Mirror Server - Revision history

Tiziano: /* Fetch restricting */

2014-08-22T18:28:55Z

Fetch restricting

← Older revision		Revision as of 20:28, 22 August 2014
Line 37:		Line 37:
	== Packaging notes ==		== Packaging notes ==

	=== Fetch ~~restricting~~ ===		=== Fetch restriction ===

	To avoid passive information disclosure all packages requiring source files from at least one of the restricted locations must be fetch restricted (if possible). Otherwise a client may in some circumstances try to fetch the package from a public mirror, leaving traces in the respective access log.		To avoid passive information disclosure all packages requiring source files from at least one of the restricted locations must be fetch restricted (if possible). Otherwise a client may in some circumstances try to fetch the package from a public mirror, leaving traces in the respective access log.

Tiziano at 18:28, 22 August 2014

2014-08-22T18:28:26Z

@@ Line 34: / Line 34: @@
              └── distfiles
 </pre>
 [[Category:Infrastructure]]

Tiziano: /* Directory structure */

2014-08-21T11:31:25Z

Directory structure

← Older revision		Revision as of 13:31, 21 August 2014
Line 21:		Line 21:

	<pre>		<pre>
	/		├── public
	\|- public/		│ ├── gentoo
	\|- gentoo/		│ │ └── distfiles
	\|- distfiles/		│ └── stepping-stone.ch
	\|- stepping-stone.ch/		│ └── sepiola
	\|- sepiola/		├── role-restricted
	\|- site-restricted/		│ ├── crm_sugarcrm_mysql
	\|- stepping-stone.ch/		│ └── wiki_mediawiki_mysql
	\|- gentoo/		└── site-restricted
	\|- distfiles/		└── stepping-stone.ch
	~~\|- role-restricted/~~		└── gentoo
	~~\|- wiki_mediawiki_mysql~~		└── distfiles
	~~\|- crm_sugarcrm_mysql~~
	</pre>		</pre>

	[[Category:Infrastructure]]		[[Category:Infrastructure]]

Tiziano: /* Directory structure */

2014-08-21T11:20:34Z

Directory structure

← Older revision		Revision as of 13:20, 21 August 2014
Line 32:		Line 32:
	\|- distfiles/		\|- distfiles/
	\|- role-restricted/		\|- role-restricted/
	\|- ~~mediawiki_mysql~~		\|- wiki_mediawiki_mysql
			\|- crm_sugarcrm_mysql
	</pre>		</pre>

	[[Category:Infrastructure]]		[[Category:Infrastructure]]

Tiziano: /* Directory structure */

2014-08-21T11:20:02Z

Directory structure

← Older revision		Revision as of 13:20, 21 August 2014
Line 32:		Line 32:
	\|- distfiles/		\|- distfiles/
	\|- role-restricted/		\|- role-restricted/
	\|- ~~mediawiki_AiO~~		\|- mediawiki_mysql
	</pre>		</pre>

	[[Category:Infrastructure]]		[[Category:Infrastructure]]

Tiziano: /* Requirements */

2014-08-21T11:19:44Z

Requirements

← Older revision		Revision as of 13:19, 21 August 2014
Line 7:		Line 7:
	* Distinguishes between three groups of files		* Distinguishes between three groups of files
	** '''public''': Files which are available to all clients (theoretically even to the entire internet, added to clients via GENTOO_MIRRORS)		** '''public''': Files which are available to all clients (theoretically even to the entire internet, added to clients via GENTOO_MIRRORS)
	** '''site-~~local~~''': Files which are only available to authenticated clients belonging to the same infrastructure (for example those which would put us into [http://www.bettercallsaul.com/ legal troubles] if available to the public, used by clients via a ''local'' entry in <code>/etc/portage/mirrors</code>)		** '''site-restricted''': Files which are only available to authenticated clients belonging to the same infrastructure (for example those which would put us into [http://www.bettercallsaul.com/ legal troubles] if available to the public, used by clients via a ''local'' entry in <code>/etc/portage/mirrors</code>)
	*** A subdirectory named after a site will be created below <code>site-local</code>, for example <code>site-local/example-site</code>.		*** A subdirectory named after a site will be created below <code>site-local</code>, for example <code>site-local/example-site</code>.
	** '''~~stack~~-~~local~~''': Files which are only available to authenticated clients belonging to the same infrastructure and the software stack group (private files of a specific customer, used by clients via a ''local'' entry in <code>/etc/portage/mirrors</code>)		** '''role-restricted''': Files which are only available to authenticated clients belonging to the same infrastructure and the software stack group (private files of a specific customer, used by clients via a ''local'' entry in <code>/etc/portage/mirrors</code>)
	*** A subdirectory per ~~stack~~ will be created below <code>~~stack~~-~~local~~</code>, for example <code>~~stack~~-~~local~~/~~secret-stack~~</code>.		*** A subdirectory per role will be created below <code>role-restricted</code>, for example <code>role-restricted/mediawiki_mysql</code>.
	* Provides an easy way to let an administrator manually upload new files, for example via WebDAV-CGI, SFTP or a similar mechanism.		* Provides an easy way to let an administrator manually upload new files, for example via WebDAV-CGI, SFTP or a similar mechanism.
	* Possibility to authenticate clients either via HTTP basic auth or client certificates.		* Possibility to authenticate clients either via HTTP basic auth or client certificates.
	* Old or no longer supported files will be removed automatically		* Old or no longer supported files will be removed automatically
	* Can be implemented on the [[#Build_host_requirements\|build host]]		* Can be implemented on the [[#Build_host_requirements\|build host]]


	== Directory structure ==		== Directory structure ==

Tiziano at 11:17, 21 August 2014

2014-08-21T11:17:54Z

← Older revision		Revision as of 13:17, 21 August 2014
Line 1:		Line 1:
			== Requirements ==

			* Hosts all the files required to build a package (<code>GENTOO_MIRRORS=mirror.example.com/public/gentoo/distfiles</code>)
			** Acts as a caching mirror for already downloaded packages from an official mirror, example caching mirror URL https://mirror.example.com/mirror
			** Serves fetch-restricted files (<code>dev-java/oracle-jdk-bin</code> for example), to authorized clients
			* Files are served via HTTPS
			* Distinguishes between three groups of files
			** '''public''': Files which are available to all clients (theoretically even to the entire internet, added to clients via GENTOO_MIRRORS)
			** '''site-local''': Files which are only available to authenticated clients belonging to the same infrastructure (for example those which would put us into [http://www.bettercallsaul.com/ legal troubles] if available to the public, used by clients via a ''local'' entry in <code>/etc/portage/mirrors</code>)
			*** A subdirectory named after a site will be created below <code>site-local</code>, for example <code>site-local/example-site</code>.
			** '''stack-local''': Files which are only available to authenticated clients belonging to the same infrastructure and the software stack group (private files of a specific customer, used by clients via a ''local'' entry in <code>/etc/portage/mirrors</code>)
			*** A subdirectory per stack will be created below <code>stack-local</code>, for example <code>stack-local/secret-stack</code>.
			* Provides an easy way to let an administrator manually upload new files, for example via WebDAV-CGI, SFTP or a similar mechanism.
			* Possibility to authenticate clients either via HTTP basic auth or client certificates.
			* Old or no longer supported files will be removed automatically
			* Can be implemented on the [[#Build_host_requirements\|build host]]


	== Directory structure ==		== Directory structure ==

Tiziano: /* Directory structure */

2014-08-21T11:16:42Z

Directory structure

← Older revision		Revision as of 13:16, 21 August 2014
Line 6:		Line 6:
	/		/
	\|- public/		\|- public/
	\|- gentoo/		\|- gentoo/
	\|- distfiles/		\|- distfiles/
	\|- stepping-stone.ch/		\|- stepping-stone.ch/
	\|- sepiola/		\|- sepiola/
	\|- site-restricted/		\|- site-restricted/
	\|- stepping-stone.ch/		\|- stepping-stone.ch/
	\|- gentoo/		\|- gentoo/
	\|- distfiles/		\|- distfiles/
	\|- role-restricted/		\|- role-restricted/
	\|- mediawiki_AiO		\|- mediawiki_AiO
	</pre>		</pre>

	[[Category:Infrastructure]]		[[Category:Infrastructure]]

Tiziano at 11:16, 21 August 2014

2014-08-21T11:16:12Z

← Older revision		Revision as of 13:16, 21 August 2014
Line 1:		Line 1:
			== Directory structure ==

			The visible structure starting from the root directory will be as follows:

			<pre>
			/
			\|- public/
			\|- gentoo/
			\|- distfiles/
			\|- stepping-stone.ch/
			\|- sepiola/
			\|- site-restricted/
			\|- stepping-stone.ch/
			\|- gentoo/
			\|- distfiles/
			\|- role-restricted/
			\|- mediawiki_AiO
			</pre>

	[[Category:Infrastructure]]		[[Category:Infrastructure]]

Michael: Created page with " Category:Infrastructure"

2014-04-21T17:42:47Z

Created page with " Category:Infrastructure"

New page

[[Category:Infrastructure]]