guest access for dak on ftp-master

[mirror/dsa-puppet.git] / modules / roles / templates / snapshot / snapshot.debian.org.vcl.erb

diff --git a/modules/roles/templates/snapshot/snapshot.debian.org.vcl.erb b/modules/roles/templates/snapshot/snapshot.debian.org.vcl.erb
index 25e6d12..c01fcb7 100644 (file)
--- a/modules/roles/templates/snapshot/snapshot.debian.org.vcl.erb
+++ b/modules/roles/templates/snapshot/snapshot.debian.org.vcl.erb
@@ -25,3 +25,24 @@ sub vcl_purge {
     return(restart);
   }
 }
+
+# We rate-limit requests by clients.
+#  Currently, we do that at the netfilter level, so one
+#  request per connection works best.
+sub vcl_deliver {
+  if (remote.ip != "127.0.0.1" &&
+      remote.ip != "::1") {
+    set resp.http.connection = "close";
+  }
+}
+
+sub vcl_backend_response {
+    if (bereq.retries == 0 &&
+        beresp.status == 302 &&
+        beresp.http.location ~ "https?://[^/]*/file/") {
+        set beresp.http.location = regsub(beresp.http.location,"^https?://","");
+        set bereq.http.host = regsub(beresp.http.location,"/.*$","");
+        set bereq.url = regsub(beresp.http.location,"[^/]*","");
+        return (retry);
+    }
+}