From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id 0IlHNrJkgWFF1AAAgWs5BA (envelope-from ) for ; Tue, 02 Nov 2021 17:17:54 +0100 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id MOvkMbJkgWHXZwAAbx9fmQ (envelope-from ) for ; Tue, 02 Nov 2021 16:17:54 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 07A8714C01 for ; Tue, 2 Nov 2021 17:17:54 +0100 (CET) Received: from localhost ([::1]:57426 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mhwTx-00047O-42 for larch@yhetil.org; Tue, 02 Nov 2021 12:17:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54776) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mhwMN-00074q-4w for bug-guix@gnu.org; Tue, 02 Nov 2021 12:10:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:54561) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1mhwMM-0006QQ-K9 for bug-guix@gnu.org; Tue, 02 Nov 2021 12:10:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1mhwMM-0003Ri-77 for bug-guix@gnu.org; Tue, 02 Nov 2021 12:10:02 -0400 X-Loop: help-debbugs@gnu.org Subject: bug#37348: [PATCH] hydra: berlin: Redirect HTTP to HTTPS by default. References: <8736h643ke.fsf@rekahsoft.ca> In-Reply-To: <8736h643ke.fsf@rekahsoft.ca> Resent-From: Tobias Geerinckx-Rice Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Tue, 02 Nov 2021 16:10:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 37348 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: 37348@debbugs.gnu.org Received: via spool by 37348-submit@debbugs.gnu.org id=B37348.163586937313197 (code B ref 37348); Tue, 02 Nov 2021 16:10:02 +0000 Received: (at 37348) by debbugs.gnu.org; 2 Nov 2021 16:09:33 +0000 Received: from localhost ([127.0.0.1]:37874 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mhwLs-0003Qn-H5 for submit@debbugs.gnu.org; Tue, 02 Nov 2021 12:09:32 -0400 Received: from tobias.gr ([80.241.217.52]:55320) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mhwLn-0003QZ-HN for 37348@debbugs.gnu.org; Tue, 02 Nov 2021 12:09:31 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=2018; bh=KIv53D+NWLVlI ApTMryx3dbI+Adi23ntbjxkeFhnEmc=; h=date:subject:to:from; d=tobias.gr; b=Xji601vQspBMcEGqi5ccGA0WpHQigkJXLKETKn/oaxdseVq2lbFDoKmPABYKD1wi8s7n VpE5apcvMjpObXSKqexqzkzKGVJbWqLNYOaxsIwCODPSbvBdwKd6y1BBzX/2H3Kmccdqrs h8GQ+Af8rc/V1z9YmUpIGENOZB/u1Du94TpSG6Urlv1PTNp/pC8lrNvSZJedpEI5Dc80HG T8iFRwgj5L+/eECB9UGLqFgvaK2PcacMMKB1oFaQzDbYwbwEJcXlb2mppeYALh0RaT4OwW zztqx1txycPy4qjcux0Gy/oStKjwoWzv/UCpKTOmTpJOUEWNuWc5Cv8q5gLfJfJw== Received: by submission.tobias.gr (OpenSMTPD) with ESMTPSA id 86798975 (TLSv1.3:AEAD-AES256-GCM-SHA384:256:NO) for <37348@debbugs.gnu.org>; Tue, 2 Nov 2021 16:09:21 +0000 (UTC) Date: Tue, 2 Nov 2021 17:09:50 +0100 Message-Id: <20211102160950.20467-1-me@tobias.gr> X-Mailer: git-send-email 2.33.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-guix@gnu.org List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+larch=yhetil.org@gnu.org Sender: "bug-Guix" Reply-to: Tobias Geerinckx-Rice From: Tobias Geerinckx-Rice via Bug reports for GNU Guix X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1635869874; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:resent-cc: resent-from:resent-sender:resent-message-id:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=KIv53D+NWLVlIApTMryx3dbI+Adi23ntbjxkeFhnEmc=; b=VFbgJpI7MwZ0TgCnM3DFyaZTm6S6p51+xdmghzbEhpqcTwADcSelSp30t89ofUozjYReKe UFO1tVBq0tL8a1fgMPawZSz9a+VyyADzkU1KkVOKeCikypug8Y47WbkvnhCYp6QZFAPOgb Fk6p+fcQZk0AXG4zK86ORP4VEG0EK1wsneAtbCZY9IuHLXjwCcVKvXG2Csdb3LJTGsNkra 5ds9OqaU/LhVQ2CFLhuVeL1KETARJQ+g+UeCB6jqDVPflOJo8hOM6pA5JQ/zMmHAryWixR wa3jB/GdlX54z9bt2JnyTobpWvEv6EDnRt3Lierjn508Por+3vn+XpQsqa/IeQ== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1635869874; a=rsa-sha256; cv=none; b=ACz9N1eel8T+xHcwg/6WJz4Lgkfzr8DN97MhK3RHcNdrHvwyh/wfM/Ol8tO7tWtPqVq37O oR+Ekoqq0zC5V+zVXWEUuqmO6O5bTS4ySbjvEHRhbXkndJ0/d9XKkmN+kYr8xoiWowoSj+ FY6Dw+NxhYQ5ZhAh9sFiX4SdIknjHLWNpkZHzut5I9LKRrdV2HLLjMji23aNTOqYqSYEuv n1pEGzXqti0S5+2UwhfPL67m6svx4hM40RyjV3AFB+SuoFgCEgPy+egK25eB1I3d1Oxcj/ fV9CnKOco/F0uP0FqAralrX+eG7LKBaK7wvDiRK9xYNqeB1tWDHrMoT7/UvyWA== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=tobias.gr header.s=2018 header.b=Xji601vQ; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of bug-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=bug-guix-bounces@gnu.org X-Migadu-Spam-Score: -2.92 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=tobias.gr header.s=2018 header.b=Xji601vQ; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of bug-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=bug-guix-bounces@gnu.org X-Migadu-Queue-Id: 07A8714C01 X-Spam-Score: -2.92 X-Migadu-Scanner: scn0.migadu.com X-TUID: Lf4aJ38O2cym * hydra/nginx/berlin.scm (%berlin-servers): Add a default port-80 server to redirect all requests to their HTTPS counterparts. Remove explicit HTTP support for guix.gnu.org and issues.guix.gnu.org. --- All, Like Chris I'm not convinced there was anything ‘missing’, but this is a practice whose time has come and come again and left several voice mails at this point. People are going to keep asking for it. The old ‘user choice’ argument always rung hollow to me. Shall we just do this? This is a conservative patch: it only redirects guix.gnu.org and issues.guix.gnu.org, the most (potential-)user-facing sites, to HTTPS. CI should probably remain reachable over HTTP indefinitely. Subprojects like GWL, friends like Bootstrappable, and anything else retain ‘user choice’, until they opt in. Kind regards, T G-R hydra/nginx/berlin.scm | 42 +++++++----------------------------------- 1 file changed, 7 insertions(+), 35 deletions(-) diff --git a/hydra/nginx/berlin.scm b/hydra/nginx/berlin.scm index 4713d7b..38854e3 100644 --- a/hydra/nginx/berlin.scm +++ b/hydra/nginx/berlin.scm @@ -797,31 +797,37 @@ PUBLISH-URL." (body (list "try_files $uri /$lang/$uri /$lang/$uri/index.html =404;"))) (nginx-location-configuration ;certbot (uri "/.well-known") (body (list "root /var/www;"))))) (define guix.gnu.org-locations (append guix.gnu.org-redirect-locations (guix.gnu.org-redirects-for-each-language) guix.gnu.org-other-locations)) (define %publish-url "http://localhost:3000") (define %berlin-servers (list - ;; Plain HTTP + ;; Redirect domains that don't explicitly support HTTP (below) to HTTPS. + (nginx-server-configuration + (listen '("80")) + (raw-content + (list "return 308 https://$host$request_uri;"))) + + ;; Domains that still explicitly support plain HTTP. (nginx-server-configuration (listen '("80")) (server-name '("ci.guix.gnu.org")) (locations (berlin-locations %publish-url)) (raw-content (list "access_log /var/log/nginx/http.access.log;" "proxy_set_header X-Forwarded-Host $host;" "proxy_set_header X-Forwarded-Port $server_port;" "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;"))) (nginx-server-configuration (listen '("80")) (server-name '("bootstrappable.org" "www.bootstrappable.org")) @@ -829,64 +835,30 @@ PUBLISH-URL." (raw-content (list "access_log /var/log/nginx/bootstrappable.access.log;"))) (nginx-server-configuration (listen '("80")) (server-name '("disarchive.guix.gnu.org")) (root "/gnu/disarchive") (raw-content ;; Tell nginx to always read 'FILE.gz' when asked for 'FILE', and to ;; gunzip it on the fly (because the client for this typically doesn't ;; properly support gzip encoding). (list "gzip_static always; gunzip on;\n" "access_log /var/log/nginx/disarchive.access.log;"))) - (nginx-server-configuration - (listen '("80")) - (server-name '("guix.gnu.org")) - (root "/srv/guix.gnu.org") - (locations guix.gnu.org-locations) - (raw-content - (list - "add_header Content-Security-Policy \"frame-ancestors 'none'\";" - - ;; TODO This works around NGinx using the epoch for the - ;; Last-Modified date, as well as the etag. - ;; See http://issues.guix.gnu.org/37207 - "add_header Last-Modified \"\";" - "if_modified_since off;" - "etag off;" - - "rewrite (.*)/$ $1/index.html;" - "access_log /var/log/nginx/guix-info.access.log;"))) - - (nginx-server-configuration - (listen '("80")) - (server-name '("issues.guix.gnu.org")) - (root "/home/rekado/mumi/") - (locations - (list (nginx-location-configuration ;certbot - (uri "/.well-known") - (body (list "root /var/www;"))) - (nginx-location-configuration - (uri "/") - (body '("proxy_pass http://localhost:1234;"))))) - (raw-content - (list - "access_log /var/log/nginx/issues-guix-info.access.log;"))) - (nginx-server-configuration (listen '("80")) (server-name '("guixwl.org" "www.guixwl.org")) (root "/home/rekado/gwl/") (locations (list (nginx-location-configuration ;certbot (uri "/.well-known") (body (list "root /var/www;"))) (nginx-location-configuration (uri "/manual") (body (list "alias /srv/gwl-manual;"))) ;; Pass requests to 'guix workflow --web-interface'. base-commit: 9782bc16ef4384171c7b7381ad27a4b9ba60ca61 -- 2.33.0