diff --git a/server/logrotate.conf b/server/logrotate.conf deleted file mode 100644 index 5bf60fc..0000000 --- a/server/logrotate.conf +++ /dev/null @@ -1,19 +0,0 @@ -/srv/dpaste.de/var/*.log { - monthly - rotate 52 - dateext - missingok - compress - delaycompress - notifempty - create 0640 www-data adm - sharedscripts - prerotate - if [ -d /etc/logrotate.d/httpd-prerotate ]; then \ - run-parts /etc/logrotate.d/httpd-prerotate; \ - fi \ - endscript - postrotate - invoke-rc.d nginx rotate >/dev/null 2>&1 - endscript -} diff --git a/server/nginx.conf b/server/nginx.conf deleted file mode 100644 index fd6b594..0000000 --- a/server/nginx.conf +++ /dev/null @@ -1,120 +0,0 @@ -limit_req_zone $binary_remote_addr zone=login:10m rate=2r/s; - -upstream app_server { - server 127.0.0.1:12000 fail_timeout=0; -} - -# Combined log with remote:local port logged -log_format combined_port '$remote_addr - $remote_user [$time_local] ' - '"$request" $status $body_bytes_sent ' - '"$http_referer" "$http_user_agent" "$remote_port:$server_port"'; - -# ----------------------------------------------------------------------------- -# Redirect all sort of non-ssl (with and without www) to ssl without www -# ----------------------------------------------------------------------------- -server { - listen 80; - - server_name dpaste.de - www.dpaste.de - dpaste.org - www.dpaste.org; - - location / { - rewrite ^ https://$server_name$request_uri? permanent; - } - - location /.well-known/acme-challenge/ { - alias /var/www/challenges/; - try_files $uri =404; - } -} - -# ----------------------------------------------------------------------------- -# SSL Hosts -# ----------------------------------------------------------------------------- - -server { - listen 443 ssl spdy; - - server_name dpaste.org www.dpaste.org; - - ssl on; - ssl_certificate /srv/dpaste.de/etc/ssl/dpaste_org_chained.pem; - ssl_certificate_key /srv/dpaste.de/etc/ssl/dpaste_org.key; - ssl_dhparam /etc/ssl/dhparam.pem; - - # SSL modern config for modern browsers Pete told me - ssl_prefer_server_ciphers on; - ssl_protocols TLSv1.1 TLSv1.2; - ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK'; - ssl_stapling on; - ssl_stapling_verify on; - - add_header Strict-Transport-Security max-age=25200; - - # Redirect to dpaste.de - location / { - rewrite ^/(.*)$ https://dpaste.de/$1 permanent; - } -} - -server { - listen 443 ssl spdy; - - server_name dpaste.de www.dpaste.de; - - ssl on; - ssl_certificate /srv/dpaste.de/etc/ssl/dpaste_de_chained.pem; - ssl_certificate_key /srv/dpaste.de/etc/ssl/dpaste_de.key; - ssl_dhparam /etc/ssl/dhparam.pem; - - # SSL modern config for modern browsers Pete told me - ssl_prefer_server_ciphers on; - ssl_protocols TLSv1.1 TLSv1.2; - ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK'; - ssl_stapling on; - ssl_stapling_verify on; - - add_header Strict-Transport-Security max-age=25200; - - # Rewrite www to non-www - if ($host = www.dpaste.de) { - rewrite ^/(.*)$ https://dpaste.de/$1 permanent; - } - - access_log /var/log/nginx/dpaste.access.log combined_port; - error_log /var/log/nginx/dpaste.error.log; - - keepalive_timeout 5; - client_max_body_size 10M; - - location ~ /(favicon.ico|robots.txt) { - access_log off; - log_not_found off; - expires 3d; - } - - location /webalizer/ { - alias /srv/dpaste.de/var/webalizer/; - auth_basic "Restricted"; - auth_basic_user_file /srv/dpaste.de/var/.htpasswd; - } - - location /static/ { - alias /srv/dpaste.de/var/static/; - } - - location / { - - limit_req zone=login burst=5; - - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $http_host; - proxy_redirect off; - proxy_buffering off; - proxy_pass http://app_server; - break; - } -} - diff --git a/server/upstart.conf b/server/upstart.conf deleted file mode 100644 index 3b94afb..0000000 --- a/server/upstart.conf +++ /dev/null @@ -1,16 +0,0 @@ -start on (static-network-up and started mysql) -stop on shutdown - -respawn -respawn limit 10 5 - -setuid www-data -setgid www-data - -exec /srv/dpaste.de/bin/gunicorn dpaste.wsgi:application \ - --user=www-data \ - --group=www-data \ - --workers=2 \ - --error-logfile=/srv/dpaste.de/var/gunicorn.error.log \ - --pid=/srv/dpaste.de/var/gunicorn.pid \ - --bind=127.0.0.1:12000 diff --git a/server/webalizer.conf b/server/webalizer.conf deleted file mode 100644 index a5e720f..0000000 --- a/server/webalizer.conf +++ /dev/null @@ -1,810 +0,0 @@ -# -# Sample Webalizer configuration file -# Copyright 1997-2013 by Bradford L. Barrett -# -# Distributed under the GNU General Public License. See the -# files "Copyright" and "COPYING" provided with the webalizer -# distribution for additional information. -# -# This is a sample configuration file for the Webalizer (ver 2.23) -# Lines starting with pound signs '#' are comment lines and are -# ignored. Blank lines are skipped as well. Other lines are considered -# as configuration lines, and have the form "ConfigOption Value" where -# ConfigOption is a valid configuration keyword, and Value is the value -# to assign that configuration option. Invalid keyword/values are -# ignored, with appropriate warnings being displayed. There must be -# at least one space or tab between the keyword and its value. -# -# As of version 0.98, The Webalizer will look for a 'default' configuration -# file named "webalizer.conf" in the current directory, and if not found -# there, will look for "/etc/webalizer.conf". - - -# LogFile defines the web server log file to use. If not specified -# here or on on the command line, input will default to STDIN. If -# the log filename ends in '.gz' (a gzip compressed file), or '.bz2' -# (bzip2 compressed file), it will be decompressed on the fly as it -# is being read. - -LogFile /var/log/nginx/dpaste.access.log.1 - -# LogType defines the log type being processed. Normally, the Webalizer -# expects a CLF or Combined web server log as input. Using this option, -# you can process ftp logs (xferlog as produced by wu-ftp and others), -# Squid native logs or W3C extended format web logs. Values can be 'clf', -# 'ftp', 'squid' or 'w3c'. The default is 'clf'. - -#LogType clf - -# OutputDir is where you want to put the output files. This should -# should be a full path name, however relative ones might work as well. -# If no output directory is specified, the current directory will be used. - -OutputDir /srv/dpaste.de/var/webalizer - -# HistoryName allows you to specify the name of the history file produced -# by the Webalizer. The history file keeps the data for previous months, -# and is used for generating the main HTML page (index.html). The default -# is a file named "webalizer.hist", stored in the output directory being -# used. The name can include a path, which will be relative to the output -# directory unless absolute (starts with a leading '/'). - -#HistoryName webalizer.hist - -# Incremental processing allows multiple partial log files to be used -# instead of one huge one. Useful for large sites that have to rotate -# their log files more than once a month. The Webalizer will save its -# internal state before exiting, and restore it the next time run, in -# order to continue processing where it left off. This mode also causes -# The Webalizer to scan for and ignore duplicate records (records already -# processed by a previous run). See the README file for additional -# information. The value may be 'yes' or 'no', with a default of 'no'. -# The file 'webalizer.current' is used to store the current state data, -# and is located in the output directory of the program (unless changed -# with the IncrementalName option below). Please read at least the section -# on Incremental processing in the README file before you enable this option. - -Incremental yes - -# IncrementalName allows you to specify the filename for saving the -# incremental data in. It is similar to the HistoryName option where the -# name is relative to the specified output directory, unless an absolute -# filename is specified. The default is a file named "webalizer.current" -# kept in the normal output directory. If you don't specify "Incremental" -# as 'yes' then this option has no meaning. - -IncrementalName webalizer.current - -# ReportTitle is the text to display as the title. The hostname -# (unless blank) is appended to the end of this string (separated with -# a space) to generate the final full title string. -# Default is (for english) "Usage Statistics for". - -ReportTitle Usage statistics for - -# HostName defines the hostname for the report. This is used in -# the title, and is prepended to the URL table items. This allows -# clicking on URLs in the report to go to the proper location in -# the event you are running the report on a 'virtual' web server, -# or for a server different than the one the report resides on. -# If not specified here, or on the command line, webalizer will -# try to get the hostname via a uname system call. If that fails, -# it will default to "localhost". - -HostName dpaste.de - -# HTMLExtension allows you to specify the filename extension to use -# for generated HTML pages. Normally, this defaults to "html", but -# can be changed for sites who need it (like for PHP embeded pages). - -#HTMLExtension html - -# PageType lets you tell the Webalizer what types of URLs you -# consider a 'page'. Most people consider html and cgi documents -# as pages, while not images and audio files. If no types are -# specified, defaults will be used ('htm*', 'cgi' and HTMLExtension -# if different for web logs, 'txt' for ftp logs). - -PageType htm* -PageType cgi -#PageType phtml -PageType php3 -#PageType pl -PageType php - -# PagePrefix allows all requests with a specified prefix to be -# considered as 'pages'. If you want everything under /documents -# to be treated as pages no matter what their extension is. Also -# useful if you have cgi-scripts with PATH_INFO. - -#PagePrefix /documents -#PagePrefix /mycgi/parameters - -# OmitPage lets you tell the Webalizer that certain URLs do not -# contain any pages. No URL matching an OmitPage value will be -# counted as a page, even if it matches a PageType above or has -# no extension (e.g., a directory). They will still be counted -# as a hit. - -#OmitPage /render - -# UseHTTPS should be used if the analysis is being run on a -# secure server, and links to urls should use 'https://' instead -# of the default 'http://'. If you need this, set it to 'yes'. -# Default is 'no'. This only changes the behaviour of the 'Top -# URLs' table. - -UseHTTPS yes - -# HTAccess allows the generation of a default .htaccess file in the -# output directory. If enabled, a default .htaccess file will be -# created (with a single "DirectoryIndex" directive), unless one -# already exists. Values may be 'yes' or 'no', with 'no' -# being the default (don't write .htaccess files). - -#HTAccess no - -# StripCGI determines if URL CGI variables should be striped or not. -# Historically, the Webalizer stripped all CGI variables from the end -# of URLs to improve accuracy. Some sites may prefer to keep the CGI -# variables in place, particularly those with highly dynamic pages. -# Values may be 'yes' or 'no', with the default being 'yes'. - -#StripCGI yes - -# The TrimSquidURL option only has effect on squid type log files. -# When analyzing a squid log, it is usually desirable to have less -# granularity on the URLs. TrimSquidURL = n where n is a number > 0 -# causes all URLs to be truncated after the nth '/' after the http:// -# portion. Setting TrimSquidURL to one (1) will cause all URLs to be -# summarized by domain only. The default is zero (0), which disables -# any such truncation and preserve the URLs as they are in the log. - -# TrimSquidURL 0 - -# DNSCache specifies the DNS cache filename to use for reverse DNS lookups. -# This file must be specified if you wish to perform name lookups on any IP -# addresses found in the log file. If an absolute path is not given as -# part of the filename (ie: starts with a leading '/'), then the name is -# relative to the default output directory. See the DNS.README file for -# additional information. - -#DNSCache dns_cache.db - -# DNSChildren allows you to specify how many "children" processes are -# run to perform DNS lookups to create or update the DNS cache file. -# If a number is specified, the DNS cache file will be created/updated -# each time the Webalizer is run, immediately prior to normal processing, -# by running the specified number of "children" processes to perform -# DNS lookups. If used, the DNS cache filename MUST be specified as -# well. The default value is zero (0), which disables DNS cache file -# creation/updates at run time. The number of children processes to -# run may be anywhere from 1 to 100, however a large number may affect -# normal system operations. Reasonable values should be between 5 and -# 20. See the DNS.README file for additional information. - -#DNSChildren 0 - -# CacheIPs allows unresolved IP addresses to be cached in the DNS -# database. Normally, only resolved addresses are saved. At some -# sites, particularly those with a large number of unresolvable IP -# addresses visiting, it may be useful to enable this feature so -# those addresses are not constantly looked up each time the program -# is run. Values can be 'yes' or 'no', with 'no' being the default. - -#CacheIPs no - -# CacheTTL specifies the time to live (TTL) value for cached DNS -# entries, in days. This value may be anywhere between 1 and 100 -# with the default being 7 days (1 week). - -#CacheTTL 7 - -# The GeoDB option enables or disabled the use of the native -# Webalizer GeoDB geolocation services. This is the preferred -# geolocation option. Values may be 'yes' or 'no', with 'no' -# being the default. - -#GeoDB yes - -# GeoDBDatabase specifies an alternate database to use. The -# default database is /usr/share/GeoDB/GeoDB.dat (however the -# path may be changed at compile time; use the -vV command -# line option to determine where). If a different database is -# to be used, it may be specified here. The name is relative -# to the output directory being used unless an absolute name -# (ie: starts with a leading '/') is specified. - -#GeoDBDatabase /usr/share/GeoIP/GeoIP.dat - -# The GeoIP option enables or disables the use of geolocation -# services provided by the GeoIP library (http://www.maxmind.com), -# if available. Values may be 'yes' or 'no, with 'no' being the -# default. Note: if GeoDB is enabled, then this option will have -# no effect (GeoDB will be used regardless of this setting). - -GeoIP yes - -# GeoIPDatabase specifies an alternate database filename to use by the -# GeoIP library. If an absolute path is not given as part of the name -# (ie: starts with a leading '/'), then the name is relative to the -# default output directory. This option should not normally be needed. - -GeoIPDatabase /usr/share/GeoIP/GeoIP.dat - -# HTMLPre defines HTML code to insert at the very beginning of the -# file. Default is the DOCTYPE line shown below. Max line length -# is 80 characters, so use multiple HTMLPre lines if you need more. - -#HTMLPre - -# HTMLHead defines HTML code to insert within the
-# block, immediately after the