kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(package-cache-frontend): restore upstreams.conf from before 16.2.0

Browse Source 
The 16.2.0 release commit (e2501cb1de) shipped a locally generated
`compose/package-cache-frontend/upstreams.conf`, the output of the cache
generator that only exists on the feature branches (230d9a1e5e). It adds
TLS server blocks for argos-net.com, huggingface.co, index.crates.io,
registry.ollama.ai and static.crates.io, but main's `cert-gen.sh` issues
no certificates for them. nginx then dies on start with

    cannot load certificate "/etc/nginx/certs/argos-net.com.crt"

the frontend stays unhealthy, pypi.org on the runner refuses connections,
and `make install-lint` fails in every workspace job (run 39482585010).

Restore the file byte for byte to its state before the release (blob
b5c5ef08e7), the version every workspace job passed with in run
39443109355.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kevinveenbirkenbachandClaude Opus 5.5 committed 2026-10-20 22:30:36 +02:00
1 parent d04a5ed2c2
commit bc56beb7e9
1 file changed
+96 -133
Download Patch File Download Diff File Expand all files Collapse all files
compose/package-cache-frontend/upstreams.conf
+96 -133
View File
@@ -9,8 +9,49 @@ proxy_request_buffering off;
proxy_read_timeout 300s;
proxy_connect_timeout 30s;
# Docker embedded DNS, pinned to bypass image-specific resolv.conf order.
resolver 127.0.0.11 ipv6=off valid=30s;
# Nexus answers 502 when a proxy's remote is unreachable (measured) and has no
# group repository type for apt, so the mirror failover sits here rather than in
# the repo layout. 5xx only: a 404 means the file genuinely is not in the suite,
# and apt probes for missing files often enough that retrying those would double
# the request rate.
#
# Nexus answers that 502 only after trying every address of the remote in turn,
# one connect timeout each; for a remote with several addresses that outlasts a
# client's own timeout before the mirror is ever asked.
#
# These stay prefix locations. A regex location forfeits nginx's implicit
# `/debian` -> `/debian/` redirect, and the URL-reachability test probes exactly
# that slash-less form through the runner's DNS hijack, so it turns into a 404.
server {
listen 80;
server_name deb.debian.org;
location /debian/ {
rewrite ^/debian/(.*)$ /repository/apt-debian/$1 break;
proxy_intercept_errors on;
proxy_read_timeout 8s;
error_page 502 503 504 = @debian_mirror;
proxy_pass http://package-cache:8081;
}
location @debian_mirror {
rewrite ^/repository/apt-debian/(.*)$ /repository/apt-debian-mirror/$1 break;
proxy_pass http://package-cache:8081;
}
location /debian-security/ {
rewrite ^/debian-security/(.*)$ /repository/apt-debian-security/$1 break;
proxy_intercept_errors on;
proxy_read_timeout 8s;
error_page 502 503 504 = @debian_security_mirror;
proxy_pass http://package-cache:8081;
}
location @debian_security_mirror {
rewrite ^/repository/apt-debian-security/(.*)$ /repository/apt-debian-security-mirror/$1 break;
proxy_pass http://package-cache:8081;
}
}
server {
listen 80;
server_name archive.ubuntu.com;
@@ -18,59 +59,26 @@ server {
rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu/$1 break;
proxy_intercept_errors on;
proxy_read_timeout 8s;
error_page 502 503 504 = @apt_ubuntu_mirror;
error_page 502 503 504 = @ubuntu_mirror;
proxy_pass http://package-cache:8081;
}
location @apt_ubuntu_mirror {
location @ubuntu_mirror {
rewrite ^/repository/apt-ubuntu/(.*)$ /repository/apt-ubuntu-mirror/$1 break;
proxy_pass http://package-cache:8081;
}
}
server {
listen 443 ssl;
server_name argos-net.com;
ssl_certificate /etc/nginx/certs/argos-net.com.crt;
ssl_certificate_key /etc/nginx/certs/argos-net.com.key;
location / {
proxy_read_timeout 1800s;
proxy_pass http://package-cache:8081/repository/raw-argos-net/;
}
}
server {
listen 443 ssl;
server_name codeload.github.com;
ssl_certificate /etc/nginx/certs/codeload.github.com.crt;
ssl_certificate_key /etc/nginx/certs/codeload.github.com.key;
location / {
proxy_pass http://package-cache:8081/repository/raw-codeload-github/;
}
}
server {
listen 80;
server_name deb.debian.org;
location /debian/ {
rewrite ^/debian/(.*)$ /repository/apt-debian/$1 break;
server_name security.ubuntu.com;
location /ubuntu/ {
rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu-security/$1 break;
proxy_intercept_errors on;
proxy_read_timeout 8s;
error_page 502 503 504 = @apt_debian_mirror;
error_page 502 503 504 = @ubuntu_security_mirror;
proxy_pass http://package-cache:8081;
}
location @apt_debian_mirror {
rewrite ^/repository/apt-debian/(.*)$ /repository/apt-debian-mirror/$1 break;
proxy_pass http://package-cache:8081;
}
location /debian-security/ {
rewrite ^/debian-security/(.*)$ /repository/apt-debian-security/$1 break;
proxy_intercept_errors on;
proxy_read_timeout 8s;
error_page 502 503 504 = @apt_debian_security_mirror;
proxy_pass http://package-cache:8081;
}
location @apt_debian_security_mirror {
rewrite ^/repository/apt-debian-security/(.*)$ /repository/apt-debian-security-mirror/$1 break;
location @ubuntu_security_mirror {
rewrite ^/repository/apt-ubuntu-security/(.*)$ /repository/apt-ubuntu-security-mirror/$1 break;
proxy_pass http://package-cache:8081;
}
}
@@ -86,11 +94,11 @@ server {
server {
listen 443 ssl;
server_name dl-cdn.alpinelinux.org;
ssl_certificate /etc/nginx/certs/dl-cdn.alpinelinux.org.crt;
ssl_certificate_key /etc/nginx/certs/dl-cdn.alpinelinux.org.key;
server_name pypi.org;
ssl_certificate /etc/nginx/certs/pypi.org.crt;
ssl_certificate_key /etc/nginx/certs/pypi.org.key;
location / {
proxy_pass http://package-cache:8081/repository/raw-alpine/;
proxy_pass http://package-cache:8081/repository/pypi-proxy/;
}
}
@@ -104,71 +112,13 @@ server {
}
}
server {
listen 443 ssl;
server_name huggingface.co;
ssl_certificate /etc/nginx/certs/huggingface.co.crt;
ssl_certificate_key /etc/nginx/certs/huggingface.co.key;
location / {
proxy_pass http://package-cache:8081/repository/raw-huggingface/;
}
}
server {
listen 443 ssl;
server_name index.crates.io;
ssl_certificate /etc/nginx/certs/index.crates.io.crt;
ssl_certificate_key /etc/nginx/certs/index.crates.io.key;
location / {
proxy_pass http://package-cache:8081/repository/raw-crates-index/;
}
}
server {
listen 443 ssl;
server_name index.rubygems.org;
ssl_certificate /etc/nginx/certs/index.rubygems.org.crt;
ssl_certificate_key /etc/nginx/certs/index.rubygems.org.key;
location / {
proxy_pass http://package-cache:8081/repository/gem-proxy/;
}
}
server {
listen 443 ssl;
server_name proxy.golang.org;
ssl_certificate /etc/nginx/certs/proxy.golang.org.crt;
ssl_certificate_key /etc/nginx/certs/proxy.golang.org.key;
location / {
proxy_pass http://package-cache:8081/repository/go-proxy/;
}
}
server {
listen 443 ssl;
server_name pypi.org;
ssl_certificate /etc/nginx/certs/pypi.org.crt;
ssl_certificate_key /etc/nginx/certs/pypi.org.key;
location / {
proxy_pass http://package-cache:8081/repository/pypi-proxy/;
}
}
server {
listen 443 ssl;
server_name raw.githubusercontent.com;
ssl_certificate /etc/nginx/certs/raw.githubusercontent.com.crt;
ssl_certificate_key /etc/nginx/certs/raw.githubusercontent.com.key;
location / {
proxy_pass http://package-cache:8081/repository/raw-githubusercontent/;
}
}
server {
listen 443 ssl;
server_name registry.npmjs.org;
ssl_certificate /etc/nginx/certs/registry.npmjs.org.crt;
ssl_certificate_key /etc/nginx/certs/registry.npmjs.org.key;
# Tarball URLs Nexus emits already carry /repository/npm-proxy/; pass them
# through as-is (no path on proxy_pass) so they aren't double-prefixed → 404.
location /repository/npm-proxy/ {
proxy_pass http://package-cache:8081;
}
@@ -179,11 +129,20 @@ server {
server {
listen 443 ssl;
server_name registry.ollama.ai;
ssl_certificate /etc/nginx/certs/registry.ollama.ai.crt;
ssl_certificate_key /etc/nginx/certs/registry.ollama.ai.key;
server_name rubygems.org;
ssl_certificate /etc/nginx/certs/rubygems.org.crt;
ssl_certificate_key /etc/nginx/certs/rubygems.org.key;
location / {
proxy_pass http://package-cache:8081/repository/raw-ollama-registry/;
proxy_pass http://package-cache:8081/repository/gem-proxy/;
}
}
server {
listen 443 ssl;
server_name index.rubygems.org;
ssl_certificate /etc/nginx/certs/index.rubygems.org.crt;
ssl_certificate_key /etc/nginx/certs/index.rubygems.org.key;
location / {
proxy_pass http://package-cache:8081/repository/gem-proxy/;
}
}
@@ -199,36 +158,40 @@ server {
server {
listen 443 ssl;
server_name rubygems.org;
ssl_certificate /etc/nginx/certs/rubygems.org.crt;
ssl_certificate_key /etc/nginx/certs/rubygems.org.key;
server_name proxy.golang.org;
ssl_certificate /etc/nginx/certs/proxy.golang.org.crt;
ssl_certificate_key /etc/nginx/certs/proxy.golang.org.key;
location / {
proxy_pass http://package-cache:8081/repository/gem-proxy/;
}
}
server {
listen 80;
server_name security.ubuntu.com;
location /ubuntu/ {
rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu-security/$1 break;
proxy_intercept_errors on;
proxy_read_timeout 8s;
error_page 502 503 504 = @apt_ubuntu_security_mirror;
proxy_pass http://package-cache:8081;
}
location @apt_ubuntu_security_mirror {
rewrite ^/repository/apt-ubuntu-security/(.*)$ /repository/apt-ubuntu-security-mirror/$1 break;
proxy_pass http://package-cache:8081;
proxy_pass http://package-cache:8081/repository/go-proxy/;
}
}
server {
listen 443 ssl;
server_name static.crates.io;
ssl_certificate /etc/nginx/certs/static.crates.io.crt;
ssl_certificate_key /etc/nginx/certs/static.crates.io.key;
server_name dl-cdn.alpinelinux.org;
ssl_certificate /etc/nginx/certs/dl-cdn.alpinelinux.org.crt;
ssl_certificate_key /etc/nginx/certs/dl-cdn.alpinelinux.org.key;
location / {
proxy_pass http://package-cache:8081/repository/raw-crates-static/;
proxy_pass http://package-cache:8081/repository/raw-alpine/;
}
}
server {
listen 443 ssl;
server_name raw.githubusercontent.com;
ssl_certificate /etc/nginx/certs/raw.githubusercontent.com.crt;
ssl_certificate_key /etc/nginx/certs/raw.githubusercontent.com.key;
location / {
proxy_pass http://package-cache:8081/repository/raw-githubusercontent/;
}
}
server {
listen 443 ssl;
server_name codeload.github.com;
ssl_certificate /etc/nginx/certs/codeload.github.com.crt;
ssl_certificate_key /etc/nginx/certs/codeload.github.com.key;
location / {
proxy_pass http://package-cache:8081/repository/raw-codeload-github/;
}
}