.Pirátská strana » Technický odbor

Bump.

Ahoj Lukáši, můžu se zeptat jakým právem přiřazuješ řešitele v úkolech TO?

Protoze mam tu moznost, kdybych ji nemel, tak na to asik pravo nemam.

Dekuji, dal bys tu proxy prosim na gitlab, at je mozny delat review? Diky.

Takhle by to mohlo stacit:

server {
    listen              443 ssl;
    server_name         ipx.pirati.cz;
    resolver 8.8.8.8 ipv6=off;

    location / {
        return 404;
    }

    location ~ ^/(?<target_scheme>https?):/(?<target_host>[^/]*)/(?<target_path>.*)$ {
        valid_referers none blocked server_names ~\.pirati\.cz;

        if ($invalid_referer) {
            return 403;
        }
        image_filter test;
        image_filter_buffer 4M;
        proxy_pass_request_body off;
        proxy_intercept_errors on;
        error_page 301 302 307 =200 @redir; 
        proxy_pass_request_headers off;
        proxy_method GET;
        proxy_set_header Host $target_host;
        proxy_pass $target_scheme://$target_host/$target_path$is_args$args;

        proxy_buffering on;
        proxy_cache ipx;
        proxy_cache_valid 200 24h;
        proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
        proxy_ignore_headers X-Accel-Redirect X-Accel-Expires X-Accel-Limit-Rate X-Accel-Buffering X-Accel-Charset Expires Cache-Control Set-Cookie;
        proxy_hide_header Cache-Control;
        proxy_hide_header Set-Cookie;
        proxy_hide_header Expires;
        proxy_hide_header ETag;
        proxy_hide_header Last-Modified;
        proxy_hide_header Access-Control-Allow-Methods;
        proxy_hide_header Access-Control-Allow-Origin;
        proxy_hide_header Range;
        proxy_cache_lock on;
            proxy_http_version 1.1;
        proxy_cache_lock_timeout    300s;
        proxy_set_header    Connection  "keep-alive";
        proxy_set_header    User-Agent  "Mozilla/5.0 (X11; Linux x86_64; rv:10.0.5) Gecko/20120601 Firefox/10.0.5";
        proxy_set_header    Accept-Encoding  "";
        proxy_set_header    Accept-Language "en-us,en;q=0.5";
        proxy_set_header    Accept          "*/*";
        proxy_set_header    Referer $target_scheme://$target_host/$target_path$is_args$args;
        expires 24h;
    }

    location @redir { 
        return 302 https://ipx.pirati.cz/$upstream_http_location;
    } 
}

Docela good...

• SNI je broken.
• misto prepisu VERB na upstream proste odmitni jakekoliv jinej VERB na vstupu (jelikoz ani proxy_pass_request_headers off; nezabrani preposlani Content-Length apod., proste exploze)
• posilej nejakej rozumejsi Accept, nektery servery ti misto obrazku jinak naserviruji html
• ... fakt by to bylo lepsi na tom gitlabu...

Jo a sekundarnim smyslem toho ipx bylo neco jako archiv, cache na 24 hodin uplne neni, to co sem tim zamyslel.

Archiv není možný viz paragraf 4 zákona 480/2004 Sb. Za připomínky diky.

Proc nepostupujeme podle § 5?