Jimmy Zelinskie
68894a6cad
nginx: comment out last part of OCSP stapling
2015-07-14 18:07:53 -04:00
Jimmy Zelinskie
973aa601ef
nginx: "temporarily" disable OCSP stapling
2015-07-14 17:33:57 -04:00
Jake Moshenko
91b2c21789
Reference our certificate file as trusted to enable OCSP stapling.
2015-07-01 15:35:40 -04:00
Joseph Schorr
784a45372d
Make the doupdatelimits script optional
...
Without the `privileged` flag or the proper kernel capability, this command can fail the start of the container. With this change, we still print the error message, but don't fail container start. The downside of this command not running is a lower maximum connection count (128), which should be okay for most of our enterprise customers.
2015-07-01 15:13:36 +03:00
Jake Moshenko
ee154c37a8
Merge pull request #121 from coreos-inc/robots
...
Add support for custom robots.txt in conf/stack
2015-06-17 15:48:30 -04:00
Jimmy Zelinskie
3166c9a38f
nginx: recompile with SSL module, move directives
2015-06-16 12:30:25 -04:00
Joseph Schorr
191f84fd0b
Add support for custom robots.txt in conf/stack
...
Fixes #115
2015-06-11 12:33:21 -04:00
Jimmy Zelinskie
f7c81e2a34
binarydeps: tengine 2.1.0 -> nginx 1.8.0
...
nginx stable now has unbuffered uploading support, thus we are no longer
required to use tengine.
2015-06-08 15:35:56 -04:00
Jimmy Zelinskie
581d2fa4fc
nginx: move ssl config out of server-base
2015-05-22 16:25:28 -04:00
Jimmy Zelinskie
4323eb58da
nginx: SSL config into server-base.conf
2015-05-22 13:54:43 -04:00
Jimmy Zelinskie
f9f933feff
nginx: update cipher suite, HSTS, X-Frame-Options
2015-05-22 13:35:49 -04:00
Jimmy Zelinskie
60763d69b1
nginx: support OCSP Stapling
2015-05-20 16:32:12 -04:00
Jimmy Zelinskie
4689c00fad
nginx: drop SSLv3, support TLS 1.1 & 1.2
2015-05-20 16:31:32 -04:00
Jimmy Zelinskie
c44846103e
nginx: enable Strict Transport Security
2015-05-20 16:31:00 -04:00
Joseph Schorr
3f1e8f3c27
Add a RepositoryActionCount table so we can use it (instead of LogEntry) when scoring repo search results
2015-04-13 13:31:07 -04:00
Jake Moshenko
24cf27bd12
Route all of the logging through syslog-ng. Add the ability to specify extra syslog-ng config. Simplify the Dockerfile.
2015-03-26 09:22:47 -04:00
Jimmy Zelinskie
b4b06ec8c8
nginx: add comment explaining repo rate limiting
2015-02-25 12:32:48 -05:00
Jimmy Zelinskie
2a826f52d4
nginx: rename api rate limit bucket to verbs
2015-02-25 12:32:30 -05:00
Jimmy Zelinskie
ebff374408
nginx: tweak rate limiting; remove webapp limiting
2015-02-25 12:22:41 -05:00
Jimmy Zelinskie
ef61145b2c
Merge branch 'master' of github.com:coreos-inc/quay
2015-02-23 20:54:15 -05:00
Jimmy Zelinskie
7554c47a30
nginx: burst=5 for API calls
...
This means that requests are delayed until the client reaches the burst
rate and then they will receive the 429.
2015-02-23 20:53:21 -05:00
Jake Moshenko
a0833b7978
Fix the worker timeout for synchronous verbs workers.
2015-02-23 16:02:22 -05:00
Jake Moshenko
291c1c810b
Merge remote-tracking branch 'origin/hotfix'
...
Conflicts:
conf/proxy-server-base.conf
2015-02-19 17:37:44 -05:00
Jimmy Zelinskie
4a2b25200a
nginx: make rate limiting awesome
2015-02-19 16:24:05 -05:00
Jimmy Zelinskie
01811ee793
nginx: add missing semicolon
2015-02-19 13:31:49 -05:00
Jimmy Zelinskie
11c5632121
nginx: remove blacklisted IP
2015-02-19 12:46:03 -05:00
Jimmy Zelinskie
b7159293c1
nginx: create unauth/auth ratelimiting
...
This also removes nodelay on rate limiting and temporarily blacklists an
IP address.
2015-02-19 12:32:06 -05:00
Jake Moshenko
04b06547b8
Remove all of the timeouts since they were not doing the right thing anyway.
2015-02-18 17:04:25 -05:00
Joseph Schorr
f107b50a46
Merge branch 'master' into ackbar
2015-02-12 12:04:45 -05:00
Joseph Schorr
42db221576
Disable proxy server buffer changes
2015-02-11 16:25:09 -05:00
Jake Moshenko
0f3d87466e
Unify the logging infrastructure and turn the prod logging level to INFO in preparation for picking up a new cloud logger.
2015-02-11 14:15:18 -05:00
Jimmy Zelinskie
3abb5bf0a3
nginx: set proxy_buffer_size to 6MB
...
Because tags are included in our sessions, pushes containing many tags
will make our headers larger than the buffer nginx uses to send to the
client and then nginx is unable to validate the headers.
2015-02-10 15:48:27 -05:00
Joseph Schorr
9dfe523615
Merge master changes
2015-02-05 13:11:16 -05:00
Jake Moshenko
11562a74de
Remove the old builder infrastructure.
2015-01-29 11:03:23 -05:00
Jimmy Zelinskie
24365fb960
nginx: rate-limiting for /c1/
2015-01-26 15:42:56 -05:00
Jimmy Zelinskie
f99025f123
nginx: adjust proxy protocol rate limiting values
2015-01-26 15:03:27 -05:00
Joseph Schorr
30b895b795
Merge branch 'grunt-js-folder' of https://github.com/coreos-inc/quay into ackbar
2015-01-23 17:26:14 -05:00
Jimmy Zelinskie
b5f7777fd7
nginx: create proxy-server-base.conf w/ rate limit
2015-01-23 16:50:16 -05:00
Jimmy Zelinskie
64bea5387b
nginx: rate limiting only on proxy protocol
2015-01-23 16:04:06 -05:00
Jimmy Zelinskie
a185b53db4
nginx: set real IP from any address
2015-01-23 15:13:24 -05:00
Jimmy Zelinskie
b19b256b52
Proxy Protocol on port 8443
2015-01-22 16:10:02 -05:00
Jimmy Zelinskie
a715d97660
health check endpoint without proxy protocol
2015-01-22 12:58:48 -05:00
Jimmy Zelinskie
73557f20b9
add missing semicolon
2015-01-22 12:16:04 -05:00
Jimmy Zelinskie
365290d3c4
Add and include proxy-protocol.conf
2015-01-21 17:11:23 -05:00
Jimmy Zelinskie
e93d0b83ec
reset nginx config to master
2015-01-21 17:00:43 -05:00
Jimmy Zelinskie
0f8aad9ef1
Break out a new server{} config for port 444>
...
This also restores docker proxy stuff with recursive enabled
2015-01-21 15:59:29 -05:00
Jimmy Zelinskie
b7d6d42317
comment out docker reverse proxy stuff
2015-01-21 15:05:35 -05:00
Jimmy Zelinskie
c992657f05
health check on port 444
2015-01-21 13:43:21 -05:00
Jimmy Zelinskie
312ba536d9
move proxy protocol to ssl listen directive
2015-01-21 11:19:41 -05:00
Jimmy Zelinskie
a5569b124d
only set real_ip from local subnet
2015-01-20 17:46:06 -05:00
