Newer
Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
log_format pypi_cache '$remote_addr - $host [$time_local] '
'request_time=$request_time upstream_time=$upstream_response_time '
'cache_status=$upstream_cache_status \t'
'$status "$request" $body_bytes_sent';
access_log /dev/stdout pypi_cache buffer=64k flush=1s;
# Log to file, can be useful for dev
# access_log /var/log/nginx/cache.log pypi_cache buffer=64k flush=1s;
# Cache 50G worth of packages for up to 1 month
proxy_cache_path /var/lib/nginx/pypi levels=1:2 keys_zone=pypi:16m inactive=1M max_size=50G use_temp_path=off;
# Having the same upstream server listed twice allegedly forces nginx to retry
# connections and not fail the request immediately.
upstream sg_pypi {
server pypi.org:443;
server pypi.org:443;
keepalive 16;
}
upstream sg_pythonhosted {
server files.pythonhosted.org:443;
server files.pythonhosted.org:443;
keepalive 16;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name {{fqdn}};
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.3;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
ssl_certificate '/etc/ssl/step/{{fqdn}}.crt';
ssl_certificate_key '/etc/ssl/step/{{fqdn}}.key';
ssl_session_timeout 10m;
add_header Strict-Transport-Security max-age=15768000;
location / {
set $deny_access 1;
{% for client in haproxy_cns %}
if ($ssl_client_s_dn = "CN={{client}}" ){
set $deny_access 0;
}
{% endfor %}
if ($ssl_client_verify != "SUCCESS"){
set $deny_access 1;
}
if ($deny_access != 0){
return 403;
}
proxy_set_header Connection "";
proxy_set_header Accept-Encoding "";
proxy_cache_valid 200 301 10m;
proxy_cache_valid 404 1m;
proxy_set_header Host pypi.org;
proxy_ssl_name pypi.org;
proxy_pass 'https://sg_pypi';
proxy_redirect 'https://pypi.org' $scheme://$host;
}
proxy_cache pypi;
proxy_cache_key $uri/$http_accept_encoding;
proxy_cache_lock on;
proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
proxy_http_version 1.1;
proxy_ssl_server_name on;
# sub_filter can't apply to gzipped content, so be careful about that
add_header X-Pypi-Cache $upstream_cache_status;
sub_filter 'https://pypi.org' $scheme://$host;
sub_filter 'https://files.pythonhosted.org/packages' $scheme://$host/packages;
sub_filter_once off;
sub_filter_types application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html;
location ^~ /simple {
proxy_set_header Connection "";
proxy_set_header Accept-Encoding "";
proxy_cache_valid 200 301 10m;
proxy_cache_valid 404 1m;
proxy_set_header Host pypi.org;
proxy_ssl_name pypi.org;
proxy_pass 'https://sg_pypi';
proxy_redirect 'https://pypi.org' $scheme://$host;
}
location ^~ /packages {
proxy_set_header Connection "";
proxy_set_header Accept-Encoding "";
proxy_cache_valid 200 301 1M;
proxy_cache_valid 404 1m;
proxy_set_header Host files.pythonhosted.org;
proxy_ssl_name files.pythonhosted.org;
proxy_pass 'https://sg_pythonhosted/packages';
proxy_redirect 'https://files.pythonhosted.org/packages' $scheme://$host/packages;
}
location /nginx_status {
stub_status;
}
}