Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Disallow cloudfront from accessing ostree refs and summray

Browse source 
Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
This commit is contained in:
Patrick Uiterwijk 2019-01-30 20:17:06 +01:00
parent c16f040a40
commit f10ce98e0f
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
roles/httpd/reverseproxy/templates/reversepassproxy.kojipkgs.conf
View file

@ -1,5 +1,18 @@
{% if rewrite %}
RewriteEngine On
# Make sure that CloudFront does not cache ostree summary or refs files.
# These should always be requested directly from Fedora, so any user directly
# hitting a cloudfront setup should update their configuration.
RewriteCond %{HTTP:X-Amz-Cf-Id} !^$
RewriteRule ^/atomic/repo/summary - [F]
RewriteCond %{HTTP:X-Amz-Cf-Id} !^$
RewriteRule ^/atomic/repo/refs - [F]
RewriteCond %{HTTP:X-Amz-Cf-Id} !^$
RewriteRule ^/ostree/repo/summary - [F]
RewriteCond %{HTTP:X-Amz-Cf-Id} !^$
RewriteRule ^/ostree/repo/refs - [F]
RewriteRule ^{{remotepath}}$ %{REQUEST_URI}/ [R=301]
{% endif %}