hydra-proxy: allow downloads to bypass anubis
This fixes access for distrobuilder, which retrieves LXC/Incus images for redistribution. Also removes the X-From map that is no longer required.
Martin Weinelt committed
Nov 21, 2025 at 01:51 UTC
c81db02bc2f01801d20ee37fe04db107b6668952
1 file changed
+8
-8
build/hydra-proxy.nix
+8
-8
@@ -43,9 +43,13 @@
43
'';
44
45
appendHttpConfig = ''
46
- map $http_x_from $upstream {
47
- default "anubis";
48
- nix.dev-Uogho3gi "hydra-server";
46
+ map $request_uri $backend {
47
+ default anubis;
48
+
49
+ # downloads (e.g. distrobuilder for lxc/incus images)
50
+ ~^/build/\d+/download/ hydra-server;
51
+ ~^/build/\d+/download-by-type/ hydra-server;
52
+ ~^/job/[^/]+/[^/]+/[^/]+/latest/download-by-type/file/ hydra-server;
53
}
54
55
limit_req_zone $binary_remote_addr zone=hydra-server:8m rate=2r/s;
@@ -87,16 +91,12 @@
91
};
92
93
locations."/" = {
90
- proxyPass = "http://$upstream";
94
+ proxyPass = "http://$backend";
95
extraConfig = ''
96
limit_req zone=hydra-server burst=7;
97
'';
98
};
99
96
- locations."~ ^/build/\\d+/download/" = {
97
- proxyPass = "http://hydra-server";
98
- };
99
-
100
locations."/static/" = {
101
alias = "${config.services.hydra-dev.package}/libexec/hydra/root/static/";
102
};