unkinben
3bd3ca8b74
Add per-remote quarantine support: when quarantine_new=true and quarantine_days=N, immutable artifacts published within the last N days are blocked with 404 until the quarantine window expires. - ConfigManager.get_quarantine_config() reads quarantine_new/quarantine_days - RedisCache.store/get_artifact_published() persist Last-Modified per artifact - proxy._check_quarantine() enforces the window; fails open when date is unknown - proxy._fetch_last_modified() HEAD-requests upstream to discover publish date - Docker proxy route wires quarantine checks on both cache-hit and cache-miss - remotes.yaml: quarantine_new/quarantine_days added to pypi example (3-day window) - README: documents quarantine configuration
278 lines
11 KiB
YAML
278 lines
11 KiB
YAML
# Example remotes configuration — copy and adapt for your environment.
|
|
#
|
|
# immutable_patterns: artifacts cached forever (e.g. release binaries, versioned tags).
|
|
# mutable_patterns: artifacts that expire after cache.mutable_ttl seconds and are
|
|
# re-fetched from upstream on next request (e.g. index files,
|
|
# branch archives). Defaults to the package-type built-ins when
|
|
# not set (APKINDEX, repomd.xml, Docker manifests, etc.).
|
|
# cache:
|
|
# immutable_ttl: TTL for immutable files (0 = forever, rarely needed to change).
|
|
# mutable_ttl: TTL in seconds for mutable files. Omit to use the default (3600).
|
|
#
|
|
# quarantine_new: Set to true to block immutable artifacts published within the last
|
|
# quarantine_days days. Requests return 404 until the quarantine period
|
|
# expires. Fails open when the publish date cannot be determined.
|
|
# quarantine_days: Number of days to quarantine newly published artifacts (requires
|
|
# quarantine_new: true). The upstream Last-Modified header is used as
|
|
# the publish date.
|
|
#
|
|
# WARNING: this file may contain credentials — do not commit real values.
|
|
#
|
|
# Global configuration
|
|
#s3:
|
|
# endpoint: "localhost:9000"
|
|
# access_key: "minioadmin"
|
|
# secret_key: "minioadmin"
|
|
# bucket: "artifacts"
|
|
# secure: false
|
|
#
|
|
#redis:
|
|
# url: "redis://localhost:6379/0"
|
|
#
|
|
#database:
|
|
# url: "postgresql://artifacts:artifacts123@localhost:5432/artifacts"
|
|
#
|
|
remotes:
|
|
github:
|
|
base_url: "https://github.com"
|
|
type: "remote"
|
|
package: "generic"
|
|
description: "GitHub releases and files"
|
|
immutable_patterns:
|
|
- "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
|
|
- "lxc/incus/.*\\.tar\\.gz$"
|
|
- "prometheus/node_exporter/.*/node_exporter-.*\\.linux-amd64\\.tar\\.gz$"
|
|
- "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*\\.tar\\.gz$"
|
|
- "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster\\.tar\\.gz$"
|
|
- "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*\\.tar\\.gz$"
|
|
- "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*\\.tar\\.gz$"
|
|
- "prometheus-community/bind_exporter/.*/bind_exporter-.*\\.linux-amd64\\.tar\\.gz$"
|
|
- "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*\\.linux-amd64\\.tar\\.gz$"
|
|
- "prometheus-community/postgres_exporter/.*/postgres_exporter-.*\\.linux-amd64\\.tar\\.gz$"
|
|
- "onedr0p/exportarr/.*/exportarr_.*_linux_amd64\\.tar\\.gz$"
|
|
- "tynany/frr_exporter/.*/frr_exporter-.*\\.linux-amd64\\.tar\\.gz$"
|
|
- "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*\\.linux-amd64\\.tar\\.gz$"
|
|
- "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
|
|
- "helmfile/helmfile/.*/helmfile_.*_linux_amd64\\.tar\\.gz$"
|
|
- "helmfile/vals/.*/vals_.*_linux_amd64\\.tar\\.gz$"
|
|
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*\\.tar\\.gz$"
|
|
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*\\.tar\\.gz$"
|
|
- "apple/foundationdb/.*/libfdb_c\\.x86_64\\.so$"
|
|
- "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu\\.tar\\.gz$"
|
|
- "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu\\.tar\\.gz$"
|
|
- "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu\\.tar\\.gz$"
|
|
cache:
|
|
immutable_ttl: 0 # Files cached indefinitely
|
|
mutable_ttl: 0
|
|
|
|
github-archive:
|
|
base_url: "https://github.com"
|
|
type: "remote"
|
|
package: "generic"
|
|
description: "GitHub repository archive tarballs"
|
|
immutable_patterns:
|
|
# Tag archives are immutable — a tag never changes
|
|
- ".*/archive/refs/tags/.*\\.tar\\.gz$"
|
|
mutable_patterns:
|
|
# Branch archives can change on every push
|
|
- ".*/archive/refs/heads/main\\.tar\\.gz$"
|
|
- ".*/archive/refs/heads/master\\.tar\\.gz$"
|
|
# Before re-downloading an expired branch archive, check whether it has
|
|
# actually changed (304 Not Modified → just refresh the TTL, no transfer).
|
|
# Only applies to user-defined mutable_patterns, not package-type defaults.
|
|
check_mutable_updates: true
|
|
cache:
|
|
immutable_ttl: 0 # Tag archives cached indefinitely
|
|
mutable_ttl: 86400 # Branch archives refreshed after 1 day
|
|
|
|
gitea-dl:
|
|
base_url: "https://dl.gitea.com"
|
|
type: "remote"
|
|
package: "generic"
|
|
description: "Gitea download site"
|
|
immutable_patterns:
|
|
- "act_runner/.*/act_runner-.*-linux-amd64$"
|
|
cache:
|
|
immutable_ttl: 0 # Files cached indefinitely
|
|
mutable_ttl: 0
|
|
|
|
hashicorp-releases:
|
|
base_url: "https://releases.hashicorp.com"
|
|
type: "remote"
|
|
package: "generic"
|
|
description: "HashiCorp product releases"
|
|
immutable_patterns:
|
|
- "terraform/.*terraform_.*_linux_amd64\\.zip$"
|
|
- "terraform/.*terraform_.*_windows_amd64\\.zip$"
|
|
- "terraform/.*terraform_.*_darwin_amd64\\.zip$"
|
|
- "vault/.*vault_.*_linux_amd64\\.zip$"
|
|
- "vault/.*vault_.*_windows_amd64\\.zip$"
|
|
- "vault/.*vault_.*_darwin_amd64\\.zip$"
|
|
- "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
|
|
- "consul/.*/consul_.*_linux_amd64\\.zip$"
|
|
- "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
|
|
- "nomad/.*/nomad_.*_linux_amd64\\.zip$"
|
|
- "packer/.*/packer_.*_linux_amd64\\.zip$"
|
|
cache:
|
|
immutable_ttl: 0 # Files cached indefinitely
|
|
mutable_ttl: 0
|
|
|
|
alpine:
|
|
base_url: "https://dl-cdn.alpinelinux.org"
|
|
type: "remote"
|
|
package: "alpine"
|
|
description: "Alpine Linux APK package repository"
|
|
immutable_patterns:
|
|
- ".*/x86_64/.*\\.apk$"
|
|
# check_mutable_updates not set: APKINDEX.tar.gz is a package-type default
|
|
# and is always re-fetched on expiry — conditional checks are skipped for
|
|
# built-in mutable patterns regardless of this flag.
|
|
cache:
|
|
immutable_ttl: 0 # Files cached indefinitely
|
|
mutable_ttl: 7200 # Index files (APKINDEX.tar.gz) cached for 2 hours
|
|
|
|
almalinux:
|
|
base_url: "https://gsl-syd.mm.fcix.net/almalinux"
|
|
type: "remote"
|
|
package: "rpm"
|
|
description: "AlmaLinux RPM package repository"
|
|
immutable_patterns:
|
|
- ".*/x86_64/.*\\.rpm$"
|
|
- ".*/noarch/.*\\.rpm$"
|
|
- ".*/repodata/.*$"
|
|
- ".*\\.rpm$" # Allow all RPM files
|
|
# repomd.xml / repodata are package-type defaults — always re-fetched on
|
|
# expiry. check_mutable_updates would only apply to any custom
|
|
# mutable_patterns added here.
|
|
cache:
|
|
immutable_ttl: 0 # Files cached indefinitely
|
|
mutable_ttl: 7200 # Metadata files cached for 2 hours
|
|
|
|
epel:
|
|
base_url: "http://mirror.aarnet.edu.au/pub/epel"
|
|
type: "remote"
|
|
package: "rpm"
|
|
description: "EPEL (Extra Packages for Enterprise Linux)"
|
|
immutable_patterns:
|
|
- "8/Everything/x86_64/.*\\.rpm$"
|
|
- "9/Everything/x86_64/.*\\.rpm$"
|
|
- "10/Everything/x86_64/.*\\.rpm$"
|
|
- ".*/noarch/.*\\.rpm$"
|
|
- ".*/repodata/.*$"
|
|
cache:
|
|
immutable_ttl: 0 # Files cached indefinitely
|
|
mutable_ttl: 7200 # Metadata files cached for 2 hours
|
|
|
|
fedora:
|
|
base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
|
|
type: "remote"
|
|
package: "rpm"
|
|
description: "Fedora Linux RPM package repository"
|
|
immutable_patterns:
|
|
- "releases/.*/Everything/x86_64/.*\\.rpm$"
|
|
- "updates/.*/Everything/x86_64/.*\\.rpm$"
|
|
- "development/.*/Everything/x86_64/.*\\.rpm$"
|
|
- ".*/noarch/.*\\.rpm$"
|
|
- "updates/.*/Everything/x86_64/repodata/.*$"
|
|
cache:
|
|
immutable_ttl: 0 # Files cached indefinitely
|
|
mutable_ttl: 300 # Metadata files cached for 5 minutes
|
|
|
|
ghcr:
|
|
base_url: "https://ghcr.io"
|
|
type: "remote"
|
|
package: "docker"
|
|
description: "GitHub Container Registry"
|
|
# username: "your-github-username"
|
|
# password: "your-github-pat" # needs read:packages scope
|
|
# Docker manifest/tag-list patterns are package-type defaults — always
|
|
# re-fetched on expiry. check_mutable_updates only applies to any custom
|
|
# mutable_patterns you add (e.g. a metadata endpoint).
|
|
cache:
|
|
immutable_ttl: 0
|
|
mutable_ttl: 300
|
|
|
|
dockerhub:
|
|
base_url: "https://registry-1.docker.io"
|
|
type: "remote"
|
|
package: "docker"
|
|
description: "Docker Hub registry"
|
|
cache:
|
|
immutable_ttl: 0
|
|
mutable_ttl: 300
|
|
|
|
pypi:
|
|
base_url: "https://files.pythonhosted.org"
|
|
type: "remote"
|
|
package: "pypi"
|
|
description: "Python Package Index — simple index and package files via a single remote"
|
|
# simple/ requests are transparently fetched from pypi.org; package files come from
|
|
# files.pythonhosted.org (base_url). URLs in the simple index are rewritten to this remote.
|
|
check_mutable_updates: true
|
|
# Block packages published within the last 3 days (supply-chain attack mitigation).
|
|
# Immutable artifacts (wheel/sdist) newer than quarantine_days return 404 until
|
|
# the window passes. Disable by setting quarantine_new: false or removing both keys.
|
|
quarantine_new: true
|
|
quarantine_days: 3
|
|
immutable_patterns:
|
|
- "packages/.*\\.whl$"
|
|
- "packages/.*\\.whl\\.metadata$"
|
|
- "packages/.*\\.tar\\.gz$"
|
|
- "packages/.*\\.zip$"
|
|
- "packages/.*\\.egg$"
|
|
cache:
|
|
immutable_ttl: 0
|
|
mutable_ttl: 600 # Simple index pages refreshed after 10 minutes
|
|
|
|
pypi-gitea:
|
|
base_url: "https://gitea.example.com/api/packages/myorg/pypi"
|
|
type: "remote"
|
|
package: "pypi"
|
|
description: "Private Gitea PyPI registry — simple index and files at the same host"
|
|
# username: "your-gitea-username"
|
|
# password: "your-personal-access-token" # needs package:read scope
|
|
check_mutable_updates: true
|
|
immutable_patterns:
|
|
- "files/.*\\.whl$"
|
|
- "files/.*\\.whl\\.metadata$"
|
|
- "files/.*\\.tar\\.gz$"
|
|
- "files/.*\\.zip$"
|
|
- "files/.*\\.egg$"
|
|
cache:
|
|
immutable_ttl: 0
|
|
mutable_ttl: 600
|
|
|
|
npm:
|
|
base_url: "https://registry.npmjs.org"
|
|
type: "remote"
|
|
package: "npm"
|
|
description: "npm registry — package metadata with tarball URL rewriting"
|
|
check_mutable_updates: true
|
|
immutable_patterns:
|
|
- \.tgz$
|
|
mutable_patterns:
|
|
- ^(?!.*\.tgz$).*
|
|
cache:
|
|
immutable_ttl: 0
|
|
mutable_ttl: 600 # Package metadata refreshed after 10 minutes
|
|
|
|
hashicorp-helm:
|
|
base_url: "https://helm.releases.hashicorp.com"
|
|
type: "remote"
|
|
package: "helm"
|
|
description: "HashiCorp Helm chart repository (Vault, Consul, Nomad, etc.)"
|
|
check_mutable_updates: true
|
|
immutable_patterns:
|
|
- "\\.tgz$"
|
|
cache:
|
|
immutable_ttl: 0 # Chart tarballs are versioned — cache forever
|
|
mutable_ttl: 3600 # index.yaml refreshed after 1 hour
|
|
|
|
local-generic:
|
|
type: "local"
|
|
package: "generic"
|
|
description: "Local generic file repository"
|
|
cache:
|
|
immutable_ttl: 0 # Files cached indefinitely
|
|
mutable_ttl: 0
|