjATAgIRHxcNMTYwNDA5MjAwODM5WjATAgIRJhcNMTUxMjE3MTYyNzM1WjATAgIR
|
|
||||||
JxcNMTYwNzA3MTA1MTMzWjATAgIRKxcNMTYwNjIwMDkwNDE3WjATAgIROBcNMTYw
|
|
||||||
ODE3MTcxNjQzWjATAgIRRBcNMTYxMDIwMDc0NjAzWjATAgIRSBcNMTYwMTIwMjAw
|
|
||||||
MjEzWjATAgIRbRcNMTYwMjEzMTgzODI2WjATAgIRchcNMTYxMjEwMTUzMzE1WjAT
|
|
||||||
AgIRcxcNMTYxMDA5MTcwMjIxWjATAgIRexcNMTYwMjI5MjMyNjU1WjATAgIRiRcN
|
|
||||||
MTYwNzA3MTA1MTMxWjATAgIRixcNMTYwMzE0MTQxMTA4WjATAgIRkRcNMTYwNjIw
|
|
||||||
MDkwNDE5WjATAgIRkhcNMTYwMzE0MTQxMTA2WjATAgIRlRcNMTcwMTE4MTYwMDI2
|
|
||||||
WjATAgIRnxcNMTYxMDAzMjAwNjMzWjATAgIRohcNMTYwMzE4MTQwNjE5WjATAgIR
|
|
||||||
thcNMTYwMzE5MTUzNzQ3WjATAgIRuRcNMTYwMzE5MTYyMjQzWjATAgIRwhcNMTYw
|
|
||||||
MzIwMTE1MzAzWjATAgIRwxcNMTYwNTExMjI1ODE1WjATAgIRzxcNMTYwMzI0MDEx
|
|
||||||
MzMyWjATAgIR0RcNMTcwMjA3MTk1ODI5WjATAgIR5BcNMTYwNzAyMTUxNTMzWjAT
|
|
||||||
AgIR5xcNMTYwODE4MTUzMDUzWjATAgIR6hcNMTYwMzI5MTYyMDMzWjATAgIR7xcN
|
|
||||||
MTcwMzIyMjM0MTM5WjATAgIR9RcNMTYwMzI3MDgwMzI0WjATAgIR/BcNMTYwNTI0
|
|
||||||
MjA1MDE4WjATAgIR/xcNMTYwNTA0MTk1NDMzWjATAgISFhcNMTcwMjE2MjEyODE5
|
|
||||||
WjATAgISIRcNMTYwNDA4MDkyMjEwWjATAgISIhcNMTYwNDA4MDkyMjEyWjATAgIS
|
|
||||||
IxcNMTYwNDA4MDkyMjE1WjATAgISJBcNMTYwNDA4MDkyMjE3WjATAgISKBcNMTYw
|
|
||||||
NTAyMDU1MDAyWjATAgISMhcNMTYwNDA5MjAyOTU3WjATAgISPRcNMTYwNDEwMTkx
|
|
||||||
MjA3WjATAgISShcNMTYxMjEwMTUzMzE0WjATAgISUhcNMTYwNDIxMTYwNDU2WjAT
|
|
||||||
AgISYhcNMTcwNDE5MDY1MDQ4WjATAgISbhcNMTYwNTE0MDE0MzEyWjATAgIScBcN
|
|
||||||
MTYwNTEzMjIyOTMyWjATAgIScRcNMTYwNTEzMjIyOTM2WjATAgIScxcNMTYwNTE0
|
|
||||||
MDE0MzE4WjATAgISgRcNMTYwNjMwMTUwMjU1WjATAgIShRcNMTYxMDAzMjAwNjI0
|
|
||||||
WjATAgISqBcNMTYwNjA4MTQ0NTEzWjATAgISrRcNMTYwNjExMjMwNjA4WjATAgIS
|
|
||||||
sRcNMTcwMzIyMjM0MTQ3WjATAgISsxcNMTYwNjIwMTM1MDAyWjATAgIStBcNMTYw
|
|
||||||
NjIwMTM1MDAwWjATAgIStRcNMTYwNjIwMTM0OTU4WjATAgISwRcNMTYxMTIyMTIx
|
|
||||||
NDAzWjATAgIS5BcNMTYwOTI5MTczMTA4WjATAgIS5RcNMTYwOTI5MTczMDUzWjAT
|
|
||||||
AgITBRcNMTcwNDEzMDE1NDM0WjATAgITHxcNMTYwOTA4MDg1MDIzWjATAgITIBcN
|
|
||||||
MTcwMTA2MjExMDU3WjATAgITIxcNMTYxMTMwMTAzOTI1WjATAgITPBcNMTYwOTI5
|
|
||||||
MTc0NzI3WjATAgITQhcNMTYwOTI5MTczNTQ1WjATAgITThcNMTYxMDA5MjA0NTQy
|
|
||||||
WjATAgITTxcNMTYxMDA5MTcxMjIxWjATAgITVRcNMTYxMDEyMTQwMDIwWjATAgIT
|
|
||||||
XBcNMTYxMjI4MTg0NzMxWjATAgITXRcNMTYxMDE2MTU1NzM2WjATAgITYxcNMTYx
|
|
||||||
MDE4MTcwNzE0WjATAgITaxcNMTcwNDE3MTA1MTIxWjATAgITbhcNMTYxMjE4MTYw
|
|
||||||
NTI0WjATAgITchcNMTYxMDI0MjA1MjU3WjATAgITfhcNMTcwMTE3MTAzMzMzWjAT
|
|
||||||
AgITghcNMTYxMDMwMTgzODQyWjATAgIThxcNMTYxMDMxMjE0NzUyWjATAgITiBcN
|
|
||||||
MTYxMDMxMjE0MzE4WjATAgITixcNMTYxMTAyMTkyOTIxWjATAgITmBcNMTYxMTA4
|
|
||||||
MTkyODE2WjATAgITmRcNMTYxMTA4MTkzNTExWjATAgITmhcNMTYxMTA4MTkzNTEy
|
|
||||||
WjATAgITnRcNMTcwMTA2MjExMDU2WjATAgITpRcNMTYxMTEwMjE1NjA5WjATAgIT
|
|
||||||
phcNMTYxMTEwMjIxODE1WjATAgITuxcNMTcwMTAxMTAwNDQxWjATAgIT5hcNMTcw
|
|
||||||
MTA2MjExMDU1WjATAgIT6BcNMTcwNDIyMTQxMzUzWjATAgIT8xcNMTYxMjIxMjEz
|
|
||||||
MjQ0WjATAgIT+BcNMTYxMjIzMjIzNTQ0WjATAgIT+RcNMTYxMjIzMjIzNTQzWjAT
|
|
||||||
AgIUABcNMTYxMjMwMDA1NjM2WjATAgIUCBcNMTcwMTEwMDk1MzQwWjATAgIUERcN
|
|
||||||
MTcwMTA0MTMzMjI1WjATAgIUEhcNMTcwMTA0MTMzMzU3WjATAgIUExcNMTcwMTA0
|
|
||||||
MTMzODI2WjATAgIURRcNMTcwMjA1MTYxNTE0WjATAgIURhcNMTcwMjA1MTYyMDIy
|
|
||||||
WjATAgIUXxcNMTcwMjEzMTYyMzQ5WjATAgIUbBcNMTcwMjI0MDc0MTU4WjATAgIU
|
|
||||||
fxcNMTcwMzA5MTAxNTI2WjATAgIUhxcNMTcwMzE1MDczNzE3WjATAgIUtxcNMTcw
|
|
||||||
MzMwMTcxODQxWjATAgIUuBcNMTcwMzMwMTcxODI5WjATAgIUuRcNMTcwMzMwMTcy
|
|
||||||
MDIzWjATAgIU4hcNMTcwNDEzMDc1MDE3WjATAgIVLBcNMTcwNDIyMTQ1NTAyWjAN
|
|
||||||
BgkqhkiG9w0BAQsFAAOCAQEAuSmMXKr6dqDRi149DwlVFYBz8mskPPr61EzJKoYk
|
|
||||||
K4rAGBzlY7Ekcz57h881KxCFv7aFGmKA8DdnAOga4lr7/4c1tuoGTqqKDaS5/oOf
|
|
||||||
jgf7koLMWt9uqx6f5w491XkJqVCKXETfxUwpxRclyTFgcUWchTHnBEH98K/jrYG4
|
|
||||||
WcqN2Xi2pxAaLM8V7E0CN9TETKRRO3WlbGfGMP8SqqHyOVRQBOuFQpaPyFSf+AXe
|
|
||||||
vRN4jih1Zfvg7WttKrjq+s04dPXM6nzUGnc9UeBHAif2FHY/qaT3mgw7ou22yS17
|
|
||||||
E7KTGCnXjoLg+g9e+A2vBXzjHhm1u/GAwMZVzzGGfRdi9g==
|
|
||||||
-----END X509 CRL-----
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIDlzCCAn+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBEMRowGAYDVQQDExFTU08g
|
|
||||||
Q0EgMjAxNS0wOC0yMTEmMCQGA1UEChMdRGViaWFuIFNTTyBjbGllbnQgY2VydGlm
|
|
||||||
aWNhdGUwIhgPMjAxNTA4MjEyMDQzMzVaGA85OTk5MTIzMTIzNTk1OVowRDEaMBgG
|
|
||||||
A1UEAxMRU1NPIENBIDIwMTUtMDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xp
|
|
||||||
ZW50IGNlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
|
|
||||||
1SUMNiEVMlycwDPlJhgJ099VorLDTW556XvbWSw8l7cnygs8V9bN83f6W2P8x328
|
|
||||||
dz+U1OxEZ/PnS+/zMwco03XQggXcNN+UjHwUu9WP5koNsPFH6HRbvUy5oBDfbdVN
|
|
||||||
EzBE2gXE4WYFoj45U9rSU6qLEnT4QKxJ/CbTeMGvLKzuXdCv6W+UxUfbh186kSqM
|
|
||||||
tfDtY3aQ+L6MuPA1a+bumUh9EGVZrrIMbjgm1xrQohQBJC75X10dnicUliGZ+7C0
|
|
||||||
h7pUQlIY+/IxREQ46xBY1CNYeZNMEI9ErMbiFiShsc3mP3aLxTAQ4KzHCDtIuzwD
|
|
||||||
ElH8aMPxIQOUyL/FLx8ZTQIDAQABo4GPMIGMMA8GA1UdEwEB/wQFMAMBAf8wEwYD
|
|
||||||
VR0lBAwwCgYIKwYBBQUHAwkwDwYDVR0PAQH/BAUDAwcGADAdBgNVHQ4EFgQU0OJ+
|
|
||||||
JoHgzarLNF+2eiay11GCk44wNAYDVR0fBC0wKzApoCegJYYjaHR0cHM6Ly9zc28u
|
|
||||||
ZGViaWFuLm9yZy9zcGthYy9jYS5jcmwwDQYJKoZIhvcNAQELBQADggEBAKynxkRr
|
|
||||||
7w85LHYzH5q9xVHXX6+K6r1mA3b+OAopNMJZTCTn7v9UVDncp26wOeHOUEvawWaQ
|
|
||||||
21HBd70CiFH0XGDow0/K68ite/0RHxq1WAuggBc678d/0yDkoWdFHAf9n5Agzf4J
|
|
||||||
rXov++XmBXYHRXiHunuSLnM3i8HToejZMCC7P9nqpPo0tK7O22calbZn20Pdve6k
|
|
||||||
KrKxwwjxpuNxezr6uYGuNTLJOZtyjF09FuAebSlHvX6VYPl7FnMUDcS6QerEyocL
|
|
||||||
Bv7pbsNWehIfvfjqPJQwqznieieZGL6s1zB8/XWQw37C0i28LqJ8DTvEjgmF44RP
|
|
||||||
6JhTYDnI06pKfQY=
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
-----BEGIN DH PARAMETERS-----
|
|
||||||
MIIBCAKCAQEA8kUEh2+7OSDG3BQ22cJBlBM0jp+AWW8Wa64J0hE/gQaR8jw9VSQW
|
|
||||||
a+WBaDQ+FAcxOmAeVvrX4owvBocHBcVPmU4NEnkWe77qsCG56wEJWco+DgN3cq43
|
|
||||||
SYbhI3s2HNQwLCzUYLAMZVXcUDH4Nn3cRTTl3ZNpB99XhAio20frNpGQrQeUb0Of
|
|
||||||
dDj3QpLL1k09b+OVnAh+3KFHawrjzzyFf9pZMsrmK/wZR5SSds1TTisHjVaJe4zN
|
|
||||||
dcOfvQr5dUHl1mvwxYPnpbXmXdlDmdBU6/HCqkXpUcfl18bhwKG1UT7wmWuInizT
|
|
||||||
AsNFRK393l5eqlE+AFvWZpacMGGMGJhd+wIBAg==
|
|
||||||
-----END DH PARAMETERS-----
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIFhTCCA22gAwIBAgIJAJdnIw1IRbAAMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV
|
|
||||||
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
|
|
||||||
aWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xNzA0MjIxNTI3
|
|
||||||
MTlaFw0yNzA0MjAxNTI3MTlaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21l
|
|
||||||
LVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNV
|
|
||||||
BAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ8c
|
|
||||||
28eoDXVGRYtXPMHa7L3v4pCdJQQthpiVULT108yDGHfCc8XJkjFqrk2GBH8Pvsk7
|
|
||||||
a9us/aad5G+6dQ+a6w8QG1U4grYyaO28QhSSy7ZP1l7rl5XAmYlU5aFVPPgJEnlT
|
|
||||||
QGc1lArEJH0mDREdagwNzD03NsWYGUOkdTgldQxO1zTmJWTr77/StP0fFYAff8Sb
|
|
||||||
gYoKEM1ZN0mNgt3Ts9tO7UZmEvglMvWa3OS8mJsrkBiU2yqou+R4sevdyC3TBFE3
|
|
||||||
yawahizt69NGR21LzBmlBewQwQ9eXmT8qPiRGplo1Rb4+UB6sMsESQDzCkyH09p0
|
|
||||||
T0fGoAXQrkthZRTsH6LAhR6nQzopuw7ZsyMNAjWQ5ksKED0tmbVGBKmXCz3CWetO
|
|
||||||
qu25mnNV9P/X+5Rl3vUXOpBcZOZYzG2lM4PmsYWpH40l0tbcBGvB1/nxT4+Ztqf4
|
|
||||||
+9LB0/bROYnBXoEAa8x1kXqiptk3pAko+U0AsQch26bF8sKKCZk+0aWiC7PXE5O6
|
|
||||||
2k9pPnA4fE+fmPPcYQQQXZ4D31afxQsGdbqklWNT2QdzVUyveL0tqDVSZMiTSK5j
|
|
||||||
sc5kEjLSfPoR0xgiFF/y81pzKWJwvI7DDI8q5ggWklrTqroms+riCLE+ko4ClLRa
|
|
||||||
ETc/iNGSQeMZD7xauqUuv8hGdtpyaVj12OZvWzarAgMBAAGjUDBOMB0GA1UdDgQW
|
|
||||||
BBQH5Z7WecoPmPYfrDvc/kYnUDxo3TAfBgNVHSMEGDAWgBQH5Z7WecoPmPYfrDvc
|
|
||||||
/kYnUDxo3TAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQA6kFmAEcQw
|
|
||||||
JMM02H1MM3RHBr0ZWDo6wSAT72kdLZnhOTdbCRiQ1Fm9dltNEuHHJIKhdWykCMjy
|
|
||||||
1uULsukBPDjomO8cB+K2vA4HAWcKtg64NnnVNFK70ZIdazwfYPwqddykgE6uWHc6
|
|
||||||
nQskGD3B+zQwartpThHvmw0V5HccIKoiHIy7qD9g8P+ovRg+6l+kaBELQiFUxDGm
|
|
||||||
lIxK2VgrYWxKoT3IBp1C5yNKJORc6Hc0m6r/Uf8uA3oLGkjvAmoY41lr/7ThIo8/
|
|
||||||
gd/Vk4EXjMdwfevIhHbjC2s2dxrV94f+TI54y9UPo4dOZJ9DMtmwvE2sTm1ROJfr
|
|
||||||
Wvufx0OUzMY0iGO2YEAglhk1NTf0ryyNh5sNWVx2YYaiRrzEmrtE3xYILBHyr4rF
|
|
||||||
dYWOg3IbXzVdL2oUsYrZwUtO35zw0ewuFKAnOO53N2+I3q2abq/jKvojACB6v+lf
|
|
||||||
k60Q8d07iBhkDrk1NI71SDyxSMrYqYxobI7AenFb196+9q3s1dS3ddIFiS8JL1le
|
|
||||||
JjvKo2HdQ64Yz/1qpgjAQD8xptSdwy4IPaef6kpMHylQ+V7BxwhGy6pZnKoXP6qE
|
|
||||||
VliHUJUzy4Dn4IgNLTx3MXLBObb6H63JqZE6DpfoKrNPAaL2zy9xv6ELkUPTsGVr
|
|
||||||
F/a83GfM+wAzDJB50cfuaOOR+QvCTdy0pg==
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
|
|
@ -1,52 +0,0 @@
|
||||||
-----BEGIN PRIVATE KEY-----
|
|
||||||
MIIJQAIBADANBgkqhkiG9w0BAQEFAASCCSowggkmAgEAAoICAQCfHNvHqA11RkWL
|
|
||||||
VzzB2uy97+KQnSUELYaYlVC09dPMgxh3wnPFyZIxaq5NhgR/D77JO2vbrP2mneRv
|
|
||||||
unUPmusPEBtVOIK2MmjtvEIUksu2T9Ze65eVwJmJVOWhVTz4CRJ5U0BnNZQKxCR9
|
|
||||||
Jg0RHWoMDcw9NzbFmBlDpHU4JXUMTtc05iVk6++/0rT9HxWAH3/Em4GKChDNWTdJ
|
|
||||||
jYLd07PbTu1GZhL4JTL1mtzkvJibK5AYlNsqqLvkeLHr3cgt0wRRN8msGoYs7evT
|
|
||||||
RkdtS8wZpQXsEMEPXl5k/Kj4kRqZaNUW+PlAerDLBEkA8wpMh9PadE9HxqAF0K5L
|
|
||||||
YWUU7B+iwIUep0M6KbsO2bMjDQI1kOZLChA9LZm1RgSplws9wlnrTqrtuZpzVfT/
|
|
||||||
1/uUZd71FzqQXGTmWMxtpTOD5rGFqR+NJdLW3ARrwdf58U+Pmban+PvSwdP20TmJ
|
|
||||||
wV6BAGvMdZF6oqbZN6QJKPlNALEHIdumxfLCigmZPtGloguz1xOTutpPaT5wOHxP
|
|
||||||
n5jz3GEEEF2eA99Wn8ULBnW6pJVjU9kHc1VMr3i9Lag1UmTIk0iuY7HOZBIy0nz6
|
|
||||||
EdMYIhRf8vNacylicLyOwwyPKuYIFpJa06q6JrPq4gixPpKOApS0WhE3P4jRkkHj
|
|
||||||
GQ+8WrqlLr/IRnbacmlY9djmb1s2qwIDAQABAoICACAEqqVux+aFkZEMqQlJiMJf
|
|
||||||
93Oqa7x/fMpPocIIheptpwrScoGmomiXUyP+iAEZpgbQkk/Oa+yPcVyaZNwTDKIn
|
|
||||||
V5i6mnMXic3tSE7ji2LQhg7r0cEs1LiyANOKV46CJNmNSzR5r6TK+5zDf3WmOaTb
|
|
||||||
UfIvnjH8/XiDK6N0xi0H4H6goX3BjKlJOWqGSslRjWB++n5QsDjibyG5/E+vPk4v
|
|
||||||
f8fe2opc0fhihXjyCrOO/Jw1uDTJZ6X+M6+HHbU69W9yjn63h7Ca4A3P4qe3zQaM
|
|
||||||
ErkCVhdFojEoNshuSq/8TIUm7OFwzwrLffVW8webfaJELYAAFEuXRrucib7AFU1V
|
|
||||||
uNgNP8ul0dSCyRjzxuXO2ar9dTAv9qcYvi1sLEkpl7dqdNwf3Lg2sfcvDv5C/c3h
|
|
||||||
TRJOMX3ciMfc59ZJlMB78K5c1LqQWMsOQUL8i6lFtf4BcRJItCgtSTvyTe7Wc5oZ
|
|
||||||
LXRS+EUj75EcnjYxUtHLkVwAC9eNrmpIYre/ng2fSs293BDEPE9oSD6Yw7xj3V8b
|
|
||||||
FdMCGM5/rFn0c5L52fNEL8JUzqfK6Dfu0f5Ox1tpVHT7Tlf6Di13ViZnsZ96lCS7
|
|
||||||
QUV0MGR0o86djDFR6YIQhHvdAgbIrdzvImyYozcxx8x5GuMExSmyE6cFvknbWi8N
|
|
||||||
C8YudEbHY0moquO2VothAoIBAQDOfzAYkKuy3D2MZcS9vYR+nMQtMBVEi0CpFRwy
|
|
||||||
APME2+jD1zqXvemqe7YQifWHlhnaUfX8yRVoA00DUZHt+wRSn+SJWc93ZLnPqgpJ
|
|
||||||
KsByWSxey9JFSUIdQvuA8zsLmoQ+GMbXQbby52kc7l5BmM6baWF20wqyUU/29UYJ
|
|
||||||
iKm7MuLnKI5Y3FSJwbKJDB2Dlhhh0ckCovyN+XeLW6F0JnBTb0l7Dy4YxtAXco1i
|
|
||||||
9cMZ8+drDsA/B5L4O5xYtTvrtCLEswR+1w83MqjYq/m1ydY1XG1r4DdzGWHKEADj
|
|
||||||
k+dzNYbpnNiAnf9d4IrOjS8luc1KQaEjlEp+TiP6IefZ1XM/AoIBAQDFQa9j6tUr
|
|
||||||
NtLD6iQ2lGdZ4yc4Lyr+boW0+zwhiEk6fFwan2TF6WzzuGDR9iMjnxrFHuKtLmlS
|
|
||||||
Ljcd95/LTvZqRp8b6HaPzsKokIXeDn1JsvoZY9/+8LdQoERDfQg4Uo12S8soZ2Iq
|
|
||||||
3epF+uIFgA0TFI9bPWMF9XjmtLGLgoyvFj8jylErdf4WeKLQd8XQ4JqcNCDxyagY
|
|
||||||
Qx6vZ+lA9D8NtaGeL1uCvVzWqFFYOVNDIvYHjuGRZNvYAtO1sxzPbJkgKI/th8+Y
|
|
||||||
G1gbZS/a7V/iey42D4rNSsLrubkR7uRFAZHlZwM1F2t+Rf32FTu5Y7fW7W9huxgS
|
|
||||||
+CsLnyZQrx2VAoH/PuqBvPpXVifEmQJo72bO98TMAPilgjzrdpj3/kRLxy85vHHX
|
|
||||||
aGR0zXzj/CYMqUMSnXJbgKnD2+0lid1QmTHiH0qYV0EF9Vq7QoqMl75u5GhHHJr9
|
|
||||||
dh7cBg5ikueJFf/+Su1BqFRdaaUYYbg+/72PNcrl505l8+7SbmxM6pq5HFBk0gmJ
|
|
||||||
VYnMOCzMOPV4CJ+yzhsdI7CFQry/r7Y7eyg7ETDXMqdtZB8vR/WfHofC6iVmXTgh
|
|
||||||
WxLztK509JJDr40zCruAoyTjfe3xhBLiAoF8wsVmkXe/bVJOeUJnAvANlQy6DnO7
|
|
||||||
g3SgWfoQUN6zfssdwYI9lpmYGOO2EoBCJBzlAoIBAQCXOhiA/dSX4NwNH0DMJ1Jk
|
|
||||||
82VqCZ9omMshSUt8WcPqdtUWBAV6Rc8lusFfttiRwrT/UwJtyxsrygqvityTPeJk
|
|
||||||
7+ejucDL17QdD0/SQkGDcxeSx6M/DMU9puEu7HiU1ZVmkA0c2MXGH4QwSntlxBpB
|
|
||||||
+o09Yf683sjl9rn3PwskYGXfxogcTcWS7MHGGU0rKkbeYoivVe7tSugHih6lkZuV
|
|
||||||
ox5Y6+24efznBPv4K1rOKct9V+lPUofJP8GXl84KqDNtGCvf6zMYZj5SIm1h5oKQ
|
|
||||||
W+e9woSjhyGRHz3npcKTtPRpb2RiG6ZplLdzJiw3oV+cA0RVJN78DA7URhtV2CtR
|
|
||||||
AoIBAHkflDjX9FICWvxo3jJkHWm4OKULXqT4nVsP3ua9uGsLCxDFneivKdj3kJjI
|
|
||||||
iZh3HHzXybeoGyt8jCBKDIjugbnGDaaW4zQOIeN5afsUIyDppRtCspoBD48Hy7g6
|
|
||||||
9tjg6Ko0iHPONayhsxegchltPhplBlGVnPnzE5/n+FMCyj1LnNOq81VhaSS6t/AW
|
|
||||||
hgTxz2QzdDsWIxBiJ6KJoXIOBWpHu1sudHgGmpQo6w3yyLYhCJXHyMP9oUi7fBEm
|
|
||||||
w+DjxmiNCPPWVs+EmL6MiEmqp/Pd0v0wpUOARV2Bnr62OMNyIXNebPpGqlBHPxFW
|
|
||||||
iD5mKOq6Z4Rivbd2DN+0aIoCgWI=
|
|
||||||
-----END PRIVATE KEY-----
|
|
||||||
|
|
@ -1,89 +0,0 @@
|
||||||
|
|
||||||
types {
|
|
||||||
text/html html htm shtml;
|
|
||||||
text/css css;
|
|
||||||
text/xml xml;
|
|
||||||
image/gif gif;
|
|
||||||
image/jpeg jpeg jpg;
|
|
||||||
application/javascript js;
|
|
||||||
application/atom+xml atom;
|
|
||||||
application/rss+xml rss;
|
|
||||||
|
|
||||||
text/mathml mml;
|
|
||||||
text/plain txt;
|
|
||||||
text/vnd.sun.j2me.app-descriptor jad;
|
|
||||||
text/vnd.wap.wml wml;
|
|
||||||
text/x-component htc;
|
|
||||||
|
|
||||||
image/png png;
|
|
||||||
image/tiff tif tiff;
|
|
||||||
image/vnd.wap.wbmp wbmp;
|
|
||||||
image/x-icon ico;
|
|
||||||
image/x-jng jng;
|
|
||||||
image/x-ms-bmp bmp;
|
|
||||||
image/svg+xml svg svgz;
|
|
||||||
image/webp webp;
|
|
||||||
|
|
||||||
application/font-woff woff;
|
|
||||||
application/java-archive jar war ear;
|
|
||||||
application/json json;
|
|
||||||
application/mac-binhex40 hqx;
|
|
||||||
application/msword doc;
|
|
||||||
application/pdf pdf;
|
|
||||||
application/postscript ps eps ai;
|
|
||||||
application/rtf rtf;
|
|
||||||
application/vnd.apple.mpegurl m3u8;
|
|
||||||
application/vnd.ms-excel xls;
|
|
||||||
application/vnd.ms-fontobject eot;
|
|
||||||
application/vnd.ms-powerpoint ppt;
|
|
||||||
application/vnd.wap.wmlc wmlc;
|
|
||||||
application/vnd.google-earth.kml+xml kml;
|
|
||||||
application/vnd.google-earth.kmz kmz;
|
|
||||||
application/x-7z-compressed 7z;
|
|
||||||
application/x-cocoa cco;
|
|
||||||
application/x-java-archive-diff jardiff;
|
|
||||||
application/x-java-jnlp-file jnlp;
|
|
||||||
application/x-makeself run;
|
|
||||||
application/x-perl pl pm;
|
|
||||||
application/x-pilot prc pdb;
|
|
||||||
application/x-rar-compressed rar;
|
|
||||||
application/x-redhat-package-manager rpm;
|
|
||||||
application/x-sea sea;
|
|
||||||
application/x-shockwave-flash swf;
|
|
||||||
application/x-stuffit sit;
|
|
||||||
application/x-tcl tcl tk;
|
|
||||||
application/x-x509-ca-cert der pem crt;
|
|
||||||
application/x-xpinstall xpi;
|
|
||||||
application/xhtml+xml xhtml;
|
|
||||||
application/xspf+xml xspf;
|
|
||||||
application/zip zip;
|
|
||||||
|
|
||||||
application/octet-stream bin exe dll;
|
|
||||||
application/octet-stream deb;
|
|
||||||
application/octet-stream dmg;
|
|
||||||
application/octet-stream iso img;
|
|
||||||
application/octet-stream msi msp msm;
|
|
||||||
|
|
||||||
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
|
|
||||||
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
|
|
||||||
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
|
|
||||||
|
|
||||||
audio/midi mid midi kar;
|
|
||||||
audio/mpeg mp3;
|
|
||||||
audio/ogg ogg;
|
|
||||||
audio/x-m4a m4a;
|
|
||||||
audio/x-realaudio ra;
|
|
||||||
|
|
||||||
video/3gpp 3gpp 3gp;
|
|
||||||
video/mp2t ts;
|
|
||||||
video/mp4 mp4;
|
|
||||||
video/mpeg mpeg mpg;
|
|
||||||
video/quicktime mov;
|
|
||||||
video/webm webm;
|
|
||||||
video/x-flv flv;
|
|
||||||
video/x-m4v m4v;
|
|
||||||
video/x-mng mng;
|
|
||||||
video/x-ms-asf asx asf;
|
|
||||||
video/x-ms-wmv wmv;
|
|
||||||
video/x-msvideo avi;
|
|
||||||
}
|
|
||||||
|
|
@ -1,119 +0,0 @@
|
||||||
#user www-data;
|
|
||||||
#worker_processes 4;
|
|
||||||
pid /tmp/nginx.pid;
|
|
||||||
error_log /tmp/error-foo;
|
|
||||||
|
|
||||||
#events {
|
|
||||||
# worker_connections 768;
|
|
||||||
#}
|
|
||||||
|
|
||||||
http {
|
|
||||||
sendfile on;
|
|
||||||
tcp_nopush on;
|
|
||||||
tcp_nodelay on;
|
|
||||||
keepalive_timeout 20;
|
|
||||||
types_hash_max_size 2048;
|
|
||||||
|
|
||||||
include mime.types;
|
|
||||||
default_type application/octet-stream;
|
|
||||||
|
|
||||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
|
||||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
|
|
||||||
ssl_dhparam dhparams.pem;
|
|
||||||
|
|
||||||
ssl_prefer_server_ciphers on;
|
|
||||||
ssl_session_cache shared:SSL:20m;
|
|
||||||
ssl_session_timeout 180m;
|
|
||||||
|
|
||||||
##
|
|
||||||
# Logging Settings
|
|
||||||
##
|
|
||||||
|
|
||||||
access_log /tmp/access-main;
|
|
||||||
error_log /tmp/error-main;
|
|
||||||
|
|
||||||
##
|
|
||||||
# Gzip Settings
|
|
||||||
##
|
|
||||||
|
|
||||||
gzip on;
|
|
||||||
|
|
||||||
##
|
|
||||||
# Phusion Passenger config
|
|
||||||
##
|
|
||||||
# Uncomment it if you installed passenger or passenger-enterprise
|
|
||||||
##
|
|
||||||
|
|
||||||
#passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini;
|
|
||||||
#passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby;
|
|
||||||
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen *:8000 default_server;
|
|
||||||
listen *:8443 ssl;
|
|
||||||
ssl_certificate screenshots.debian.net.crt;
|
|
||||||
ssl_certificate_key screenshots.debian.net.key;
|
|
||||||
ssl_client_certificate debsso.crt;
|
|
||||||
ssl_crl debsso.crl;
|
|
||||||
ssl_verify_client optional;
|
|
||||||
ssl_verify_depth 1;
|
|
||||||
|
|
||||||
root ../public;
|
|
||||||
server_name _;
|
|
||||||
access_log /tmp/access-front;
|
|
||||||
error_log /tmp/error-front;
|
|
||||||
|
|
||||||
# Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite
|
|
||||||
# redirection loop because the backend assumes that HTTP was spoken behind the
|
|
||||||
# proxy.
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
|
|
||||||
# Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
|
|
||||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
|
||||||
gzip_proxied any;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
try_files /maintenance.html @backend;
|
|
||||||
add_header X-Coffee main;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /json/ {
|
|
||||||
try_files /maintenance.html @backend;
|
|
||||||
add_header X-Coffee json;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /favicon.ico {
|
|
||||||
# try_files /maintenance.html @backend;
|
|
||||||
alias ../public/favicon.ico;
|
|
||||||
}
|
|
||||||
|
|
||||||
location @backend {
|
|
||||||
proxy_set_header x_debian_sso_dn $ssl_client_s_dn;
|
|
||||||
proxy_pass http://127.0.0.1:3000;
|
|
||||||
}
|
|
||||||
|
|
||||||
#location /assets/ {
|
|
||||||
# alias ../public/assets/;
|
|
||||||
# expires 1h;
|
|
||||||
# add_header X-Coffee assets;
|
|
||||||
#}
|
|
||||||
location /logo/ {
|
|
||||||
alias ../public/logo/;
|
|
||||||
expires 1h;
|
|
||||||
add_header X-Coffee logo;
|
|
||||||
}
|
|
||||||
location /screenshots/ {
|
|
||||||
alias ../public/screenshots/;
|
|
||||||
expires max;
|
|
||||||
add_header X-Coffee screenshots;
|
|
||||||
}
|
|
||||||
location /images/ {
|
|
||||||
alias ../public/images/;
|
|
||||||
expires 1h;
|
|
||||||
add_header X-Coffee images;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,111 +0,0 @@
|
||||||
#!/usr/bin/python3
|
|
||||||
|
|
||||||
# Download new versions of the CA certificate and Certificate Revocation List
|
|
||||||
# from sso.debian.org and write them out atomically.
|
|
||||||
|
|
||||||
import requests
|
|
||||||
import tempfile
|
|
||||||
import argparse
|
|
||||||
import os
|
|
||||||
import subprocess
|
|
||||||
import ssl
|
|
||||||
|
|
||||||
class atomic_writer(object):
|
|
||||||
"""
|
|
||||||
Atomically write to a file
|
|
||||||
"""
|
|
||||||
def __init__(self, fname, mode, osmode=0o644, sync=True, **kw):
|
|
||||||
self.fname = fname
|
|
||||||
self.osmode = osmode
|
|
||||||
self.sync = sync
|
|
||||||
dirname = os.path.dirname(self.fname)
|
|
||||||
self.fd, self.abspath = tempfile.mkstemp(dir=dirname, text="b" not in mode)
|
|
||||||
self.outfd = open(self.fd, mode, closefd=True, **kw)
|
|
||||||
|
|
||||||
def __enter__(self):
|
|
||||||
return self.outfd
|
|
||||||
|
|
||||||
def __exit__(self, exc_type, exc_val, exc_tb):
|
|
||||||
if exc_type is None:
|
|
||||||
self.outfd.flush()
|
|
||||||
if self.sync: os.fdatasync(self.fd)
|
|
||||||
os.fchmod(self.fd, self.osmode)
|
|
||||||
os.rename(self.abspath, self.fname)
|
|
||||||
else:
|
|
||||||
os.unlink(self.abspath)
|
|
||||||
self.outfd.close()
|
|
||||||
return False
|
|
||||||
|
|
||||||
|
|
||||||
def get_url(url):
|
|
||||||
"""
|
|
||||||
Fetch a URL and return the raw result as bytes
|
|
||||||
"""
|
|
||||||
bundle='/etc/ssl/ca-debian/ca-certificates.crt'
|
|
||||||
if os.path.exists(bundle):
|
|
||||||
res = requests.get(url, verify=bundle)
|
|
||||||
else:
|
|
||||||
res = requests.get(url)
|
|
||||||
res.raise_for_status()
|
|
||||||
return res.content
|
|
||||||
|
|
||||||
|
|
||||||
def update_file(pathname, content, validate=None):
|
|
||||||
"""
|
|
||||||
Write content on pathname atomically, and do nothing if pathname exists and
|
|
||||||
has the same content as `content`.
|
|
||||||
|
|
||||||
Returns True if the file has been updated, else False.
|
|
||||||
"""
|
|
||||||
try:
|
|
||||||
with open(pathname, "rb") as fd:
|
|
||||||
existing = fd.read()
|
|
||||||
except OSError:
|
|
||||||
existing = None
|
|
||||||
|
|
||||||
if existing == content: return False
|
|
||||||
|
|
||||||
# Validate the contents
|
|
||||||
if validate:
|
|
||||||
validate(content)
|
|
||||||
|
|
||||||
with atomic_writer(pathname, "wb", osmode=0o644) as out:
|
|
||||||
out.write(content)
|
|
||||||
return True
|
|
||||||
|
|
||||||
def validate_crt(data):
|
|
||||||
ssl.PEM_cert_to_DER_cert(data.decode("utf-8"))
|
|
||||||
|
|
||||||
def validate_crl(data):
|
|
||||||
if not data.startswith(b"-----BEGIN X509 CRL-----"):
|
|
||||||
raise RuntimeError("Data does not begin with a CRL signature")
|
|
||||||
if not data.endswith(b"-----END X509 CRL-----\n"):
|
|
||||||
raise RuntimeError("Data does not end with a CRL footer")
|
|
||||||
|
|
||||||
def update(destdir):
|
|
||||||
# Fetch the certificate and the CRL
|
|
||||||
cert = get_url("https://sso.debian.org/ca/ca.pem")
|
|
||||||
crl = get_url("https://sso.debian.org/ca/ca.crl")
|
|
||||||
|
|
||||||
# Write them out atomically
|
|
||||||
|
|
||||||
updated = False
|
|
||||||
updated = update_file(os.path.join(destdir, "debsso.crt"), cert, validate=validate_crt) or updated
|
|
||||||
updated = update_file(os.path.join(destdir, "debsso.crl"), crl, validate=validate_crl) or updated
|
|
||||||
return updated
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
|
||||||
parser = argparse.ArgumentParser()
|
|
||||||
parser.add_argument("--destdir", default=".", help="destination directory. Default: .")
|
|
||||||
parser.add_argument("--onupdate", help="command to run if the file has been updated. Default: do not run anything.")
|
|
||||||
args = parser.parse_args()
|
|
||||||
|
|
||||||
if update(args.destdir):
|
|
||||||
if args.onupdate:
|
|
||||||
subprocess.check_call(["sh", "-c", args.onupdate])
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
main()
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue