Documentation revamped

This commit is contained in:
Christoph Haas 2018-08-08 14:14:40 +02:00
parent 844feb7f0e
commit fbee80f5f1
16 changed files with 377 additions and 1175 deletions

View file

@ -1,3 +1,5 @@
This file collects various notes about how certain aspects are implemented.
# Full text search
The pg_search Ruby gem is used for full-text searched in Rails.
@ -21,7 +23,7 @@ SELECT COUNT(*) FROM "packages" WHERE (
)
)
# Index:
## Create search index to speed up searches significantly
CREATE INDEX packages_gin ON packages USING GIN( (to_tsvector('simple',
coalesce("packages"."name"::text, '')) || to_tsvector('simple',
@ -33,27 +35,21 @@ coalesce("packages"."long_description"::text, ''))) );
Used: https://github.com/semaperepelitsa/jquery.fileupload-rails
Which is a gem for: https://github.com/blueimp/jQuery-File-Upload
---
Paperclip for attachment/screenshot file handlind within ActiveRecord
https://github.com/thoughtbot/paperclip
--
Rails 5 is said to contain functionality like that already.
Might be worth migrating to that at some time.
Components:
- Rails 5 (widespread, up-to-date, solves many common problems)
- PostgreSQL (fast, easy, I don't like MySQL, good fulltext search)
- Git (most people nowadays use Git)
- jQuery (well known and easy to use)
- Zurb Foundation (integrates nicer than Twitter Bootstrap)
- Guard for automated testing (http://www.rubydoc.info/gems/guard-rails)
--
---
Importer
How Debian repositories are organized: https://wiki.debian.org/RepositoryFormat
--
---
Logging from within the application into the database's "log" table:
@ -61,7 +57,7 @@ Log.log "foo"
or with section (default='frontend'):
Log.log "foo", "importer"
--
---
To create admin users
---------------------

View file

@ -1,5 +0,0 @@
To run the Rails server in development mode on port 3001 with HTTPS:
rails s puma -b 'ssl://0.0.0.0:3001?key=nginx/localhost.key&cert=nginx/localhost.crt&verify_mode=none'
This is required to be able to use single-sign login with the different services.

123
doc/README.Development.md Normal file
View file

@ -0,0 +1,123 @@
# Developing/Contributing
This document helps you set up the *debshots* Rails application on your
own Debian system if you intend to work on the source code.
## Preparing the development environment
Most steps required to deploy the application (for production use) are automated
using an Ansible playbook that you find at ./ansible/debshots.yml
The following section documents the steps you need to do to get the application
running in development mode. If you are a little experienced in developing Rails
applications you may know most of that already.
Development worked best on a Debian Jessie or Sid system.
## Install dependencies
These APT-gettable packages are probably required to run the application:
apt install python-psycopg2 ruby sudo libssl-dev libreadline-dev \
zlib1g-dev libbz2-dev libpq-dev git imagemagick
## Prepare PostgreSQL database server and user
PostgreSQL stores data about packages, screenshots and users. Authentication works in production
because the applications runs as the system user *debshots* that gets access to PostgreSQL via
ident-based authentication. In development mode you will likely work as your own user so you need to
create a development database in PostgreSQL and create a database user with a password to access it.
Put those credentials into ./config/database.yml
apt install postgresql
su - postgres
createuser -P -d debshots_dev
createdb -O debshots_dev -E UTF8 -T template0 debshots_dev
## Install the required Ruby version using rbenv
Rails uses the *bundler* tool to download and install dependent gems/packages. To avoid installing
them system wide you should rather create an *rbenv* sandbox environment where the specific Ruby
version and the required gems are installed. That ensures stable operation of the application and
does not spoil your otherwise APT-controlled system.
Documentation on rbenv can be found at https://github.com/rbenv/rbenv
To install it for your current user:
git clone https://github.com/rbenv/rbenv.git ~/.rbenv
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile
# Load rbenv automatically by appending
# the following to ~/.profile:
Run "rbenv init" and do as said.
Install the "rbenv install" (https://github.com/rbenv/ruby-build#readme) add-on:
git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
## Get the application
Clone the debshots Git repository from https://salsa.debian.org/debian/debshots
## Install the required Ruby version and the applications' dependencies
rbenv install
echo "gem: --no-rdoc --no-ri" > ~/.gemrc
gem install bundler
bundle install
## Optional: copy screenshots and database from the live website
scp screenshots.debian.net:debshots-screenshots.tar .
tar -C public/ -xvf debshots-screenshots.tar
scp screenshots.debian.net:debshots.sql .
psql debshots_dev < debshots.sql
Make sure that the application's database schema is upgraded to reflect the latest state of
development.
bundle exec rails db:migrate
(The reason to prefix all commands by "bundle exec" to make sure that the Ruby version
from *rbenv* is used and that only the gems from the sandbox environment are used.)
## Start with a blank database
Create a blank database with the latest database schema:
bundle exec rails db:schema:load
If you get database access errors then check the *development* section in your
./config/database.yml file.
## Fill/update the database with information from APT repositories
Get the latest information on packages from the Debian repositories.
bundle exec rails debshots:update_from_deb_repos RAILS_ENV=production
bundle exec rails debshots:update_longdescription_from_deb_repos RAILS_ENV=production
## Run the application
bundle exec rails s
Point your browser to http://localhost:3000/ and you will see the web site.
## Optional: Tidy up the screenshot data
bundle exec rake debshots:remove_broken_screenshots
bundle exec rake debshots:remove_duplicate_images
## Optional: Import new package information
bundle exec rake debshots:list_deb_repos
bundle exec rake debshots:update_from_deb_repos
bundle exec debshots:update_longdescription_from_deb_repos
To run the Rails server in development mode on port 3001 with HTTPS:
rails s puma -b 'ssl://0.0.0.0:3001?key=nginx/localhost.key&cert=nginx/localhost.crt&verify_mode=none'
This is required to be able to use single-sign login with the different services.

View file

@ -1,303 +0,0 @@
# Installing debshots the easy way using Ansible
Prerequisites: A Debian Jessie server.
Install PIP to get a recent version of Ansible:
apt install python-pip
pip install ansible
Run the Ansible playbook that comes with the debshots repository:
cd ansible
ansible-playbook debshots.yml
# Installing debshots the manual way
## Prepare PostgreSQL database server and user (ident-based authentication)
apt install postgresql
su - postgres
createuser -P -d debshots
createdb -O debshots -E UTF8 -T template0 debshots
## Create an application user
adduser debshots
Allow the user to parse access log files from Nginx:
adduser debshots adm
su - debshots
## Install the required Ruby version using rbenv
Documentation: https://github.com/rbenv/rbenv
git clone https://github.com/rbenv/rbenv.git ~/.rbenv
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile
# Load rbenv automatically by appending
# the following to ~/.profile:
eval "$(rbenv init -)"
Install the "rbenv install" add-on:
Documentation: https://github.com/rbenv/ruby-build#readme
git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
Install the "rbenv vars" add-on:
cd ~/.rbenv/plugins
git clone https://github.com/sstephenson/rbenv-vars.git
## Get the application
Clone the debshots Git repository.
## Install the Ruby dependencies
rbenv install
echo "gem: --no-rdoc --no-ri" > ~/.gemrc
gem install bundler
bundle install --deployment
## Optional: copy screenshots and database from the live website
scp screenshots.debian.net:debshots-screenshots.tar .
tar -C public/ -xvf debshots-screenshots.tar
scp screenshots.debian.net:debshots.sql .
psql debshots < debshots.sql
## Switch to production environment
export RAILS_ENV=production
## Migrate database
rails db:schema:load RAILS_ENV=production
- rails db:migrate RAILS_ENV=production -
In config/database.yml: production: user/password/host must be commented out
## Fill/update the database with information from APT repositories
rails debshots:update_from_deb_repos RAILS_ENV=production
rails debshots:update_longdescription_from_deb_repos RAILS_ENV=production
## Pre-render the static assets
rails assets:precompile RAILS_ENV=production
## Test the application:
rails s -b 127.0.0.1 -e production
Point your browser to http://...:3000/ and check the web site.
## Create a user for moderation:
Start a Rails console:
bundle exec rails c -e production
Create a new user record:
user = User.create(realname: 'Christoph Haas', password: 'foobartest', email: 'email@christoph-haas.de')
user.save!
## Tidy up the screenshot data
bundle exec rake debshots:remove_broken_screenshots
bundle exec rake debshots:remove_duplicate_images
## Import new package information
bundle exec rake debshots:list_deb_repos
bundle exec rake debshots:update_from_deb_repos
bundle exec debshots:update_longdescription_from_deb_repos
# Supported URL paths (aka routes)
_For up-to-date information please check config/routes._
/screenshots/:package_inital/:package/:(id)_:size.png
* package = name of the package
* id = numerical ID of the screenshot
* size = "large" or "small"
* Returns a PNG image of a screenshot
* Should be served as a static asset
/image/:(id)_:size.png
* id = numerical ID of the screenshot
* size = "large" or "small"
* Returns a PNG image of a screenshot
* Usually used for unapproved images that should just be shown to the uploader
/about
* Return an informational HTML page
/packages
* Return a list of packages with pagination
/packages/with_screenshots
* Return a list of packages with pagination
* Select only those packages that have screenshots.
/packages/without_screenshots
* Return a list of packages with pagination
* Select only those packages that do not have screenshots.
/packages/games_without_screenshots (deprecated)
* Return a list of packages with pagination
* Select only those packages that belong to Debian's "games" section
/json/packages
* Return a JSON data structure of all packages
/json/screenshots
* Return a JSON data structure containing packages and screenshots
/json/packages-without-screenshots
* Return a JSON data structure of those packages that do not have any screenshots
/packages/moderate
* Return a HTML page showing packages that need moderation
* Must only be available to logged in moderators
/upload
* Return a HTML page containing an upload form for new screenshots
/guidelines (deprecated)
* Return a HTML page showing general guidelines for creating screenshots
* Should just redirect to the /upload page
/upload/:package
* ??
/uploadfile
* ??
/login
* Show a login form
/logout
* Logout the user by invalidating the cookie session.
/package/:package
* Show details of a certain package
/json/package/:package
* Return a JSON data structure containing details of a certain package
/thumbnail/:package
/thumbnail-404/:package (deprecated)
* Return a small (160x120 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
/thumbnail-with-version/:package/:version
* Return a small (160x120 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
* Prefer screenshots of a certain version
/screenshot/:package
/screenshot-404/:package (deprecated)
* Return a large (320x240 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
/screenshot-with-version/:package/:version
* Return a large (320x240 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
* Prefer screenshots of a certain version
/delete_screenshot/:screenshot
* Users: request deletion of a screenshot
* Moderators: delete a screenshot
/approve_screenshot/:screenshot
* Users: 403
* Moderators: approve a screenshot
/keep_screenshot/:screenshot
* Users: 403
* Moderators: re-approve a screenshot that was requested for deletion
## Cron jobs
Parse Nginx access logs to count the number of visits of each package:
RAILS_ENV=production bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
As a cron job:
41 9 * * * cd $HOME/debshots ; RAILS_ENV=production /home/debshots/.rbenv/shims/bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
# Authentication
This web application tries to avoid to create yet another directory
of user accounts. So it leverages other common web sites like StackExchange,
Debian SSO (using browser/client certificates) or GitHub as single-sign-on
services. It is still possible to create local user accounts for administrators
but registration is disabled.
Anonymous uploads are possible but they have to be moderated by an administrator.
# Authorization
A user can have one of these access levels.
## Anonymous
Without authentication all user actions are moderated. Such users can upload
screenshots or report existing/published screenshots as inappropriate. However
a user with level 'admin' will have to approve that action.
## Authenticated by single-sign-login (SSO)
Users can use different authentication services to login - like Github or
StackExchange. Such users internally get an account with a random password
created but they will keep logging in via SSO.
The first upload will have to be moderated. Subsequent uploads will be
approved automatically.
## Authenticated by Debian signle-sign-login (SSO)
If a user authenticates using a Debian SSO client certificate they will be
able to upload screenshots without moderation.
(Anohter idea was to restrict them to uploading only screenshots for the
packages they maintain. But that may be reliable and is not implemented at
this time.)
## Administrator
Such a user has an internal user account. The database record has the
'admin' field set to 1. Admins can freely upload, moderate and delete
screenshots. They can also read the log files.
# Nginx during development
During development it is advised to run Nginx to proxy ports 3000 (HTTP)
and 3001 (HTTPS) to the rails application.
cd nginx
nginx -c `pwd`/nginx.conf
The SSL certitificate is just a self-signed certificate with the
common name "localhost". It was generated using:
openssl req -x509 -newkey 4096 -nodes -keyout localhost.key -out localhost.crt -days 3650
Run "rails s" in another window. That will use the built-in Ruby 'Puma'
application server that can also be used in production. It requires less
configuration than Phusion Passenger but may be slower in regard to
performance and multi-threading / multi-core support.
If you get "400 Bad Request / The SSL certificate error" in the browser then
please check the error log (/tmp/error*). Once cause is that the CRL of
the Debian SSO has expired and needs to be updated.

129
doc/README.Installation.md Normal file
View file

@ -0,0 +1,129 @@
# Installing debshots
The easiest way to deploy the application is using Ansible.
Take a Debian Stretch server (8 GB RAM recommended).
Install PIP to get a recent version of Ansible:
apt install python-pip
pip install ansible
Run the Ansible playbook that comes with the debshots repository:
cd ansible
ansible-playbook debshots.yml
Check out the project repository from https://salsa.debian.org/debian/debshots
Change to the *ansible* subdirectory and run the main playbook:
cd ansible
ansible-playbook debshots.yml
This will install PostgreSQL and Nginx, create a database, create a system user
and do various configuration.
Make sure that you set the environment variables as described in README.SSO.md before
you start the Rails application. Otherwise most single sign-on providers cannot work.
You also need to get the https://salsa.debian.org/debsso-team/debsso/raw/master/update-debsso-ca
script and run it in /etc/nginx to update the certficate and CRL used by the Debian
single-sign-on provider.
The production configuration uses Nginx that decrypts HTTPS and either serves static
assets (images, Javascript, CSS) itself or requests for dynamic content to the
Rails application. You will need a SSL certificate for Nginx. Just get one from
LetsEncrypt using the *certbot* tool.
Finally create an admin user for moderation:
Start a Rails console:
rails c -e production
Create a new user record:
user = User.create(realname: 'Christoph Haas', password: 'foobartest', email: 'email@christoph-haas.de')
user.save!
## Cron jobs
Parse Nginx access logs to count the number of visits of each package:
RAILS_ENV=production bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
As a cron job:
41 9 * * * cd $HOME/debshots ; RAILS_ENV=production /home/debshots/.rbenv/shims/bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
# Authentication
This web application tries to avoid to create yet another directory
of user accounts. So it leverages other common web sites like StackExchange,
Debian SSO (using browser/client certificates) or GitHub as single-sign-on
services. It is still possible to create local user accounts for administrators
but registration is disabled.
Anonymous uploads are possible but they have to be moderated by an administrator.
# Authorization
A user can have one of these access levels.
## Anonymous
Without authentication all user actions are moderated. Such users can upload
screenshots or report existing/published screenshots as inappropriate. However
a user with level 'admin' will have to approve that action.
## Authenticated by single-sign-login (SSO)
Users can use different authentication services to login - like Github or
StackExchange. Such users internally get an account with a random password
created but they will keep logging in via SSO.
The first upload will have to be moderated. Subsequent uploads will be
approved automatically.
## Authenticated by Debian signle-sign-login (SSO)
If a user authenticates using a Debian SSO client certificate they will be
able to upload screenshots without moderation.
(Anohter idea was to restrict them to uploading only screenshots for the
packages they maintain. But that may be reliable and is not implemented at
this time.)
## Administrator
Such a user has an internal user account. The database record has the
'admin' field set to 1. Admins can freely upload, moderate and delete
screenshots. They can also read the log files.
# Nginx during development
During development it is advised to run Nginx to proxy ports 3000 (HTTP)
and 3001 (HTTPS) to the rails application.
cd nginx
nginx -c `pwd`/nginx.conf
The SSL certitificate is just a self-signed certificate with the
common name "localhost". It was generated using:
openssl req -x509 -newkey 4096 -nodes -keyout localhost.key -out localhost.crt -days 3650
Run "rails s" in another window. That will use the built-in Ruby 'Puma'
application server that can also be used in production. It requires less
configuration than Phusion Passenger but may be slower in regard to
performance and multi-threading / multi-core support.
If you get "400 Bad Request / The SSL certificate error" in the browser then
please check the error log (/tmp/error*). Once cause is that the CRL of
the Debian SSO has expired and needs to be updated.
# Tidy up the screenshot data:
bundle exec rake debshots:remove_broken_screenshots
bundle exec rake debshots:remove_duplicate_images

102
doc/README.URLs.md Normal file
View file

@ -0,0 +1,102 @@
# Supported URL paths (aka routes)
/screenshots/:package_inital/:package/:(id)_:size.png
* package = name of the package
* id = numerical ID of the screenshot
* size = "large" or "small"
* Returns a PNG image of a screenshot
* Should be served as a static asset
/image/:(id)_:size.png
* id = numerical ID of the screenshot
* size = "large" or "small"
* Returns a PNG image of a screenshot
* Usually used for unapproved images that should just be shown to the uploader
/about
* Return an informational HTML page
/packages
* Return a list of packages with pagination
/packages/with_screenshots
* Return a list of packages with pagination
* Select only those packages that have screenshots.
/packages/without_screenshots
* Return a list of packages with pagination
* Select only those packages that do not have screenshots.
/packages/games_without_screenshots (deprecated)
* Return a list of packages with pagination
* Select only those packages that belong to Debian's "games" section
/json/packages
* Return a JSON data structure of all packages
/json/screenshots
* Return a JSON data structure containing packages and screenshots
/json/packages-without-screenshots
* Return a JSON data structure of those packages that do not have any screenshots
/packages/moderate
* Return a HTML page showing packages that need moderation
* Must only be available to logged in moderators
/upload
* Return a HTML page containing an upload form for new screenshots
/guidelines (deprecated)
* Return a HTML page showing general guidelines for creating screenshots
* Should just redirect to the /upload page
/upload/:package
* ??
/uploadfile
* ??
/login
* Show a login form
/logout
* Logout the user by invalidating the cookie session.
/package/:package
* Show details of a certain package
/json/package/:package
* Return a JSON data structure containing details of a certain package
/thumbnail/:package
/thumbnail-404/:package (deprecated)
* Return a small (160x120 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
/thumbnail-with-version/:package/:version
* Return a small (160x120 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
* Prefer screenshots of a certain version
/screenshot/:package
/screenshot-404/:package (deprecated)
* Return a large (320x240 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
/screenshot-with-version/:package/:version
* Return a large (320x240 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
* Prefer screenshots of a certain version
/delete_screenshot/:screenshot
* Users: request deletion of a screenshot
* Moderators: delete a screenshot
/approve_screenshot/:screenshot
* Users: 403
* Moderators: approve a screenshot
/keep_screenshot/:screenshot
* Users: 403
* Moderators: re-approve a screenshot that was requested for deletion

View file

@ -57,6 +57,7 @@ Environment variables have to be set before starting the application:
export GITHUB_SECRET=…
Keys can be managed at https://github.com/settings/applications
To register a new oauth key go to "Developer Settings" in your Github account.
Make sure that the allowed callback URL is:
https://screenshots.debian.net/users/auth/github/callback

View file

@ -1,352 +1,19 @@
== Installing debshots
# About debshots
=== Prepare PostgreSQL database server and user (ident-based authentication)
Debshots is a web application written in Ruby-on-Rails that powers the
screenshots.debian.net web site. Many services like packages.debian.net,
Ubuntu Software or Synaptic rely on it.
apt install postgresql
## State of the application
su - postgres
The application has been revamped a lot and does not resemble the version
still used in production. The current state is worth trying but not yet ready
for deployment.
createuser -d debshots
## Development
createdb -O debshots -E UTF8 -T template0 debshots
Check out the README.Development.md
=== Create an application user
## Deployment
adduser debshots
Allow the user to parse access log files from Nginx:
adduser debshots adm
su - debshots
=== Install the required Ruby version using rbenv
https://github.com/rbenv/rbenv
git clone https://github.com/rbenv/rbenv.git ~/.rbenv
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile
# Load rbenv automatically by appending
# the following to ~/.bashrc:
eval "$(rbenv init -)"
https://github.com/rbenv/ruby-build#readme
git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
=== Get the application
Clone the debshots Git repository.
=== Install the Ruby dependencies
rbenv install
echo "gem: --no-rdoc --no-ri" > ~/.gemrc
gem install bundler
bundle install --deployment
=== Copy screenshots and database from the former live website
scp screenshots.debian.net:debshots-screenshots.tar .
tar -C public/ -xvf debshots-screenshots.tar
scp screenshots.debian.net:debshots.sql .
psql debshots < debshots.sql
Switch to production environment:
export RAILS_ENV=production
Migrate database:
bundle exec rake db:migrate RAILS_ENV=production
(config/database.yml: production: user/password/host must be commented out)
Convert screenshots to new format (paperclip):
bundle exec rake debshots:screenshots_to_paperclip RAILS_ENV=production
Remove old screenshots directory structure:
rm -r public/live
Render the assets:
bundle exec rake assets:precompile RAILS_ENV=production
Test the application:
bundle exec rails s -b 0.0.0.0 -e production
http://...:3000/
Create a user for moderation:
bundle exec rails c -e production
user = User.create(realname: 'Christoph Haas', password: 'foobartest', email: 'email@christoph-haas.de', provider: 'local')
user.save!
Tidy up the screenshot data:
bundle exec rake debshots:remove_broken_screenshots
bundle exec rake debshots:remove_duplicate_images
Import new package information:
bundle exec rake debshots:list_deb_repos
bundle exec rake debshots:update_from_deb_repos
bundle exec debshots:update_longdescription_from_deb_repos
=== Install passenger to run the application behind nginx
https://www.phusionpassenger.com/library/walkthroughs/deploy/ruby/ownserver/nginx/oss/jessie/install_passenger.html
Example nginx vhost config:
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##
#proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=assets:768m use_temp_path=off;
#add_header X-Cache-Status $upstream_cache_status;
#add_header X-Runtime 42;
more_clear_headers 'X-Runtime';
more_clear_headers 'X-Powered-By';
more_clear_headers 'Server';
server_tokens off;
#passenger_show_version_in_header off;
#log_format proxy '[$time_local] Cache: $upstream_cache_status $upstream_addr $upstream_response_time $status $bytes_sent $proxy_add_x_forwarded_for $request_uri "$http_referer" "$http_user_agent"';
#access_log /var/log/nginx/debshots-access.log proxy;
# Default server configuration
#
#passenger_log_level 5;
server {
listen 85.25.83.22:80 default_server;
#listen 80 default_server;
#listen [::]:80 default_server;
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
passenger_enabled on;
passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby;
#passenger_pass_header X-Accel-Redirect;
#proxy_cache_methods GET HEAD;
root /home/debshots/debshots/public;
# Add index.php to the list if you are using PHP
#index index.html index.htm index.nginx-debian.html;
server_name _;
#proxy_cache assets;
#add_header X-Cache-Status $upstream_cache_status;
#proxy_ignore_headers Cache-Control;
#add_header X-Debian rocks;
location /assets/ {
alias /home/debshots/debshots/public/assets/;
expires 1h;
#include debshots_params;
add_header X-Coffee assets;
add_header Cache-Control public;
}
location /logo/ {
alias /home/debshots/debshots/public/logo/;
expires 1h;
add_header X-Coffee logo;
add_header Cache-Control public;
}
location /screenshots/ {
alias /home/debshots/debshots/public/screenshots/;
expires max;
add_header X-Coffee screenshots;
add_header Cache-Control public;
}
location /images/ {
alias /home/debshots/debshots/public/images/;
expires 1h;
add_header X-Coffee images;
add_header Cache-Control public;
}
# Send thumbnails using X-Sendfile / X-Accel-Redirect
# The correct thumbnail is computed by the Rails application so it cannot be served directly.
location /thumbnail/ {
expires 1d;
add_header X-Coffee thumbnail;
add_header Cache-Control public;
passenger_set_header X-Sendfile-Type "X-Accel-Redirect";
passenger_env_var HTTP_X_ACCEL_MAPPING /home/debshots/debshots/public/=/__send_file_accel/;
passenger_pass_header X-Accel-Redirect;
}
# Send public assets using X-Sendfile / X-Accel-Redirect (e.g. public/images/dummy/...)
location /public/ {
expires 1h;
add_header X-Coffee public;
add_header Cache-Control public;
passenger_set_header X-Sendfile-Type "X-Accel-Redirect";
passenger_env_var HTTP_X_ACCEL_MAPPING /home/debshots/debshots/public/=/__send_file_accel/;
passenger_pass_header X-Accel-Redirect;
}
location /__send_file_accel/ {
internal;
alias /home/debshots/debshots/public/;
}
}
== Supported URL paths (aka routes)
/screenshots/:package_inital/:package/:(id)_:size.png
* package = name of the package
* id = numerical ID of the screenshot
* size = "large" or "small"
* Returns a PNG image of a screenshot
* Should be served as a static asset
/image/:(id)_:size.png
* id = numerical ID of the screenshot
* size = "large" or "small"
* Returns a PNG image of a screenshot
* Usually used for unapproved images that should just be shown to the uploader
/about
* Return an informational HTML page
/packages
* Return a list of packages with pagination
/packages/with_screenshots
* Return a list of packages with pagination
* Select only those packages that have screenshots.
/packages/without_screenshots
* Return a list of packages with pagination
* Select only those packages that do not have screenshots.
/packages/games_without_screenshots (deprecated)
* Return a list of packages with pagination
* Select only those packages that belong to Debian's "games" section
/json/packages
* Return a JSON data structure of all packages
/json/screenshots
* Return a JSON data structure containing packages and screenshots
/json/packages-without-screenshots
* Return a JSON data structure of those packages that do not have any screenshots
/packages/moderate
* Return a HTML page showing packages that need moderation
* Must only be available to logged in moderators
/upload
* Return a HTML page containing an upload form for new screenshots
/guidelines (deprecated)
* Return a HTML page showing general guidelines for creating screenshots
* Should just redirect to the /upload page
/upload/:package
* ??
/uploadfile
* ??
/login
* Show a login form
/logout
* Logout the user by invalidating the cookie session.
/package/:package
* Show details of a certain package
/json/package/:package
* Return a JSON data structure containing details of a certain package
/thumbnail/:package
/thumbnail-404/:package (deprecated)
* Return a small (160x120 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
/thumbnail-with-version/:package/:version
* Return a small (160x120 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
* Prefer screenshots of a certain version
/screenshot/:package
/screenshot-404/:package (deprecated)
* Return a large (320x240 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
/screenshot-with-version/:package/:version
* Return a large (320x240 pixel) PNG screenshot file of a package
* If the package does not have any screenshots then return a 404 code
* Prefer screenshots of a certain version
/delete_screenshot/:screenshot
* Users: request deletion of a screenshot
* Moderators: delete a screenshot
/approve_screenshot/:screenshot
* Users: 403
* Moderators: approve a screenshot
/keep_screenshot/:screenshot
* Users: 403
* Moderators: re-approve a screenshot that was requested for deletion
== Cron jobs
Parse Nginx access logs to count the number of visits of each package:
RAILS_ENV=production bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
As a cron job:
41 9 * * * cd $HOME/debshots ; RAILS_ENV=production /home/debshots/.rbenv/shims/bundle exec rake debshots:accesslog2visits[/var/log/nginx/cache-access.log.1]
Read the README.Installation.md

View file

@ -1,75 +0,0 @@
-----BEGIN X509 CRL-----
MIINnjCCDIYwDQYJKoZIhvcNAQELBQAwRDEaMBgGA1UEAxMRU1NPIENBIDIwMTUt
MDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xpZW50IGNlcnRpZmljYXRlFw0x
NzA0MjIxNDU1MDJaFw0xNzA0MjUxNDU1MDJaMIIMDzATAgIQABcNMTUwODIxMjEy
NTI4WjATAgIQARcNMTUwODIxMjA1MDUxWjATAgIQAhcNMTUwODIxMjEwNjQ3WjAT
AgIQAxcNMTUwODIxMjEwNjQ5WjATAgIQBBcNMTUwODI0MTMwMjQyWjATAgIQBRcN
MTUwODIxMjEyNTMzWjATAgIQERcNMTYwMzE0MTQxMTAzWjATAgIQEhcNMTUwODI2
MTExODUwWjATAgIQFRcNMTYwNTE1MDE0OTA1WjATAgIQFhcNMTYwMzIzMjMyNTE3
WjATAgIQIBcNMTUwODI0MTMwMjQ0WjATAgIQIRcNMTUwODI0MTMwMjQ2WjATAgIQ
IhcNMTUwODI0MTMwMjQ2WjATAgIQIxcNMTUwODI0MTMwMzQ2WjATAgIQJRcNMTUx
MjE2MjAyMjM5WjATAgIQKBcNMTUwODI1MTUwODA3WjATAgIQMRcNMTUwODI2MTMz
ODQ4WjATAgIQNBcNMTUwODI2MTUyODE4WjATAgIQQRcNMTUxMjE2MTI1ODE0WjAT
AgIQRxcNMTUwODI4MDgxNDQ0WjATAgIQUBcNMTUwOTAxMDc1MjMxWjATAgIQURcN
MTUwOTAxMDc1MjM4WjATAgIQWxcNMTYwODE3MTcxNjM4WjATAgIQYhcNMTUwODI4
MTM1NjI4WjATAgIQcBcNMTUwOTE0MTIyNzUwWjATAgIQehcNMTYwNjIwMDkwNDE1
WjATAgIQjhcNMTYwMTEwMDEwNTEwWjATAgIQnBcNMTUxMTI1MTQ0NDI5WjATAgIQ
qBcNMTUwOTAyMTU0OTAxWjATAgIQvRcNMTUxMjA5MTM0NzQyWjATAgIQyhcNMTYw
NDA2MDkyNjI3WjATAgIQzxcNMTUxMDEyMDc1ODMxWjATAgIQ1RcNMTUxMDE5MTQ0
MjIwWjATAgIQ1hcNMTYwNDA0MDgwMTUxWjATAgIQ6RcNMTYwODE3MTcxNjQwWjAT
AgIQ9BcNMTUxMTE3MTQxMzI1WjATAgIQ+RcNMTUxMTIwMTM0OTA2WjATAgIREBcN
MTYwMjA1MjEyODAxWjATAgIREhcNMTYwMzE4MjMwMjAyWjATAgIRExcNMTYwNjEx
MjI0ODI2WjATAgIRGRcNMTYxMjEwMTUzMzE3WjATAgIRHhcNMTYwNDA5MjAwODM1
WjATAgIRHxcNMTYwNDA5MjAwODM5WjATAgIRJhcNMTUxMjE3MTYyNzM1WjATAgIR
JxcNMTYwNzA3MTA1MTMzWjATAgIRKxcNMTYwNjIwMDkwNDE3WjATAgIROBcNMTYw
ODE3MTcxNjQzWjATAgIRRBcNMTYxMDIwMDc0NjAzWjATAgIRSBcNMTYwMTIwMjAw
MjEzWjATAgIRbRcNMTYwMjEzMTgzODI2WjATAgIRchcNMTYxMjEwMTUzMzE1WjAT
AgIRcxcNMTYxMDA5MTcwMjIxWjATAgIRexcNMTYwMjI5MjMyNjU1WjATAgIRiRcN
MTYwNzA3MTA1MTMxWjATAgIRixcNMTYwMzE0MTQxMTA4WjATAgIRkRcNMTYwNjIw
MDkwNDE5WjATAgIRkhcNMTYwMzE0MTQxMTA2WjATAgIRlRcNMTcwMTE4MTYwMDI2
WjATAgIRnxcNMTYxMDAzMjAwNjMzWjATAgIRohcNMTYwMzE4MTQwNjE5WjATAgIR
thcNMTYwMzE5MTUzNzQ3WjATAgIRuRcNMTYwMzE5MTYyMjQzWjATAgIRwhcNMTYw
MzIwMTE1MzAzWjATAgIRwxcNMTYwNTExMjI1ODE1WjATAgIRzxcNMTYwMzI0MDEx
MzMyWjATAgIR0RcNMTcwMjA3MTk1ODI5WjATAgIR5BcNMTYwNzAyMTUxNTMzWjAT
AgIR5xcNMTYwODE4MTUzMDUzWjATAgIR6hcNMTYwMzI5MTYyMDMzWjATAgIR7xcN
MTcwMzIyMjM0MTM5WjATAgIR9RcNMTYwMzI3MDgwMzI0WjATAgIR/BcNMTYwNTI0
MjA1MDE4WjATAgIR/xcNMTYwNTA0MTk1NDMzWjATAgISFhcNMTcwMjE2MjEyODE5
WjATAgISIRcNMTYwNDA4MDkyMjEwWjATAgISIhcNMTYwNDA4MDkyMjEyWjATAgIS
IxcNMTYwNDA4MDkyMjE1WjATAgISJBcNMTYwNDA4MDkyMjE3WjATAgISKBcNMTYw
NTAyMDU1MDAyWjATAgISMhcNMTYwNDA5MjAyOTU3WjATAgISPRcNMTYwNDEwMTkx
MjA3WjATAgISShcNMTYxMjEwMTUzMzE0WjATAgISUhcNMTYwNDIxMTYwNDU2WjAT
AgISYhcNMTcwNDE5MDY1MDQ4WjATAgISbhcNMTYwNTE0MDE0MzEyWjATAgIScBcN
MTYwNTEzMjIyOTMyWjATAgIScRcNMTYwNTEzMjIyOTM2WjATAgIScxcNMTYwNTE0
MDE0MzE4WjATAgISgRcNMTYwNjMwMTUwMjU1WjATAgIShRcNMTYxMDAzMjAwNjI0
WjATAgISqBcNMTYwNjA4MTQ0NTEzWjATAgISrRcNMTYwNjExMjMwNjA4WjATAgIS
sRcNMTcwMzIyMjM0MTQ3WjATAgISsxcNMTYwNjIwMTM1MDAyWjATAgIStBcNMTYw
NjIwMTM1MDAwWjATAgIStRcNMTYwNjIwMTM0OTU4WjATAgISwRcNMTYxMTIyMTIx
NDAzWjATAgIS5BcNMTYwOTI5MTczMTA4WjATAgIS5RcNMTYwOTI5MTczMDUzWjAT
AgITBRcNMTcwNDEzMDE1NDM0WjATAgITHxcNMTYwOTA4MDg1MDIzWjATAgITIBcN
MTcwMTA2MjExMDU3WjATAgITIxcNMTYxMTMwMTAzOTI1WjATAgITPBcNMTYwOTI5
MTc0NzI3WjATAgITQhcNMTYwOTI5MTczNTQ1WjATAgITThcNMTYxMDA5MjA0NTQy
WjATAgITTxcNMTYxMDA5MTcxMjIxWjATAgITVRcNMTYxMDEyMTQwMDIwWjATAgIT
XBcNMTYxMjI4MTg0NzMxWjATAgITXRcNMTYxMDE2MTU1NzM2WjATAgITYxcNMTYx
MDE4MTcwNzE0WjATAgITaxcNMTcwNDE3MTA1MTIxWjATAgITbhcNMTYxMjE4MTYw
NTI0WjATAgITchcNMTYxMDI0MjA1MjU3WjATAgITfhcNMTcwMTE3MTAzMzMzWjAT
AgITghcNMTYxMDMwMTgzODQyWjATAgIThxcNMTYxMDMxMjE0NzUyWjATAgITiBcN
MTYxMDMxMjE0MzE4WjATAgITixcNMTYxMTAyMTkyOTIxWjATAgITmBcNMTYxMTA4
MTkyODE2WjATAgITmRcNMTYxMTA4MTkzNTExWjATAgITmhcNMTYxMTA4MTkzNTEy
WjATAgITnRcNMTcwMTA2MjExMDU2WjATAgITpRcNMTYxMTEwMjE1NjA5WjATAgIT
phcNMTYxMTEwMjIxODE1WjATAgITuxcNMTcwMTAxMTAwNDQxWjATAgIT5hcNMTcw
MTA2MjExMDU1WjATAgIT6BcNMTcwNDIyMTQxMzUzWjATAgIT8xcNMTYxMjIxMjEz
MjQ0WjATAgIT+BcNMTYxMjIzMjIzNTQ0WjATAgIT+RcNMTYxMjIzMjIzNTQzWjAT
AgIUABcNMTYxMjMwMDA1NjM2WjATAgIUCBcNMTcwMTEwMDk1MzQwWjATAgIUERcN
MTcwMTA0MTMzMjI1WjATAgIUEhcNMTcwMTA0MTMzMzU3WjATAgIUExcNMTcwMTA0
MTMzODI2WjATAgIURRcNMTcwMjA1MTYxNTE0WjATAgIURhcNMTcwMjA1MTYyMDIy
WjATAgIUXxcNMTcwMjEzMTYyMzQ5WjATAgIUbBcNMTcwMjI0MDc0MTU4WjATAgIU
fxcNMTcwMzA5MTAxNTI2WjATAgIUhxcNMTcwMzE1MDczNzE3WjATAgIUtxcNMTcw
MzMwMTcxODQxWjATAgIUuBcNMTcwMzMwMTcxODI5WjATAgIUuRcNMTcwMzMwMTcy
MDIzWjATAgIU4hcNMTcwNDEzMDc1MDE3WjATAgIVLBcNMTcwNDIyMTQ1NTAyWjAN
BgkqhkiG9w0BAQsFAAOCAQEAuSmMXKr6dqDRi149DwlVFYBz8mskPPr61EzJKoYk
K4rAGBzlY7Ekcz57h881KxCFv7aFGmKA8DdnAOga4lr7/4c1tuoGTqqKDaS5/oOf
jgf7koLMWt9uqx6f5w491XkJqVCKXETfxUwpxRclyTFgcUWchTHnBEH98K/jrYG4
WcqN2Xi2pxAaLM8V7E0CN9TETKRRO3WlbGfGMP8SqqHyOVRQBOuFQpaPyFSf+AXe
vRN4jih1Zfvg7WttKrjq+s04dPXM6nzUGnc9UeBHAif2FHY/qaT3mgw7ou22yS17
E7KTGCnXjoLg+g9e+A2vBXzjHhm1u/GAwMZVzzGGfRdi9g==
-----END X509 CRL-----

View file

@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
MIIDlzCCAn+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBEMRowGAYDVQQDExFTU08g
Q0EgMjAxNS0wOC0yMTEmMCQGA1UEChMdRGViaWFuIFNTTyBjbGllbnQgY2VydGlm
aWNhdGUwIhgPMjAxNTA4MjEyMDQzMzVaGA85OTk5MTIzMTIzNTk1OVowRDEaMBgG
A1UEAxMRU1NPIENBIDIwMTUtMDgtMjExJjAkBgNVBAoTHURlYmlhbiBTU08gY2xp
ZW50IGNlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
1SUMNiEVMlycwDPlJhgJ099VorLDTW556XvbWSw8l7cnygs8V9bN83f6W2P8x328
dz+U1OxEZ/PnS+/zMwco03XQggXcNN+UjHwUu9WP5koNsPFH6HRbvUy5oBDfbdVN
EzBE2gXE4WYFoj45U9rSU6qLEnT4QKxJ/CbTeMGvLKzuXdCv6W+UxUfbh186kSqM
tfDtY3aQ+L6MuPA1a+bumUh9EGVZrrIMbjgm1xrQohQBJC75X10dnicUliGZ+7C0
h7pUQlIY+/IxREQ46xBY1CNYeZNMEI9ErMbiFiShsc3mP3aLxTAQ4KzHCDtIuzwD
ElH8aMPxIQOUyL/FLx8ZTQIDAQABo4GPMIGMMA8GA1UdEwEB/wQFMAMBAf8wEwYD
VR0lBAwwCgYIKwYBBQUHAwkwDwYDVR0PAQH/BAUDAwcGADAdBgNVHQ4EFgQU0OJ+
JoHgzarLNF+2eiay11GCk44wNAYDVR0fBC0wKzApoCegJYYjaHR0cHM6Ly9zc28u
ZGViaWFuLm9yZy9zcGthYy9jYS5jcmwwDQYJKoZIhvcNAQELBQADggEBAKynxkRr
7w85LHYzH5q9xVHXX6+K6r1mA3b+OAopNMJZTCTn7v9UVDncp26wOeHOUEvawWaQ
21HBd70CiFH0XGDow0/K68ite/0RHxq1WAuggBc678d/0yDkoWdFHAf9n5Agzf4J
rXov++XmBXYHRXiHunuSLnM3i8HToejZMCC7P9nqpPo0tK7O22calbZn20Pdve6k
KrKxwwjxpuNxezr6uYGuNTLJOZtyjF09FuAebSlHvX6VYPl7FnMUDcS6QerEyocL
Bv7pbsNWehIfvfjqPJQwqznieieZGL6s1zB8/XWQw37C0i28LqJ8DTvEjgmF44RP
6JhTYDnI06pKfQY=
-----END CERTIFICATE-----

View file

@ -1,8 +0,0 @@
-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEA8kUEh2+7OSDG3BQ22cJBlBM0jp+AWW8Wa64J0hE/gQaR8jw9VSQW
a+WBaDQ+FAcxOmAeVvrX4owvBocHBcVPmU4NEnkWe77qsCG56wEJWco+DgN3cq43
SYbhI3s2HNQwLCzUYLAMZVXcUDH4Nn3cRTTl3ZNpB99XhAio20frNpGQrQeUb0Of
dDj3QpLL1k09b+OVnAh+3KFHawrjzzyFf9pZMsrmK/wZR5SSds1TTisHjVaJe4zN
dcOfvQr5dUHl1mvwxYPnpbXmXdlDmdBU6/HCqkXpUcfl18bhwKG1UT7wmWuInizT
AsNFRK393l5eqlE+AFvWZpacMGGMGJhd+wIBAg==
-----END DH PARAMETERS-----

View file

@ -1,32 +0,0 @@
-----BEGIN CERTIFICATE-----
MIIFhTCCA22gAwIBAgIJAJdnIw1IRbAAMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
aWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xNzA0MjIxNTI3
MTlaFw0yNzA0MjAxNTI3MTlaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21l
LVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNV
BAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ8c
28eoDXVGRYtXPMHa7L3v4pCdJQQthpiVULT108yDGHfCc8XJkjFqrk2GBH8Pvsk7
a9us/aad5G+6dQ+a6w8QG1U4grYyaO28QhSSy7ZP1l7rl5XAmYlU5aFVPPgJEnlT
QGc1lArEJH0mDREdagwNzD03NsWYGUOkdTgldQxO1zTmJWTr77/StP0fFYAff8Sb
gYoKEM1ZN0mNgt3Ts9tO7UZmEvglMvWa3OS8mJsrkBiU2yqou+R4sevdyC3TBFE3
yawahizt69NGR21LzBmlBewQwQ9eXmT8qPiRGplo1Rb4+UB6sMsESQDzCkyH09p0
T0fGoAXQrkthZRTsH6LAhR6nQzopuw7ZsyMNAjWQ5ksKED0tmbVGBKmXCz3CWetO
qu25mnNV9P/X+5Rl3vUXOpBcZOZYzG2lM4PmsYWpH40l0tbcBGvB1/nxT4+Ztqf4
+9LB0/bROYnBXoEAa8x1kXqiptk3pAko+U0AsQch26bF8sKKCZk+0aWiC7PXE5O6
2k9pPnA4fE+fmPPcYQQQXZ4D31afxQsGdbqklWNT2QdzVUyveL0tqDVSZMiTSK5j
sc5kEjLSfPoR0xgiFF/y81pzKWJwvI7DDI8q5ggWklrTqroms+riCLE+ko4ClLRa
ETc/iNGSQeMZD7xauqUuv8hGdtpyaVj12OZvWzarAgMBAAGjUDBOMB0GA1UdDgQW
BBQH5Z7WecoPmPYfrDvc/kYnUDxo3TAfBgNVHSMEGDAWgBQH5Z7WecoPmPYfrDvc
/kYnUDxo3TAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQA6kFmAEcQw
JMM02H1MM3RHBr0ZWDo6wSAT72kdLZnhOTdbCRiQ1Fm9dltNEuHHJIKhdWykCMjy
1uULsukBPDjomO8cB+K2vA4HAWcKtg64NnnVNFK70ZIdazwfYPwqddykgE6uWHc6
nQskGD3B+zQwartpThHvmw0V5HccIKoiHIy7qD9g8P+ovRg+6l+kaBELQiFUxDGm
lIxK2VgrYWxKoT3IBp1C5yNKJORc6Hc0m6r/Uf8uA3oLGkjvAmoY41lr/7ThIo8/
gd/Vk4EXjMdwfevIhHbjC2s2dxrV94f+TI54y9UPo4dOZJ9DMtmwvE2sTm1ROJfr
Wvufx0OUzMY0iGO2YEAglhk1NTf0ryyNh5sNWVx2YYaiRrzEmrtE3xYILBHyr4rF
dYWOg3IbXzVdL2oUsYrZwUtO35zw0ewuFKAnOO53N2+I3q2abq/jKvojACB6v+lf
k60Q8d07iBhkDrk1NI71SDyxSMrYqYxobI7AenFb196+9q3s1dS3ddIFiS8JL1le
JjvKo2HdQ64Yz/1qpgjAQD8xptSdwy4IPaef6kpMHylQ+V7BxwhGy6pZnKoXP6qE
VliHUJUzy4Dn4IgNLTx3MXLBObb6H63JqZE6DpfoKrNPAaL2zy9xv6ELkUPTsGVr
F/a83GfM+wAzDJB50cfuaOOR+QvCTdy0pg==
-----END CERTIFICATE-----

View file

@ -1,52 +0,0 @@
-----BEGIN PRIVATE KEY-----
MIIJQAIBADANBgkqhkiG9w0BAQEFAASCCSowggkmAgEAAoICAQCfHNvHqA11RkWL
VzzB2uy97+KQnSUELYaYlVC09dPMgxh3wnPFyZIxaq5NhgR/D77JO2vbrP2mneRv
unUPmusPEBtVOIK2MmjtvEIUksu2T9Ze65eVwJmJVOWhVTz4CRJ5U0BnNZQKxCR9
Jg0RHWoMDcw9NzbFmBlDpHU4JXUMTtc05iVk6++/0rT9HxWAH3/Em4GKChDNWTdJ
jYLd07PbTu1GZhL4JTL1mtzkvJibK5AYlNsqqLvkeLHr3cgt0wRRN8msGoYs7evT
RkdtS8wZpQXsEMEPXl5k/Kj4kRqZaNUW+PlAerDLBEkA8wpMh9PadE9HxqAF0K5L
YWUU7B+iwIUep0M6KbsO2bMjDQI1kOZLChA9LZm1RgSplws9wlnrTqrtuZpzVfT/
1/uUZd71FzqQXGTmWMxtpTOD5rGFqR+NJdLW3ARrwdf58U+Pmban+PvSwdP20TmJ
wV6BAGvMdZF6oqbZN6QJKPlNALEHIdumxfLCigmZPtGloguz1xOTutpPaT5wOHxP
n5jz3GEEEF2eA99Wn8ULBnW6pJVjU9kHc1VMr3i9Lag1UmTIk0iuY7HOZBIy0nz6
EdMYIhRf8vNacylicLyOwwyPKuYIFpJa06q6JrPq4gixPpKOApS0WhE3P4jRkkHj
GQ+8WrqlLr/IRnbacmlY9djmb1s2qwIDAQABAoICACAEqqVux+aFkZEMqQlJiMJf
93Oqa7x/fMpPocIIheptpwrScoGmomiXUyP+iAEZpgbQkk/Oa+yPcVyaZNwTDKIn
V5i6mnMXic3tSE7ji2LQhg7r0cEs1LiyANOKV46CJNmNSzR5r6TK+5zDf3WmOaTb
UfIvnjH8/XiDK6N0xi0H4H6goX3BjKlJOWqGSslRjWB++n5QsDjibyG5/E+vPk4v
f8fe2opc0fhihXjyCrOO/Jw1uDTJZ6X+M6+HHbU69W9yjn63h7Ca4A3P4qe3zQaM
ErkCVhdFojEoNshuSq/8TIUm7OFwzwrLffVW8webfaJELYAAFEuXRrucib7AFU1V
uNgNP8ul0dSCyRjzxuXO2ar9dTAv9qcYvi1sLEkpl7dqdNwf3Lg2sfcvDv5C/c3h
TRJOMX3ciMfc59ZJlMB78K5c1LqQWMsOQUL8i6lFtf4BcRJItCgtSTvyTe7Wc5oZ
LXRS+EUj75EcnjYxUtHLkVwAC9eNrmpIYre/ng2fSs293BDEPE9oSD6Yw7xj3V8b
FdMCGM5/rFn0c5L52fNEL8JUzqfK6Dfu0f5Ox1tpVHT7Tlf6Di13ViZnsZ96lCS7
QUV0MGR0o86djDFR6YIQhHvdAgbIrdzvImyYozcxx8x5GuMExSmyE6cFvknbWi8N
C8YudEbHY0moquO2VothAoIBAQDOfzAYkKuy3D2MZcS9vYR+nMQtMBVEi0CpFRwy
APME2+jD1zqXvemqe7YQifWHlhnaUfX8yRVoA00DUZHt+wRSn+SJWc93ZLnPqgpJ
KsByWSxey9JFSUIdQvuA8zsLmoQ+GMbXQbby52kc7l5BmM6baWF20wqyUU/29UYJ
iKm7MuLnKI5Y3FSJwbKJDB2Dlhhh0ckCovyN+XeLW6F0JnBTb0l7Dy4YxtAXco1i
9cMZ8+drDsA/B5L4O5xYtTvrtCLEswR+1w83MqjYq/m1ydY1XG1r4DdzGWHKEADj
k+dzNYbpnNiAnf9d4IrOjS8luc1KQaEjlEp+TiP6IefZ1XM/AoIBAQDFQa9j6tUr
NtLD6iQ2lGdZ4yc4Lyr+boW0+zwhiEk6fFwan2TF6WzzuGDR9iMjnxrFHuKtLmlS
Ljcd95/LTvZqRp8b6HaPzsKokIXeDn1JsvoZY9/+8LdQoERDfQg4Uo12S8soZ2Iq
3epF+uIFgA0TFI9bPWMF9XjmtLGLgoyvFj8jylErdf4WeKLQd8XQ4JqcNCDxyagY
Qx6vZ+lA9D8NtaGeL1uCvVzWqFFYOVNDIvYHjuGRZNvYAtO1sxzPbJkgKI/th8+Y
G1gbZS/a7V/iey42D4rNSsLrubkR7uRFAZHlZwM1F2t+Rf32FTu5Y7fW7W9huxgS
+CsLnyZQrx2VAoH/PuqBvPpXVifEmQJo72bO98TMAPilgjzrdpj3/kRLxy85vHHX
aGR0zXzj/CYMqUMSnXJbgKnD2+0lid1QmTHiH0qYV0EF9Vq7QoqMl75u5GhHHJr9
dh7cBg5ikueJFf/+Su1BqFRdaaUYYbg+/72PNcrl505l8+7SbmxM6pq5HFBk0gmJ
VYnMOCzMOPV4CJ+yzhsdI7CFQry/r7Y7eyg7ETDXMqdtZB8vR/WfHofC6iVmXTgh
WxLztK509JJDr40zCruAoyTjfe3xhBLiAoF8wsVmkXe/bVJOeUJnAvANlQy6DnO7
g3SgWfoQUN6zfssdwYI9lpmYGOO2EoBCJBzlAoIBAQCXOhiA/dSX4NwNH0DMJ1Jk
82VqCZ9omMshSUt8WcPqdtUWBAV6Rc8lusFfttiRwrT/UwJtyxsrygqvityTPeJk
7+ejucDL17QdD0/SQkGDcxeSx6M/DMU9puEu7HiU1ZVmkA0c2MXGH4QwSntlxBpB
+o09Yf683sjl9rn3PwskYGXfxogcTcWS7MHGGU0rKkbeYoivVe7tSugHih6lkZuV
ox5Y6+24efznBPv4K1rOKct9V+lPUofJP8GXl84KqDNtGCvf6zMYZj5SIm1h5oKQ
W+e9woSjhyGRHz3npcKTtPRpb2RiG6ZplLdzJiw3oV+cA0RVJN78DA7URhtV2CtR
AoIBAHkflDjX9FICWvxo3jJkHWm4OKULXqT4nVsP3ua9uGsLCxDFneivKdj3kJjI
iZh3HHzXybeoGyt8jCBKDIjugbnGDaaW4zQOIeN5afsUIyDppRtCspoBD48Hy7g6
9tjg6Ko0iHPONayhsxegchltPhplBlGVnPnzE5/n+FMCyj1LnNOq81VhaSS6t/AW
hgTxz2QzdDsWIxBiJ6KJoXIOBWpHu1sudHgGmpQo6w3yyLYhCJXHyMP9oUi7fBEm
w+DjxmiNCPPWVs+EmL6MiEmqp/Pd0v0wpUOARV2Bnr62OMNyIXNebPpGqlBHPxFW
iD5mKOq6Z4Rivbd2DN+0aIoCgWI=
-----END PRIVATE KEY-----

View file

@ -1,89 +0,0 @@
types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;
image/png png;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;
image/svg+xml svg svgz;
image/webp webp;
application/font-woff woff;
application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.wap.wmlc wmlc;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xspf+xml xspf;
application/zip zip;
application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;
video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;
}

View file

@ -1,119 +0,0 @@
#user www-data;
#worker_processes 4;
pid /tmp/nginx.pid;
error_log /tmp/error-foo;
#events {
# worker_connections 768;
#}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 20;
types_hash_max_size 2048;
include mime.types;
default_type application/octet-stream;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_dhparam dhparams.pem;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 180m;
##
# Logging Settings
##
access_log /tmp/access-main;
error_log /tmp/error-main;
##
# Gzip Settings
##
gzip on;
##
# Phusion Passenger config
##
# Uncomment it if you installed passenger or passenger-enterprise
##
#passenger_root /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini;
#passenger_ruby /home/debshots/.rbenv/versions/2.3.1/bin/ruby;
server {
listen *:8000 default_server;
listen *:8443 ssl;
ssl_certificate screenshots.debian.net.crt;
ssl_certificate_key screenshots.debian.net.key;
ssl_client_certificate debsso.crt;
ssl_crl debsso.crl;
ssl_verify_client optional;
ssl_verify_depth 1;
root ../public;
server_name _;
access_log /tmp/access-front;
error_log /tmp/error-front;
# Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite
# redirection loop because the backend assumes that HTTP was spoken behind the
# proxy.
proxy_set_header X-Forwarded-Proto $scheme;
# Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs
proxy_set_header Host $host;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
gzip_proxied any;
location / {
try_files /maintenance.html @backend;
add_header X-Coffee main;
}
location /json/ {
try_files /maintenance.html @backend;
add_header X-Coffee json;
}
location /favicon.ico {
# try_files /maintenance.html @backend;
alias ../public/favicon.ico;
}
location @backend {
proxy_set_header x_debian_sso_dn $ssl_client_s_dn;
proxy_pass http://127.0.0.1:3000;
}
#location /assets/ {
# alias ../public/assets/;
# expires 1h;
# add_header X-Coffee assets;
#}
location /logo/ {
alias ../public/logo/;
expires 1h;
add_header X-Coffee logo;
}
location /screenshots/ {
alias ../public/screenshots/;
expires max;
add_header X-Coffee screenshots;
}
location /images/ {
alias ../public/images/;
expires 1h;
add_header X-Coffee images;
}
}
}

View file

@ -1,111 +0,0 @@
#!/usr/bin/python3
# Download new versions of the CA certificate and Certificate Revocation List
# from sso.debian.org and write them out atomically.
import requests
import tempfile
import argparse
import os
import subprocess
import ssl
class atomic_writer(object):
"""
Atomically write to a file
"""
def __init__(self, fname, mode, osmode=0o644, sync=True, **kw):
self.fname = fname
self.osmode = osmode
self.sync = sync
dirname = os.path.dirname(self.fname)
self.fd, self.abspath = tempfile.mkstemp(dir=dirname, text="b" not in mode)
self.outfd = open(self.fd, mode, closefd=True, **kw)
def __enter__(self):
return self.outfd
def __exit__(self, exc_type, exc_val, exc_tb):
if exc_type is None:
self.outfd.flush()
if self.sync: os.fdatasync(self.fd)
os.fchmod(self.fd, self.osmode)
os.rename(self.abspath, self.fname)
else:
os.unlink(self.abspath)
self.outfd.close()
return False
def get_url(url):
"""
Fetch a URL and return the raw result as bytes
"""
bundle='/etc/ssl/ca-debian/ca-certificates.crt'
if os.path.exists(bundle):
res = requests.get(url, verify=bundle)
else:
res = requests.get(url)
res.raise_for_status()
return res.content
def update_file(pathname, content, validate=None):
"""
Write content on pathname atomically, and do nothing if pathname exists and
has the same content as `content`.
Returns True if the file has been updated, else False.
"""
try:
with open(pathname, "rb") as fd:
existing = fd.read()
except OSError:
existing = None
if existing == content: return False
# Validate the contents
if validate:
validate(content)
with atomic_writer(pathname, "wb", osmode=0o644) as out:
out.write(content)
return True
def validate_crt(data):
ssl.PEM_cert_to_DER_cert(data.decode("utf-8"))
def validate_crl(data):
if not data.startswith(b"-----BEGIN X509 CRL-----"):
raise RuntimeError("Data does not begin with a CRL signature")
if not data.endswith(b"-----END X509 CRL-----\n"):
raise RuntimeError("Data does not end with a CRL footer")
def update(destdir):
# Fetch the certificate and the CRL
cert = get_url("https://sso.debian.org/ca/ca.pem")
crl = get_url("https://sso.debian.org/ca/ca.crl")
# Write them out atomically
updated = False
updated = update_file(os.path.join(destdir, "debsso.crt"), cert, validate=validate_crt) or updated
updated = update_file(os.path.join(destdir, "debsso.crl"), crl, validate=validate_crl) or updated
return updated
def main():
parser = argparse.ArgumentParser()
parser.add_argument("--destdir", default=".", help="destination directory. Default: .")
parser.add_argument("--onupdate", help="command to run if the file has been updated. Default: do not run anything.")
args = parser.parse_args()
if update(args.destdir):
if args.onupdate:
subprocess.check_call(["sh", "-c", args.onupdate])
if __name__ == "__main__":
main()