PR#580: debuginfod: balance redirect & reverse-proxy better - fedora-infra/ansible

fedora-infra / ansible

#580 debuginfod: balance redirect & reverse-proxy better

Closed 2 years ago by fche. Opened 2 years ago by fche.

fedora-infra/ fche/ansible debuginfod48 into main

debuginfod: balance redirect & reverse-proxy better

Frank Ch. Eigler • 2 years ago

d7b20e7

playbooks/include/proxies-redirects.yml

file modified

+2 -9

		`@@ -873,7 +873,7 @@`
		`path: /`
		`target: https://fedoraproject.org/wiki/QA`

		`- # redirects for debuginfod main page`
		`+ # redirects for debuginfod main page; subdirs are reverse-proxied`
		`- role: httpd/redirect`
		`shortname: debuginfod`
		`website: debuginfod.fedoraproject.org`
		`@@ -881,11 +881,4 @@`
		`target: https://fedoraproject.org/wiki/Debuginfod`
		`tags:`
		`- debuginfod`
		`-`
		`- - role: httpd/redirect`
		`- shortname: debuginfod`
		`- website: debuginfod.fedoraproject.org`
		`- regex: ^/index.html$`
		`- target: https://fedoraproject.org/wiki/Debuginfod`
		`- tags:`
		`- - debuginfod`
		`+`

playbooks/include/proxies-reverseproxy.yml

file modified

+5 -12

		`@@ -751,18 +751,11 @@`
		`- role: httpd/reverseproxy`
		`website: debuginfod.fedoraproject.org`
		`destname: debuginfod`
		`- remotepath: /buildid/`
		`- localpath: /buildid/`
		`- proxyurl: http://debuginfod01:8002`
		`- proxyopts: "connectiontimeout=600 timeout=600 keepalive=on"`
		`- tags: debuginfod`
		`-`
		`- - role: httpd/reverseproxy`
		`- website: debuginfod.fedoraproject.org`
		`- destname: debuginfod`
		`- remotepath: /metrics`
		`- localpath: /metrics`
		`+ # This is intended to cover only /buildid/ and /metrics URLs, but`
		`+ # this ansible role doesn't abide multiple entries, so we use a`
		`+ # template directive unmatch "/" itself, so it can be redirected.`
		`+ remotepath: /`
		`+ localpath: /`
		`proxyurl: http://debuginfod01:8002`
		`proxyopts: "connectiontimeout=600 timeout=600 keepalive=on"`
		`tags: debuginfod`
		`-`

roles/httpd/reverseproxy/templates/reversepassproxy.debuginfod.conf

file added

		`@@ -0,0 +1,3 @@`
		`+`
		`+ # allow / to redirect to wiki`
		`+ ProxyPass / !`

fche commented 2 years ago

Our ansible default ansible scripts don't like multiple /suburls being
individually proxied, so we ended up losing /buildid/* and keeping
/metrics.

Switch to using single /-level reverse-proxying AND wiki-redirection
clauses, and use a new template .conf file to break the tie with a
"ProxyPass / !" directive.