Serve channel nixexprs.tar.xz directly
By not going through CloudFront, we can serve it over https, which makes channels more secure. (Though we still need to enable signing of the binary cache.)
Eelco Dolstra committed
Aug 5, 2014 at 12:52 UTC
6fa860c3d574044749cf4c0386417066ff957049
1 file changed
+5
-27
nixos-org/webserver.nix
+5
-27
@@ -15,14 +15,12 @@ let
15
[ { urlPath = "/irc";
16
dir = "/data/irc";
17
}
18
- /*
19
- { urlPath = "/update";
20
- dir = "/data/webserver/update";
21
- }
22
- */
18
{ urlPath = "/channels";
19
dir = "/releases/channels";
20
}
21
+ { urlPath = "/releases";
22
+ dir = "/releases";
23
+ }
24
{ urlPath = "/nix/manual";
25
dir = "/releases/nix/latest/manual";
26
}
@@ -41,32 +39,14 @@ let
39
40
extraConfig =
41
''
44
- #<Proxy *>
45
- # Order deny,allow
46
- # Allow from all
47
- #</Proxy>
48
- #
49
- #ProxyPreserveHost On
50
- #
51
- #ProxyPass /mturk http://wendy:3000/mturk retry=5
52
- #ProxyPassReverse /mturk http://wendy:3000/mturk
53
- #ProxyPass /mturk-sandbox http://wendy:3001/mturk-sandbox retry=5
54
- #ProxyPassReverse /mturk-sandbox http://wendy:3001/mturk-sandbox
55
-
42
MaxKeepAliveRequests 0
43
58
- # Use a very short error message for 404s in the binary
59
- # cache, since those are very frequent and not generally
60
- # seen by humans.
61
- <Location /releases/binary-cache>
62
- ErrorDocument 404 "No such file."
63
- </Location>
64
-
44
Redirect /binary-cache http://cache.nixos.org
45
Redirect /releases/channels /channels
67
- Redirect /releases http://releases.nixos.org
46
Redirect /tarballs http://tarballs.nixos.org
47
48
+ RedirectMatch ^/releases/(.*\.(iso|ova))$ http://releases.nixos.org/$1
49
+
50
<Location /server-status>
51
SetHandler server-status
52
Allow from 127.0.0.1
@@ -137,8 +117,6 @@ in
117
''
118
SSLCertificateChainFile /root/ssl-secrets/startssl-class1.pem
119
SSLCACertificateFile /root/ssl-secrets/startssl-ca.pem
140
- # Required by Catalyst.
141
- RequestHeader set X-Forwarded-Port 443
120
'';
121
extraSubservices =
122
[ { function = import <services/subversion>;