0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-09 04:06:42 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5 8e94002f17 fix(package-cache): restore apt slash redirect

The mirror failover turned the four apt locations into regex locations.
nginx only synthesises the `/debian` -> `/debian/` redirect for prefix
locations, so the slash-less form started answering 404. Inside a runner
`deb.debian.org` is DNS-hijacked to this frontend and the URL
reachability test probes exactly that form, which took the debian,
fedora and centos workspace jobs down.

The locations are prefix locations again, byte for byte as before. The
only thing that stays is the error path: the named location picks up the
already-rewritten `$uri` and rewrites it once more onto the mirror repo,
so the failover survives without a capture variable.

Measured against a simulated hijack: both bare paths 200 again, all four
suite indexes 200, and with `apt-debian` pointed at a dead remote
`dists/bookworm/InRelease` still arrives with 151 kB through
apt-debian-mirror.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-04 20:16:36 +02:00

cert-gen.sh

fix(cache): self-heal package-cache-frontend CA missing keyUsage

2026-06-17 11:30:47 +02:00

README.md

…

upstreams.conf

fix(package-cache): restore apt slash redirect

2026-08-04 20:16:36 +02:00

README.md

Package-Cache Frontend (TLS-terminating reverse proxy) 🔐

TLS-terminating reverse proxy in front of the Sonatype Nexus 3 OSS package-cache service. Owns the real upstream package-manager hostnames via DNS-hijack so clients reach the cache transparently.

For services, activation, coverage, and operations of the local cache stack, see cache.md.

Files 📄

upstreams.conf: nginx server-blocks. HTTPS (port 443) per hostname for runner-side traffic, HTTP (port 80) for inner-dockerd Dockerfile builds. Bind-mounted at /etc/nginx/conf.d/upstreams.conf.