Freezebreak: getfedora rsync
by Kevin Fenzi
An another change needed for getfedora.
+1s?
kevin
--
diff --git a/modules/rsync/files/rsyncd.conf.bapp02
b/modules/rsync/files/rsyncd.conf.bapp02 index 313d0c1..49483b5 100644
--- a/modules/rsync/files/rsyncd.conf.bapp02
+++ b/modules/rsync/files/rsyncd.conf.bapp02
@@ -109,3 +109,11 @@ uid = root
gid = root
read only = yes
hosts allow = 10.5.126.0/255.255.255.0 192.168.0.0/255.255.0.0
+
+[getfedora.org]
+comment = getfedora.org
+path = /srv/web/getfedora.org
+uid = root
+gid = root
+read only = yes
+hosts allow = 10.5.126.0/255.255.255.0 192.168.0.0/255.255.0.0
9 years, 5 months
Freezebreak request: add getfedora.org to proxies
by Kevin Fenzi
Greetings.
With Fedora 21 we are going to be using a 'getfedora.org' domain for
getting the new deliverables.
With this patch this should add them to the proxies.
We could just add the stg for now, but I think it's best to add the
production one too, since the domain isn't widely known/checked.
+1s?
kevin
--
diff --git a/manifests/services/proxy.pp b/manifests/services/proxy.pp
index a039768..dbb5927 100644
--- a/manifests/services/proxy.pp
+++ b/manifests/services/proxy.pp
@@ -111,6 +111,14 @@ class proxy {
sSLCertificateChainFile => "wildcard-2014.fedoraproject.org.intermediate.cert",
}
+ httpd::website { "getfedora.org":
+ ips => $fpo_ips,
+ server_aliases => [ "stg.getfedora.org" ],
+ ssl => true,
+ cert_name => $sslcert,
+ sSLCertificateChainFile => "wildcard-2014.fedoraproject.org.intermediate.cert",
+ }
+
httpd::website { "cloud.fedoraproject.org":
ips => $wildcard_fpo_ips,
ssl => true,
@@ -656,6 +664,10 @@ class proxy {
website => "fedoramagazine.org"
}
+ fedora-web::getfedora::proxy { "getfedora.org":
+ website => "getfedora.org"
+ }
+
fedora-docs::proxy { "docs.fedoraproject.orgj":
website => "docs.fedoraproject.org",
}
diff --git a/modules/fedora-web/files/getfedora-languages.conf b/modules/fedora-web/files/getfedora-languages.conf
index e69de29..c770e7e 100644
--- a/modules/fedora-web/files/getfedora-languages.conf
+++ b/modules/fedora-web/files/getfedora-languages.conf
@@ -0,0 +1,143 @@
+# Define the correct MIME type for specific languages
+AddType text/html .bn
+AddType text/html .el
+AddType text/html .nb
+AddType text/html .pl
+AddType text/html .tr
+
+AddLanguage af .af
+AddLanguage ar .ar
+AddLanguage as .as
+AddLanguage ast .ast
+AddLanguage bal .bal
+AddLanguage bg .bg
+AddLanguage bn .bn
+AddLanguage bn-in .bn_IN
+AddLanguage br .br
+AddLanguage ca .ca
+AddLanguage cs .cs
+AddLanguage da .da
+AddLanguage de .de
+AddLanguage de-ch .de_CH
+AddLanguage el .el
+AddLanguage en .en
+AddLanguage en-gb .en_GB
+AddLanguage es .es
+AddLanguage eu .eu
+AddLanguage fa .fa
+AddLanguage fi .fi
+AddLanguage fr .fr
+AddLanguage gl .gl
+AddLanguage gu .gu
+AddLanguage he .he
+AddLanguage hi .hi
+AddLanguage hu .hu
+AddLanguage ia .ia
+AddLanguage id .id
+AddLanguage is .is
+AddLanguage it .it
+AddLanguage ja .ja
+AddLanguage ka .ka
+AddLanguage kn .kn
+AddLanguage ko .ko
+AddLanguage lv .lv
+AddLanguage ml .ml
+AddLanguage mr .mr
+AddLanguage nb .nb
+AddLanguage nl .nl
+AddLanguage or .or
+AddLanguage pa .pa
+AddLanguage pl .pl
+AddLanguage pt .pt
+AddLanguage pt-br .pt_BR
+AddLanguage ro .ro
+AddLanguage ru .ru
+AddLanguage sk .sk
+AddLanguage sq .sq
+AddLanguage sr .sr
+AddLanguage sv .sv
+AddLanguage ta .ta
+AddLanguage te .te
+AddLanguage tg .tg
+AddLanguage th .th
+AddLanguage tr .tr
+AddLanguage uk .uk
+AddLanguage vi .vi
+AddLanguage zh-cn .zh_CN
+AddLanguage zh-tw .zh_TW
+
+LanguagePriority en
+ForceLanguagePriority Prefer Fallback
+
+AddDefaultCharset utf-8
+
+RewriteEngine on
+
+RewriteCond %{QUERY_STRING} ^lang=(af|ar|as|ast|bal|bg|bn|bn_IN|br|ca|cs|da|de|de_CH|el|en|en_GB|es|eu|fa|fi|fr|gl|gu|he|hi|hu|ia|id|is|it|ja|ka|kn|ko|lv|ml|mr|nb|nl|or|pa|pl|pt|pt_BR|ro|ru|sk|sq|sr|sv|ta|te|tg|th|tr|uk|vi|zh_CN|zh_TW)$
+RewriteRule ^(?:/(?:af|ar|as|ast|bal|bg|bn|bn_IN|br|ca|cs|da|de|de_CH|el|en|en_GB|es|eu|fa|fi|fr|gl|gu|he|hi|hu|ia|id|is|it|ja|ka|kn|ko|lv|ml|mr|nb|nl|or|pa|pl|pt|pt_BR|ro|ru|sk|sq|sr|sv|ta|te|tg|th|tr|uk|vi|zh_CN|zh_TW))?(/.*)$ /%1$1? [R=301]
+AliasMatch ^(?:/(?:af|ar|as|ast|bal|bg|bn|bn_IN|br|ca|cs|da|de|de_CH|el|en|en_GB|es|eu|fa|fi|fr|gl|gu|he|hi|hu|ia|id|is|it|ja|ka|kn|ko|lv|ml|mr|nb|nl|or|pa|pl|pt|pt_BR|ro|ru|sk|sq|sr|sv|ta|te|tg|th|tr|uk|vi|zh_CN|zh_TW))(/.*)?$ /srv/web/getfedora.org$1
+
+<Directory /srv/web/getfedora.org>
+ Options MultiViews
+
+ SetEnvIf Request_URI ^/af/ prefer-language=af
+ SetEnvIf Request_URI ^/ar/ prefer-language=ar
+ SetEnvIf Request_URI ^/as/ prefer-language=as
+ SetEnvIf Request_URI ^/ast/ prefer-language=ast
+ SetEnvIf Request_URI ^/bal/ prefer-language=bal
+ SetEnvIf Request_URI ^/bg/ prefer-language=bg
+ SetEnvIf Request_URI ^/bn/ prefer-language=bn
+ SetEnvIf Request_URI ^/bn_IN/ prefer-language=bn-in
+ SetEnvIf Request_URI ^/br/ prefer-language=br
+ SetEnvIf Request_URI ^/ca/ prefer-language=ca
+ SetEnvIf Request_URI ^/cs/ prefer-language=cs
+ SetEnvIf Request_URI ^/da/ prefer-language=da
+ SetEnvIf Request_URI ^/de/ prefer-language=de
+ SetEnvIf Request_URI ^/de_CH/ prefer-language=de-ch
+ SetEnvIf Request_URI ^/el/ prefer-language=el
+ SetEnvIf Request_URI ^/en/ prefer-language=en
+ SetEnvIf Request_URI ^/en_GB/ prefer-language=en-gb
+ SetEnvIf Request_URI ^/es/ prefer-language=es
+ SetEnvIf Request_URI ^/eu/ prefer-language=eu
+ SetEnvIf Request_URI ^/fa/ prefer-language=fa
+ SetEnvIf Request_URI ^/fi/ prefer-language=fi
+ SetEnvIf Request_URI ^/fr/ prefer-language=fr
+ SetEnvIf Request_URI ^/gl/ prefer-language=gl
+ SetEnvIf Request_URI ^/gu/ prefer-language=gu
+ SetEnvIf Request_URI ^/he/ prefer-language=he
+ SetEnvIf Request_URI ^/hi/ prefer-language=hi
+ SetEnvIf Request_URI ^/hu/ prefer-language=hu
+ SetEnvIf Request_URI ^/ia/ prefer-language=ia
+ SetEnvIf Request_URI ^/id/ prefer-language=id
+ SetEnvIf Request_URI ^/is/ prefer-language=is
+ SetEnvIf Request_URI ^/it/ prefer-language=it
+ SetEnvIf Request_URI ^/ja/ prefer-language=ja
+ SetEnvIf Request_URI ^/ka/ prefer-language=ka
+ SetEnvIf Request_URI ^/kn/ prefer-language=kn
+ SetEnvIf Request_URI ^/ko/ prefer-language=ko
+ SetEnvIf Request_URI ^/lv/ prefer-language=lv
+ SetEnvIf Request_URI ^/ml/ prefer-language=ml
+ SetEnvIf Request_URI ^/mr/ prefer-language=mr
+ SetEnvIf Request_URI ^/nb/ prefer-language=nb
+ SetEnvIf Request_URI ^/nl/ prefer-language=nl
+ SetEnvIf Request_URI ^/or/ prefer-language=or
+ SetEnvIf Request_URI ^/pa/ prefer-language=pa
+ SetEnvIf Request_URI ^/pl/ prefer-language=pl
+ SetEnvIf Request_URI ^/pt/ prefer-language=pt
+ SetEnvIf Request_URI ^/pt_BR/ prefer-language=pt-br
+ SetEnvIf Request_URI ^/ro/ prefer-language=ro
+ SetEnvIf Request_URI ^/ru/ prefer-language=ru
+ SetEnvIf Request_URI ^/sk/ prefer-language=sk
+ SetEnvIf Request_URI ^/sq/ prefer-language=sq
+ SetEnvIf Request_URI ^/sr/ prefer-language=sr
+ SetEnvIf Request_URI ^/sv/ prefer-language=sv
+ SetEnvIf Request_URI ^/ta/ prefer-language=ta
+ SetEnvIf Request_URI ^/te/ prefer-language=te
+ SetEnvIf Request_URI ^/tg/ prefer-language=tg
+ SetEnvIf Request_URI ^/th/ prefer-language=th
+ SetEnvIf Request_URI ^/tr/ prefer-language=tr
+ SetEnvIf Request_URI ^/uk/ prefer-language=uk
+ SetEnvIf Request_URI ^/vi/ prefer-language=vi
+ SetEnvIf Request_URI ^/zh_CN/ prefer-language=zh-cn
+ SetEnvIf Request_URI ^/zh_TW/ prefer-language=zh-tw
+</Directory>
diff --git a/modules/fedora-web/files/getfedora.org.conf b/modules/fedora-web/files/getfedora.org.conf
index e69de29..7fc238f 100644
--- a/modules/fedora-web/files/getfedora.org.conf
+++ b/modules/fedora-web/files/getfedora.org.conf
@@ -0,0 +1,9 @@
+DocumentRoot /srv/web/getfedora.org
+Alias /favicon.ico /srv/web/fedoraproject.org/static/images/favicon.ico
+
+AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/x-javascript
+
+FileETag MTime Size
+
+ExpiresActive On
+ExpiresDefault "access plus 5 days"
diff --git a/modules/fedora-web/files/syncStatic.sh b/modules/fedora-web/files/syncStatic.sh
index f0249a7..1f0a60e 100644
--- a/modules/fedora-web/files/syncStatic.sh
+++ b/modules/fedora-web/files/syncStatic.sh
@@ -70,3 +70,5 @@ build boot.fedoraproject.org
build fedoracommunity.org
build fudcon.fedoraproject.org
build start.fedoraproject.org
+/usr/bin/git checkout -q getfedora || exit 1
+build getfedora.org
diff --git a/modules/fedora-web/files/syncStatic.sh.stg b/modules/fedora-web/files/syncStatic.sh.stg
index 873c53f..b91b249 100644
--- a/modules/fedora-web/files/syncStatic.sh.stg
+++ b/modules/fedora-web/files/syncStatic.sh.stg
@@ -49,7 +49,6 @@ cd /srv/web/fedora-web
/usr/bin/git pull -q --ff-only || exit 1
build fedoraproject.org
-build spins.fedoraproject.org
pushd mirrors.fedoraproject.org > /dev/null
rsync -qa --delete-after --delay-updates . /srv/web/mirrors.fedoraproject.org/
@@ -66,3 +65,6 @@ build boot.fedoraproject.org
build fedoracommunity.org
build start.fedoraproject.org
build fudcon.fedoraproject.org
+/usr/bin/git checkout -q getfedora || exit 1
+build getfedora.org
+build spins.fedoraproject.org
diff --git a/modules/fedora-web/manifests/init.pp b/modules/fedora-web/manifests/init.pp
index f7c4fb8..928d09a 100644
--- a/modules/fedora-web/manifests/init.pp
+++ b/modules/fedora-web/manifests/init.pp
@@ -22,6 +22,7 @@ class fedora-web::build {
"/srv/web/mirrors.fedoraproject.org",
"/srv/web/fedoracommunity.org",
"/srv/web/fudcon.fedoraproject.org",
+ "/srv/web/getfedora.org",
]:
owner => "apache",
group => "apache",
@@ -75,6 +76,7 @@ class fedora-web::build {
File["/srv/web/mirrors.fedoraproject.org"],
File["/srv/web/fedoracommunity.org"],
File["/srv/web/fudcon.fedoraproject.org"],
+ File["/srv/web/getfedora.org"],
],
}
}
@@ -276,6 +278,34 @@ define fedora-web::spins::proxy($website) {
}
}
+define fedora-web::getfedora::proxy($website) {
+ include httpd::base
+
+ cron { "sync-getfedora-web":
+ command => "/usr/bin/rsync --delete -a --no-owner --no-group bapp02::getfedora.org/ /srv/web/getfedora.org/",
+ user => "root",
+ minute => 25,
+ }
+
+ file { "/etc/httpd/conf.d/$website/getfedora.org.conf":
+ owner => "root",
+ group => "root",
+ mode => 0644,
+ source => "puppet:///fedora-web/getfedora.org.conf",
+ notify => Service["httpd"],
+ require => Httpd::Website[$website],
+ }
+
+ file { "/etc/httpd/conf.d/$website/languages.conf":
+ owner => "root",
+ group => "root",
+ mode => 0644,
+ source => "puppet:///fedora-web/getfedora-languages.conf",
+ notify => Service["httpd"],
+ require => Httpd::Website[$website],
+ }
+}
+
define fedora-web::boot::proxy($website) {
include httpd::base
9 years, 5 months
MM2/Ansible FAD Hotel rooms
by Pierre-Yves Chibon
Hi all,
I would like to book the rooms for the hotel. Since we have 2 period (first days
for MirrorManager, then the ansible migration part), I'd like to ask who will be
there for which part?
Patrick and I arrive on the 2rd and leave on the 9th, so we'll have an extra
day to handle the jet-lag.
The official dates are from Dec 4th to Dec 9th, as in, we start working on the
4th and finish on the 8th, thus departure on the 9th, so arrival dates should be
Dec 3rd.
So, Kevin, Ralph, Luke, David and Stephen, what would be your arrival
date/departure dates?
Thanks,
Pierre
9 years, 5 months
Meeting Agenda Item: Introduction Dan Shoemaker
by Daniel Shoemaker
My IRC handle is Morpheus77. I started using Fedora at version Zod. I've
been doing Linux System Administration for about 8 years. I have a little
experience writing scripts but would like to learn more advanced stuff. I
have a little experience with MySQL & MariaDB. I am willing to learn
anything as it will help to strengthen my skillset & I can join other
sub-projects as needed to help out. As I looked at the other projects
package maintainer caught my eye.
--
Dan Shoemaker
9 years, 5 months
Freeze break koji
by Dennis Gilmore
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi all,
for https://bugzilla.redhat.com/show_bug.cgi?id=1145264 I have built an
updated koji for the builders it is in the builder repo and I have
removed the broken pykickstart build from it also, we will need to
carry the patch until f21 is eol. If i am sleeping when the +1's come
in then all that needs doing is a yum update on the builders and a
restart of kojid.
Dennis
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBAgAGBQJUbD+iAAoJEH7ltONmPFDRe8MQAIuK2dFFNrxbMNoTWaGZTMqD
Y5N9Kxfow4M61woyEJkrpEIpLvcyfoivxXtnDV706/2PtC3aORTwnEy6JPU0/tds
ffkRfh4LkEjPrvogZRo6L6MRF/u4ckDGgxPjeixoH31kKnVMSKbTqk59efJMEQnQ
n/pO+LhRV3qYwZXFjhcOm5pSJfz1MGvDkOJjpmv8MT86Qt52CZMJQLiKcrWeoEl8
Nu9j5/Xa6HTVHF5J8S8Hy5Q9xveS1uiylvRjQ9snlI3KbEqBZ6rV2BsTBNFohkmn
JmzsF2YKS+fszx7iicpw6or8J/5DDEunEVbxSiH+f2KZ22RE5Sa8l+KJPjFd3WvQ
EmalaaNlFNgsP9RltGh+rEwm4ZfHf+qJeb4UOK6ceLnHruo/VUvyC1KIs7F1Yn2V
UjcyMtaNGAbSLEOjIAXv908UEEqXVH4MQbstJpVOCeOJfHrPe5ND/EizPQ0AmSa2
0kunS3m1YtMClALRFEqfaF2rpGktRIgV7iuTe5knRb7qGjH9Nt7jQuWMnYFuFSgI
ZhK2gsjyMFmlEDTzdYovd0oMDDempPQDRCYcy+gLyjr+FRnesvMJmE0WuphEZdip
S/txXC8EMY33AwLoeZDHe/c3uiw6Au8CtyWcugRhBDQpglNaAq6B5wztslLD9fHx
HjwO39MbzwGwap+Fcobg
=fHRt
-----END PGP SIGNATURE-----
9 years, 5 months
Meeting Agenda Item: Introduction Marvin Curlee
by Marvin Curlee
Your IRC handle
mhcurlee
What skills you have to offer and which you would like to learn
Senior level sysadm wanting to give back to the community and continue to
develops skills. Interested in automation and DevOps and would like to
learn formal team development methods. Experienced with programming small
projects in Java, Python, and of course bash. Currently learning
ruby/Puppet.
http://www.linkedin.com/pub/marvin-curlee/40/33b/104/
What you would like to work on and quite possibly which outstanding issues
you would like to help resolve:
I would like to help out where needed. I am most interested in
automation/DevOps and configuration (python, ruby, bash)
9 years, 5 months
[release] pkgdb-cli 2.6
by Pierre-Yves Chibon
Hi all,
With the new version of pkgdb2, I thought it would be a good time to cut a
release of pkgdb-cli as well. I therefore just pushed the version 2.6 to pypi
and RPMs are building.
Changelog:
* Fri Nov 21 2014 Pierre-Yves Chibon <pingou(a)pingoured.fr> - 2.6-1
- Update to 2.6
- New structure: use the traditional python module structure instead of two
python files
- Do one API call for `orphan --retire`
- Prevent user from retiring packages that have no dead.package file
- Add support for obsoleting ACL requests (Stanislav Ochotnicky)
- Enable restricting orphan to a specific user (while specifying more
branches)
- Enable restricting give to a specific user (while specifying more
branches)
- Let the unorphan action call the unorphan API endpoint
- When listing packages, encode the output as UTF-8 before printing
Testing welcome as well :)
Thanks,
Pierre
9 years, 5 months
Freeze break request: Enable logging for FedOAuth
by Patrick Uiterwijk
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hi all,
I would like to enable some more debugging info for FedOAuth, given some people have had some complaints about being unable to login, but no info on them in the WARN level.
Please give +1 or -1.
Patch:
- From c0ab10f0074f3200b2d5426267901b170e00ab37 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk(a)redhat.com>
Date: Fri, 21 Nov 2014 14:43:16 +0000
Subject: [PATCH] Enable DEBUG logging for FedOAuth to a file
- ---
roles/fedoauth/templates/fedoauth.log.cfg | 14 ++++++++++----
1 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/roles/fedoauth/templates/fedoauth.log.cfg b/roles/fedoauth/templates/fedoauth.log.cfg
index 8a6bf6d..b289885 100644
- --- a/roles/fedoauth/templates/fedoauth.log.cfg
+++ b/roles/fedoauth/templates/fedoauth.log.cfg
@@ -2,20 +2,26 @@
keys=root
[handlers]
- -keys=syslog,email
+keys=syslog,email,file
[formatters]
keys=form01
[logger_root]
- -level=INFO
- -handlers=syslog,email
+level=DEBUG
+handlers=syslog,email,file
+
+[handler_file]
+class=FileHandler
+level=DEBUG
+formatter=form01
+args=('/var/log/fedoauth.log', 'w')
[handler_syslog]
class=handlers.SysLogHandler
- -level=NOTSET
+level=INFO
formatter=form01
args=(('localhost', handlers.SYSLOG_UDP_PORT), handlers.SysLogHandler.LOG_LOCAL4)
- --
1.7.2.1
- --
With kind regards,
Patrick Uiterwijk
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJUb1DXAAoJEIZXmA2atR5Q7mkQAJ7ryWSVvJ+OObdaF2z6ikzp
Y+JP59Qu9jSOiuCeKQvEX7OdMQtgQG6OFTOptleQJGjNZ5h+1+CIP/mUXUok2Jo9
HfS28GX6NVw+9qYUBNIr8XULAixoOCzoaogKJPQRYkxlPg0Kv4Siws7J2Ys4yeV1
pO5Abgjc1/F6Qx/HTdrtOd2sWIUK5mxSBJGEfz0hwkSsSWym1giPz3xN35tuZGB1
ZNLMzLFtgYfs47NCRnRHINHpxMtkJgSjjxTdaoOuAeK2jyWtuHQqTjf5OjNOA25o
+/cYSD/DYSa3UmvRzlirIVJfx7+Z9aUC6roYNyc2sAp/00Y+BBk/7Nmg0l3DHBNK
IXCS5JOQivzRXMmGcgRdV9423khzQhh8nCLpW/N3OXg/65l24gCFlOXjneH8nXPF
YoIrbKmh8ZrvAu5ObtmNNXBPlPUTCQOCWtQLTWmx5Rp/n+mqGhk3V22dVE+s+/9F
C7AJuxHvXeWaTH8Cbo6Hpk6qzKtHxd5zaQ9H3XuCsho181Nclq18hLZHM5Sc7Wr4
nE9kWerUmsTXaVGYmslFI2Uzt4bQ87wNS0H54GByDXlHwkx5azFRHEiNeWBqb0bv
wZd/T1NY8Eg69q3ogSOypin24X9Zgj3Drygi+Ttow22ja20bgNlAK53Y/7lzfxs3
R6bJ+eZNiWlJUuJW/n/J
=knxO
-----END PGP SIGNATURE-----
9 years, 5 months
Freeze break request: adding cipher to dl*.fedoraproject.org for BFO
by Patrick Uiterwijk
Hi all,
Since boot.fedoraproject.org does not support (EC)DHE_ ciphers, the attached patch will add support for RSA_WITH_AES_256_CBC_SHA256 to dl*.fedoraproject.org.
Please +1 or -2?
>From c4e72c37cedb2fd14e948f7a82d5ac14c12dc292 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk(a)redhat.com>
Date: Thu, 20 Nov 2014 21:12:21 +0000
Subject: [PATCH] Enable RSA_WITH_AES_256_CBC_SHA256 for bfo
---
.../download/files/httpd/dl.fedoraproject.org.conf | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/roles/download/files/httpd/dl.fedoraproject.org.conf b/roles/download/files/httpd/dl.fedoraproject.org.conf
index 7be586c..1129149 100644
--- a/roles/download/files/httpd/dl.fedoraproject.org.conf
+++ b/roles/download/files/httpd/dl.fedoraproject.org.conf
@@ -23,9 +23,10 @@
# https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
# If you change the protocols or cipher suites, you should probably update
# modules/squid/files/squid.conf-el6 too, to keep it in sync.
+ # RSA_WITH_AES_256_CBC_SHA256 is supported for boot.fedoraproject.org (iPXE doesn't support DHE_ or ECDHE_)
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
- SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+ SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:RSA_WITH_AES_256_CBC_SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
Include "conf.d/dl.fedoraproject.org/*.conf"
</VirtualHost>
--
1.7.2.1
With kind regards,
Patrick Uiterwijk
Associate Software Engineer, Red Hat
9 years, 5 months
