diyIT/FreeBSD
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

apr 19 update

Browse Source
This commit is contained in:
Sharad Ahlawat
2022-04-19 13:38:56 -07:00
parent a0a9496aef
commit 18dd3d9761
208 changed files with 12435 additions and 1112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
jails/config/pkgp/freebsd-update.conf
View File

@ -1,4 +1,4 @@
# $FreeBSD: releng/12.2/usr.sbin/freebsd-update/freebsd-update.conf 337338 2018-08-04 22:25:41Z brd $
# $FreeBSD: releng/12.3/usr.sbin/freebsd-update/freebsd-update.conf 370439 2021-08-29 16:58:35Z kevans $
# Trusted keyprint. Changing this is a Bad Idea unless you've received
# a PGP-signed email from <security-officer@FreeBSD.org> telling you to
@ -10,6 +10,8 @@ KeyPrint 800651ef4b4c71c27e60786d7b487188970f4b4169cc055784e21eb71d410cc5
# using a "nearby" server won't provide a measurable improvement in
# performance.
ServerName update.FreeBSD.org
# caching not used as I am mounting the /var/db/freebsd-update/files directory into every jail
#ServerName pkgp-freebsd-update.ahlawat.com
# Components of the base system which should be kept updated.
Components src world
@ -74,3 +76,6 @@ MergeChanges /etc/ /boot/device.hints
# When backing up a kernel also back up debug symbol files?
# BackupKernelSymbolFiles no
# Create a new boot environment when installing patches
# CreateBootEnv yes

6
jails/config/pkgp/mypkgs
View File

@ -1,18 +1,18 @@
net/haproxy
net/openldap24-server
net/openldap24-client
net/openldap24-sasl-client
security/cyrus-sasl2
www/apache24
devel/apr1
net/php74-ldap
net/php81-ldap
net/php80-ldap
mail/postfix
mail/dovecot
mail/dovecot-pigeonhole
mail/rspamd
mail/dcc-dccd
net/netatalk3
net/samba411
net/samba413
net/nss-pam-ldapd
net/nss-pam-ldapd-sasl
#security/pam_ldap # included above

96
jails/config/pkgp/nginx.conf
View File

@ -1,28 +1,24 @@
user www wheel;
worker_processes 8;
error_log /var/log/nginx/error.log;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
# access_log /var/log/nginx/access.log;
access_log /var/log/nginx/access.log;
access_log off;
error_log /var/log/nginx/error.log;
sendfile on;
sendfile_max_chunk 512k;
tcp_nopush on;
aio on;
sendfile on;
tcp_nopush on;
resolver 192.168.0.5 [fd01::5];
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $host;
server {
listen *:80;
listen [::]:80;
@ -40,7 +36,6 @@ http {
}
#error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/local/www/nginx-dist;
@ -48,18 +43,31 @@ http {
}
server {
listen *:443 ssl;
listen [::]:443 ssl;
listen *:443 ssl http2;
listen [::]:443 ssl http2;
server_name pkgp.ahlawat.com;
root /usr/local/share/poudriere/html;
ssl_certificate /mnt/certs/fullchain.pem;
ssl_certificate_key /mnt/certs/privkey.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
# modern configuration
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /mnt/certs/fullchain.pem;
location /data {
alias /mnt/poudriere/data/logs/bulk;
@ -72,31 +80,43 @@ http {
}
#error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/local/www/nginx-dist;
}
}
proxy_cache_path /mnt/cache/pkg/ levels=1:2 keys_zone=pkg_cache:10m max_size=10g inactive=10d use_temp_path=off;
# https://www.nginx.com/blog/nginx-caching-guide/
# https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_valid
proxy_cache_path /mnt/cache/pkg/ levels=1:2 keys_zone=pkg_cache:10m max_size=10g inactive=1d use_temp_path=off;
server {
listen *:80;
listen [::]:80;
server_name pkgp-freebsd-pkg.ahlawat.com;
root /mnt/cache/pkg/;
autoindex on;
if_modified_since before;
# root /mnt/cache/pkg/;
# autoindex on;
proxy_http_version 1.1;
proxy_socket_keepalive on;
proxy_set_header Host $host;
# add_header X-Proxy-Cache $upstream_cache_status;
location / {
proxy_cache pkg_cache;
proxy_cache_valid 1d;
proxy_cache_revalidate on;
proxy_cache_lock on;
proxy_next_upstream error timeout invalid_header http_404;
proxy_ignore_headers X-Accel-Expires Expires Cache-Control Set-Cookie;
proxy_hide_header X-Accel-Expires;
proxy_hide_header Expires;
proxy_hide_header Cache-Control;
proxy_hide_header Set-Cookie;
proxy_pass http://pkg-mirrors;
proxy_http_version 1.1;
# add_header X-Proxy-Cache $upstream_cache_status;
proxy_next_upstream error timeout invalid_header http_404;
}
}
upstream pkg-mirrors {
@ -110,7 +130,7 @@ http {
listen [::]:8001;
server_name localhost;
location / {
proxy_pass http://pkg0.isc.FreeBSD.org;
proxy_pass http://pkg0.tuk.FreeBSD.org;
}
}
@ -119,7 +139,7 @@ http {
listen [::]:8002;
server_name localhost;
location / {
proxy_pass http://pkg0.tuk.FreeBSD.org;
proxy_pass http://pkg0.bbt.FreeBSD.org;
}
}
@ -132,27 +152,38 @@ http {
}
}
proxy_cache_path /mnt/cache/update/ levels=1:2 keys_zone=update_cache:10m max_size=10g inactive=10d use_temp_path=off;
proxy_cache_path /mnt/cache/update/ levels=1:2 keys_zone=update_cache:10m max_size=10g inactive=1d use_temp_path=off;
server {
listen *:80;
listen [::]:80;
server_name pkgp-freebsd-update.ahlawat.com;
root /mnt/cache/update/;
if_modified_since before;
# root /mnt/cache/update/;
# autoindex on;
proxy_http_version 1.1;
proxy_socket_keepalive on;
proxy_set_header Host $host;
# add_header X-Proxy-Cache $upstream_cache_status;
location / {
proxy_cache update_cache;
proxy_cache_valid 1d;
proxy_cache_revalidate on;
proxy_cache_lock on;
proxy_next_upstream error timeout invalid_header http_404;
proxy_ignore_headers X-Accel-Expires Expires Cache-Control Set-Cookie;
proxy_hide_header X-Accel-Expires;
proxy_hide_header Expires;
proxy_hide_header Cache-Control;
proxy_hide_header Set-Cookie;
proxy_pass http://update-mirrors;
proxy_http_version 1.1;
# add_header X-Proxy-Cache $upstream_cache_status;
proxy_next_upstream error timeout invalid_header http_404;
}
}
upstream update-mirrors {
keepalive 4;
server localhost:8011;
server localhost:8012;
server localhost:8013;
@ -193,4 +224,5 @@ http {
proxy_pass http://update4.FreeBSD.org;
}
}
}

9
jails/config/pkgp/pkgp.conf
View File

@ -9,3 +9,12 @@ pkgp-freebsd-pkg: {
enabled: yes,
priority: 10
}
pkgp123: {
url: "http://pkgp.ahlawat.com/packages/pj123-default",
mirror_type: "http",
signature_type: "pubkey",
pubkey: "/mnt/data/apps/certs/poudriere.cert",
enabled: no,
priority: 100
}