# ************************************ # Managed by Puppet # ************************************ NameVirtualHost <%= @vhost_name %>:<%= @port %> # Dedicated port for proxy caching, as not to affect afs mirrors. Listen 8080 NameVirtualHost <%= @vhost_name %>:8080 Listen 8081 NameVirtualHost <%= @vhost_name %>:8081 Listen 8082 NameVirtualHost <%= @vhost_name %>:8082 Listen 8083 NameVirtualHost <%= @vhost_name %>:8083 LogFormat "%h %l %u %t \"%r\" %>s %b %{cache-status}e \"%{Referer}i\" \"%{User-agent}i\"" combined-cache :<%= @port %>> ServerName <%= @srvname %> <% if @serveraliases.is_a? Array -%> <% @serveraliases.each do |name| -%> <%= " ServerAlias #{name}\n" %> <% end %> <% elsif @serveraliases != nil -%> <%= " ServerAlias #{@serveraliases}" -%> <% end %> DocumentRoot <%= @docroot %> > Options <%= @options %> AllowOverride None Order allow,deny allow from all Satisfy any = 2.4> Require all granted # Caching reverse proxy for things that don't make sense in AFS # # General cache rules CacheRoot "/var/cache/apache2/proxy" CacheDirLevels 5 CacheDirLength 2 # SSL support SSLProxyEngine on # Prevent thundering herds. CacheLock on CacheLockPath "/tmp/mod_cache-lock" CacheLockMaxAge 5 # 5GiB CacheMaxFileSize 5368709120 CacheStoreExpired On # Pip sets Cache-Control: max-age=0 on requests for pypi index pages. # This means we don't use the cache for those requests. This setting # should force the proxy to ignore cache-control on the request side # but we should still cache things based on the cache-control responses # from the backed servers. CacheIgnoreCacheControl On # Added Aug 2017 in an attempt to avoid occasional 502 errors (around # 0.05% of requests) of the type: # # End of file found: ... AH01102: error reading status line from remote server ... # # Per [1]: # # This avoids the "proxy: error reading status line from remote # server" error message caused by the race condition that the backend # server closed the pooled connection after the connection check by the # proxy and before data sent by the proxy reached the backend. # # [1] https://httpd.apache.org/docs/2.4/mod/mod_proxy_http.html SetEnv proxy-initial-not-pooled 1 RewriteEngine On # pypi CacheEnable disk "/pypi" ProxyPass "/pypi/" "https://pypi.org/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/pypi/" "https://pypi.org/ # files.pythonhosted.org CacheEnable disk "/pypifiles" ProxyPass "/pypifiles/" "https://files.pythonhosted.org/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/pypifiles/" "https://files.pythonhosted.org/" # Rewrite the locations of the actual files SetOutputFilter INFLATE;SUBSTITUTE;DEFLATE Substitute "s|https://files.pythonhosted.org/|/pypifiles/|ni" # Wheel URL's are: # /wheel/{distro}-{distro-version}/a/a/a-etc.whl # /wheel/{distro}-{distro-version}/a/abcd/abcd-etc.whl # /wheel/{distro}-{distro-version}/a/abcde/abcde-etc.whl RewriteCond %{REQUEST_URI} ^/wheel/([^/]+)/([^/])([^/]*) RewriteCond %{DOCUMENT_ROOT}/wheel/$1/$2/$2$3 -d RewriteRule ^/wheel/([^/]+)/([^/])([^/]*)(/.*)?$ /wheel/$1/$2/$2$3$4 [L] # Special cases for openstack.nose_plugin & backports.* RewriteCond %{REQUEST_URI} ^/wheel/ RewriteRule ^(.*)/openstack-nose-plugin(.*)$ $1/openstack.nose_plugin$2 RewriteCond %{REQUEST_URI} ^/wheel/ RewriteRule ^(.*)/backports-(.*)$ $1/backports.$2 # Try again but replacing -'s with .'s RewriteCond %{REQUEST_URI} ^/wheel/ RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_URI} !-f RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_URI} !-d RewriteRule (.*)-(.*) $1.$2 [N] ErrorLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_error.log LogLevel warn CustomLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_access.log combined-cache ServerSignature Off :8080> ServerName <%= @srvname %>:8080 <% if @serveraliases.is_a? Array -%> <% @serveraliases.each do |name| -%> <%= " ServerAlias #{name}:8080\n" %> <% end %> <% elsif @serveraliases != nil -%> <%= " ServerAlias #{@serveraliases}:8080" -%> <% end %> # Disable directory listing by default. Order Deny,Allow Deny from all Options None AllowOverride None ErrorLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8080_error.log LogLevel warn CustomLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8080_access.log combined-cache ServerSignature Off # Caching reverse proxy for things that don't make sense in AFS # # General cache rules CacheRoot "/var/cache/apache2/proxy" CacheDirLevels 5 CacheDirLength 2 # SSL support SSLProxyEngine on # Prevent thundering herds. CacheLock on CacheLockPath "/tmp/mod_cache-lock" CacheLockMaxAge 5 # 5GiB CacheMaxFileSize 5368709120 CacheStoreExpired On # Added Aug 2017 in an attempt to avoid occasional 502 errors (around # 0.05% of requests) of the type: # # End of file found: ... AH01102: error reading status line from remote server ... # # Per [1]: # # This avoids the "proxy: error reading status line from remote # server" error message caused by the race condition that the backend # server closed the pooled connection after the connection check by the # proxy and before data sent by the proxy reached the backend. # # [1] https://httpd.apache.org/docs/2.4/mod/mod_proxy_http.html SetEnv proxy-initial-not-pooled 1 # Per site caching reverse proxy rules # Only cache specific backends, rely on afs cache otherwise. # buildlogs.centos.org (302 redirects to buildlogs.cdn.centos.org) CacheEnable disk "/buildlogs.centos" ProxyPass "/buildlogs.centos/" "https://buildlogs.centos.org/" ttl=120 disablereuse=On retry=0 ProxyPassReverse "/buildlogs.centos/" "https://buildlogs.centos.org/" # buildlogs.cdn.centos.org CacheEnable disk "/buildlogs.cdn.centos" ProxyPass "/buildlogs.cdn.centos/" "https://buildlogs.cdn.centos.org/" ttl=120 disablereuse=On retry=0 ProxyPassReverse "/buildlogs.cdn.centos/" "https://buildlogs.cdn.centos.org/" # rdo CacheEnable disk "/rdo" ProxyPass "/rdo/" "https://trunk.rdoproject.org/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/rdo/" "https://trunk.rdoproject.org/" # cbs.centos.org CacheEnable disk "/cbs.centos" ProxyPass "/cbs.centos/" "https://cbs.centos.org/repos/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/cbs.centos/" "https://cbs.centos.org/repos/" # pypi CacheEnable disk "/pypi" ProxyPass "/pypi/" "https://pypi.org/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/pypi/" "https://pypi.org/ # files.pythonhosted.org CacheEnable disk "/pypifiles" ProxyPass "/pypifiles/" "https://files.pythonhosted.org/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/pypifiles/" "https://files.pythonhosted.org/" # Rewrite the locations of the actual files SetOutputFilter INFLATE;SUBSTITUTE;DEFLATE Substitute "s|https://files.pythonhosted.org/|/pypifiles/|ni" # images.linuxcontainers.org CacheEnable disk "/images.linuxcontainers" ProxyPass "/images.linuxcontainers/" "http://us.images.linuxcontainers.org/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/images.linuxcontainers/" "http://us.images.linuxcontainers.org/" # registry.npmjs.org CacheEnable disk "/registry.npmjs" ProxyPass "/registry.npmjs/" "https://registry.npmjs.org/" ttl=120 keepalive=On retry=0 nocanon ProxyPassReverse "/registry.npmjs/" "https://registry.npmjs.org/" # api.rubygems.org CacheEnable disk "/api.rubygems" ProxyPass "/api.rubygems/" "https://api.rubygems.org/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/api.rubygems/" "https://api.rubygems.org/" # rubygems.org CacheEnable disk "/rubygems" ProxyPass "/rubygems/" "https://rubygems.org/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/rubygems/" "https://rubygems.org/" # opendaylight CacheEnable disk "/opendaylight" ProxyPass "/opendaylight/" "https://nexus.opendaylight.org/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/opendaylight/" "https://nexus.opendaylight.org/" # elastico CacheEnable disk "/elastic" ProxyPass "/elastic/" "https://packages.elastic.co/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/elastic/" "https://packages.elastic.co/" # grafana CacheEnable disk "/grafana" ProxyPass "/grafana" "https://packagecloud.io/grafana/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/grafana/" "https://packagecloud.io/grafana/" # OracleLinux CacheEnable disk "/oraclelinux" ProxyPass "/oraclelinux/" "http://yum.oracle.com/repo/OracleLinux/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/oraclelinux/" "http://yum.oracle.com/repo/OracleLinux/" # Percona CacheEnable disk "/percona" ProxyPass "/percona/" "https://repo.percona.com/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/percona/" "https://repo.percona.com/" # MariaDB CacheEnable disk "/MariaDB" ProxyPass "/MariaDB/" "https://downloads.mariadb.com/MariaDB/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/MariaDB/" "https://downloads.mariadb.com/MariaDB/" # Docker CacheEnable disk "/docker" ProxyPass "/docker/" "https://download.docker.com/linux/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/docker/" "https://download.docker.com/linux/" # Alpine CacheEnable disk "/alpine" ProxyPass "/alpine/" "http://dl-cdn.alpinelinux.org/alpine/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/alpine/" "http://dl-cdn.alpinelinux.org/alpine/" # LXC (copr) CacheEnable disk "/copr-lxc2" ProxyPass "/copr-lxc2/" "https://copr-be.cloud.fedoraproject.org/results/thm/lxc2.0/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/copr-lxc2/" "https://copr-be.cloud.fedoraproject.org/results/thm/lxc2.0/" # Docker registry v1 proxy. :8081> ServerName <%= @srvname %>:8081 <% if @serveraliases.is_a? Array -%> <% @serveraliases.each do |name| -%> <%= " ServerAlias #{name}:8081\n" %> <% end %> <% elsif @serveraliases != nil -%> <%= " ServerAlias #{@serveraliases}:8081" -%> <% end %> # Disable directory listing by default. Order Deny,Allow Deny from all Options None AllowOverride None ErrorLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8081_error.log LogLevel warn CustomLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8081_access.log combined-cache ServerSignature Off # Caching reverse proxy for things that don't make sense in AFS # # General cache rules CacheRoot "/var/cache/apache2/proxy" CacheDirLevels 5 CacheDirLength 2 # SSL support SSLProxyEngine on # Prevent thundering herds. CacheLock on CacheLockPath "/tmp/mod_cache-lock" CacheLockMaxAge 5 # 5GiB CacheMaxFileSize 5368709120 # Ignore expire headers as the urls use sha256 hashes. CacheIgnoreQueryString On # NOTE(pabelanger): In the case of docker, if neither an expiry date nor # last-modified date are provided default expire to 1 day. This is up from # 1 hour. CacheDefaultExpire 86400 CacheStoreExpired On # registry-1.docker.io CacheEnable disk "/registry-1.docker" ProxyPass "/registry-1.docker/" "https://registry-1.docker.io/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/registry-1.docker/" "https://registry-1.docker.io/" # dseasb33srnrn.cloudfront.net CacheEnable disk "/cloudfront" ProxyPass "/cloudfront/" "https://dseasb33srnrn.cloudfront.net/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/cloudfront/" "https://dseasb33srnrn.cloudfront.net/" # production.cloudflare.docker.com CacheEnable disk "/cloudflare" ProxyPass "/cloudflare/" "https://production.cloudflare.docker.com/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/cloudflare/" "https://production.cloudflare.docker.com/" # Docker registry v2 proxy. :8082> ServerName <%= @srvname %>:8082 <% if @serveraliases.is_a? Array -%> <% @serveraliases.each do |name| -%> <%= " ServerAlias #{name}:8082\n" %> <% end %> <% elsif @serveraliases != nil -%> <%= " ServerAlias #{@serveraliases}:8082" -%> <% end %> # Disable directory listing by default. Order Deny,Allow Deny from all Options None AllowOverride None ErrorLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8082_error.log LogLevel warn CustomLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8082_access.log combined-cache ServerSignature Off # Caching reverse proxy for things that don't make sense in AFS # # General cache rules CacheRoot "/var/cache/apache2/proxy" CacheDirLevels 5 CacheDirLength 2 # SSL support SSLProxyEngine on # Prevent thundering herds. CacheLock on CacheLockPath "/tmp/mod_cache-lock" CacheLockMaxAge 5 # 5GiB CacheMaxFileSize 5368709120 # Ignore expire headers as the urls use sha256 hashes. CacheIgnoreQueryString On # NOTE(pabelanger): In the case of docker, if neither an expiry date nor # last-modified date are provided default expire to 1 day. This is up from # 1 hour. CacheDefaultExpire 86400 CacheStoreExpired On # dseasb33srnrn.cloudfront.net CacheEnable disk "/cloudfront" ProxyPass "/cloudfront/" "https://dseasb33srnrn.cloudfront.net/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/cloudfront/" "https://dseasb33srnrn.cloudfront.net/" # production.cloudflare.docker.com CacheEnable disk "/cloudflare" ProxyPass "/cloudflare/" "https://production.cloudflare.docker.com/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/cloudflare/" "https://production.cloudflare.docker.com/" # NOTE(corvus): Ensure this stanza is last since it's the most # greedy match. CacheEnable disk "/" ProxyPass "/" "https://registry-1.docker.io/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/" "https://registry-1.docker.io/" # Redhat registry proxy. :8083> ServerName <%= @srvname %>:8083 <% if @serveraliases.is_a? Array -%> <% @serveraliases.each do |name| -%> <%= " ServerAlias #{name}:8083\n" %> <% end %> <% elsif @serveraliases != nil -%> <%= " ServerAlias #{@serveraliases}:8083" -%> <% end %> # Disable directory listing by default. Order Deny,Allow Deny from all Options None AllowOverride None ErrorLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8083_error.log LogLevel warn CustomLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8083_access.log combined-cache ServerSignature Off # Caching reverse proxy for things that don't make sense in AFS # # General cache rules CacheRoot "/var/cache/apache2/proxy" CacheDirLevels 5 CacheDirLength 2 # SSL support SSLProxyEngine on # Prevent thundering herds. CacheLock on CacheLockPath "/tmp/mod_cache-lock" CacheLockMaxAge 5 # 5GiB CacheMaxFileSize 5368709120 # Ignore expire headers as the urls use sha256 hashes. CacheIgnoreQueryString On CacheDefaultExpire 86400 CacheStoreExpired On # e14353.d.akamaiedge.net CacheEnable disk "/e14353.d.akamaiedge" ProxyPass "/e14353.d.akamaiedge/" "https://e14353.d.akamaiedge.net/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/e14353.d.akamaiedge/" "https://e14353.d.akamaiedge.net/" # edgekey.net CacheEnable disk "/redhat.com.edgekey" ProxyPass "/redhat.com.edgekey/" "https://registry.access.redhat.com.edgekey.net/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/redhat.com.edgekey/" "https://registry.access.redhat.com.edgekey.net/" # registry.access.redhat.com CacheEnable disk "/" ProxyPass "/" "https://registry.access.redhat.com/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/" "https://registry.access.redhat.com/" # Quay registry proxy. :8084> ServerName <%= @srvname %>:8084 <% if @serveraliases.is_a? Array -%> <% @serveraliases.each do |name| -%> <%= " ServerAlias #{name}:8084\n" %> <% end %> <% elsif @serveraliases != nil -%> <%= " ServerAlias #{@serveraliases}:8084" -%> <% end %> # Disable directory listing by default. Order Deny,Allow Deny from all Options None AllowOverride None ErrorLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8084_error.log LogLevel warn CustomLog /var/log/<%= scope.lookupvar("httpd::params::apache_name") %>/<%= @name %>_8084_access.log combined-cache ServerSignature Off # Caching reverse proxy for things that don't make sense in AFS # # General cache rules CacheRoot "/var/cache/apache2/proxy" CacheDirLevels 5 CacheDirLength 2 # SSL support SSLProxyEngine on # Prevent thundering herds. CacheLock on CacheLockPath "/tmp/mod_cache-lock" CacheLockMaxAge 5 # 5GiB CacheMaxFileSize 5368709120 # Ignore expire headers as the urls use sha256 hashes. CacheIgnoreQueryString On CacheDefaultExpire 86400 CacheStoreExpired On # iah50.r.cloudfront.net CacheEnable disk "/iah50.r.cloudfront.net" ProxyPass "/iah50.r.cloudfront.net/" "https://iah50.r.cloudfront.net/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/iah50.r.cloudfront.net/" "https://iah50.r.cloudfront.net/" # quay.io CacheEnable disk "/" ProxyPass "/" "https://quay.io/" ttl=120 keepalive=On retry=0 ProxyPassReverse "/" "https://quay.io/"