Skip to content

Commit b568540

Browse files
alopatindevalopatindev
committed
Update
1 parent 3d3a65a commit b568540

10 files changed

Lines changed: 68 additions & 26 deletions

File tree

‎_do.cr‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,8 +183,28 @@ def build
183183
build_vidstack_player
184184
build_zapthreads
185185

186-
build_jekyll(MIRROR_HOST, configs: [MAIN_SITE_CONFIG, Path["_config.i2p.yml"]]) unless DEBUG
187-
build_jekyll(MIRROR_HOST, configs: [MAIN_SITE_CONFIG, Path["_config.tor.yml"]]) unless DEBUG
186+
unless DEBUG
187+
build_jekyll(MIRROR_HOST, configs: [MAIN_SITE_CONFIG, Path["_config.i2p.yml"]])
188+
build_jekyll(MIRROR_HOST, configs: [MAIN_SITE_CONFIG, Path["_config.tor.yml"]])
189+
Dir
190+
.glob(".build/*/var/www/*")
191+
.select { |i| File.directory?(i) }
192+
.map { |i| Path[i] }
193+
.each { |i|
194+
robots = i.join("robots.txt")
195+
unless File.exists?(robots)
196+
File.write(robots, <<-STRING
197+
User-agent: *
198+
Disallow: /
199+
STRING
200+
)
201+
end
202+
203+
f = "favicon.ico"
204+
favicon = i.join(f)
205+
File.copy(Path["assets"].join(f), favicon) unless File.exists?(favicon)
206+
}
207+
end
188208

189209
build_rust_app(
190210
MEDIA_HOST,

‎_hosts/media.codonaft/etc/nginx/http.d/default.conf‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
server {
2-
listen 80 default_server;
3-
listen [::]:80 default_server;
2+
listen 80 reuseport default_server;
3+
listen [::]:80 reuseport default_server;
44

55
location / {
66
return 404;
@@ -21,9 +21,12 @@ server {
2121
}
2222

2323
server {
24-
listen 443 ssl default_server;
25-
listen [::]:443 ssl default_server;
24+
listen 443 ssl reuseport default_server ipv6only=off backlog=1024;
25+
listen [::]:443 ssl reuseport default_server ipv6only=off backlog=1024;
26+
#listen 443 quic reuseport ipv6only=off;
27+
#listen [::]:443 quic reuseport ipv6only=off;
2628
http2 on;
29+
#http3 on;
2730

2831
ssl_certificate /etc/nginx/ssl/selfsigned/example.com.crt;
2932
ssl_certificate_key /etc/nginx/ssl/selfsigned/example.com.key;

‎_hosts/media.codonaft/etc/nginx/http.d/media.conf‎

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -17,23 +17,18 @@ map $origin_allowed $origin {
1717
server {
1818
listen 443 ssl;
1919
listen [::]:443 ssl;
20+
#listen 443 quic;
21+
#listen [::]:443 quic;
2022
http2 on;
23+
#http3 on;
24+
set $h3 'h3=":$server_port"; ma=86400';
2125

22-
# # HTTP/3
23-
# listen 443 quic reuseport;
24-
# listen [::]:443 quic reuseport;
25-
# quic_retry on;
26-
# quic_gso on;
27-
# ssl_quic on;
28-
# ssl_early_data on;
29-
# add_header Alt-Svc 'h2=":$server_port"; ma=86400, h3-29=":$server_port"; ma=86400, h3=":$server_port"; ma=86400' always;
30-
# #add_header Alt-Svc 'h2=":$server_port"; ma=2592000; persist=1';
31-
# #add_header Alt-Svc 'h3=":$server_port"; ma=86400';
32-
# ssl_early_data on;
33-
# ssl_ciphers HIGH:!aNULL:!MD5;
34-
# ssl_prefer_server_ciphers on;
35-
# #add_header X-Early-Data $tls1_3_early_data; # Debug 0-RTT
36-
# add_header x-frame-options "deny";
26+
#add_header Alt-Svc 'h2=":$server_port"; ma=86400, h3-29=":$server_port"; ma=86400, h3=":$server_port"; ma=86400' always;
27+
#add_header Alt-Svc 'h2=":$server_port"; ma=2592000; persist=1' always;
28+
#ssl_ciphers HIGH:!aNULL:!MD5;
29+
#ssl_prefer_server_ciphers on;
30+
#add_header X-Early-Data $tls1_3_early_data; # Debug 0-RTT
31+
#add_header x-frame-options "deny";
3732

3833
include /etc/nginx/cloudflare.conf;
3934

@@ -66,6 +61,7 @@ server {
6661
}
6762

6863
location ~ \.(m3u8|mp4|ts|vtt|webp)$ {
64+
#add_header Alt-Svc $h3 always;
6965
add_header "Access-Control-Allow-Origin" $origin always;
7066

7167
add_header Cache-Control "public, max-age=31536000, immutable";
@@ -90,10 +86,12 @@ server {
9086
proxy_set_header Upgrade $http_upgrade;
9187
proxy_set_header Connection "upgrade";
9288

89+
#add_header Alt-Svc $h3 always;
9390
proxy_pass http://tracker/announce;
9491
}
9592

9693
location /ip {
94+
#add_header Alt-Svc $h3 always;
9795
add_header "Access-Control-Allow-Origin" $origin always;
9896

9997
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
@@ -104,8 +102,9 @@ server {
104102
}
105103

106104
location /torbulkexitlist {
107-
resolver 9.9.9.9 1.1.1.1 ipv6=off valid=300s;
105+
#add_header Alt-Svc $h3 always;
108106

107+
resolver 9.9.9.9 1.1.1.1 ipv6=off valid=300s;
109108
proxy_hide_header "Host";
110109
proxy_set_header "Host" "check.torproject.org";
111110
proxy_hide_header "Access-Control-Allow-Origin";

‎_hosts/media.codonaft/etc/nginx/http.d/nostr.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
server {
22
listen 443 ssl;
33
listen [::]:443 ssl;
4+
#listen 443 quic;
5+
#listen [::]:443 quic;
46
http2 on;
7+
#http3 on;
58

69
include /etc/nginx/cloudflare.conf;
710

‎_hosts/media.codonaft/etc/nginx/http.d/omv.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,10 @@ server {
1616
server {
1717
listen 443 ssl;
1818
listen [::]:443 ssl;
19+
#listen 443 quic;
20+
#listen [::]:443 quic;
1921
http2 on;
22+
#http3 on;
2023

2124
include /etc/nginx/cloudflare.conf;
2225

‎_hosts/media.codonaft/etc/nginx/http.d/test.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
#server {
22
# listen 443 ssl;
33
# listen [::]:443 ssl;
4+
# #listen 443 quic;
5+
# #listen [::]:443 quic;
46
# http2 on;
7+
# #http3 on;
58
#
69
# server_name .codonaft.star.is;
710
# ssl_certificate /etc/nginx/ssl/codonaft.star.is/fullchain.pem;

‎_hosts/media.codonaft/etc/periodic/hourly/probe-upstreams.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/usr/bin/env sh
2+
3+
get () {
4+
sudo -u nobody curl --silent "$@" >>/dev/null
5+
}
6+
7+
for view in events pubkeys ; do
8+
path="/nostr/spam.nostr.band/spam_api?method=get_current_spam&view=${view}"
9+
get --insecure --socks5-hostname '127.0.0.1:9050' --header 'origin: http://codonaftbvv4j5k7nsrdivbdblycqrng5ls2qkng6lm77svepqjyxgid.onion' "http://codonaftct3jsouvfyrjq4yumyngzv3el2msndf5oddccktgghnw7eyd.onion${path}"
10+
get --proxy '127.0.0.1:4444' --header 'origin: http://codonaft.i2p' "http://codnaft43k7ncna2hfsxrzi2nqoxieu22vbyjkmhkwdrrta2ghlq.b32.i2p${path}"
11+
done
12+
13+
get --header 'origin: https://codonaft.com' 'https://media.codonaft.com/torbulkexitlist'

‎_hosts/media.codonaft/var/www/media.codonaft.com/robots.txt‎

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎_hosts/mirror.codonaft/etc/nginx/http.d/mirror.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ tcp_nodelay on;
1616
ignore_invalid_headers on;
1717

1818
server {
19-
listen 127.0.0.1:80;
19+
listen 127.0.0.1:80 reuseport default_server;
2020
server_name codonaft.i2p;
2121
root /var/www/$server_name;
2222
index index.html;

‎_posts/2024-09-26-installing-alpine-linux-on-pain-in-the-ass-hosting-providers.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ I wish the third step was less esoteric and more reliable.
8989
Most likely this installation method will stop working after few ISO image releases.
9090

9191
## netboot.xyz
92-
Another [approach](https://netboot.xyz/docs/booting/grub#on-debianubuntu), which is actually pretty user-friendly, is `grub-imageboot` + `netboot.xyz`.
92+
Another [approach](https://web.archive.org/web/20250321221414/https://netboot.xyz/docs/booting/grub#on-debianubuntu), which is actually pretty user-friendly, is `grub-imageboot` + `netboot.xyz`.
9393
It works. However, I'm personally *very* uneasy about the
9494
{% include span_with_tooltip.html large="true" body="security" tooltip="Due to implementation limitations, it downloads everything over untrusted HTTP, not HTTPS. Any compromised router/ISP may easily replace OS you're trying to install with a modified backdoored/malicious version. Untrusted protocol <i>could</i> be okay, however I have serious concerns about whether netboot.xyz actually correctly checks all required signatures that relate <i>specifically</i> to <span class='no-wrap'>Alpine Linux.</span>" %}
9595
of this approach and have less time to verify it.

0 commit comments

Comments
 (0)