This was fallout from my sed to change all the references from pagure.io
to forge.fedoraproject.org. In this case though, we do want pagure.io
here because we are using this to check that it's up and working
properly.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
I am going to use this builder to test/deploy pesign sigul-dry bridge.
So, it has been disabled in koji and should be ok to test with.
Once things are lined up and tested it can be re-enabled.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
The p08 copr machines were in rdu2-cc and are gone now.
The p09 machines in rdu3 are all up and online now.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This ip had hit release-monitoring.org like 5,000,000 times in the
course of a few hours and swamped it's web pod.
Lets block it for now and see if anyone complains.
If this is you: please add some rate limiting.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
Some folks were getting posts failing against forge.
See https://forge.fedoraproject.org/forge/forge/issues/401
So, lets just explicitly allow POSTs through anubis as
this should be fine for normal people and should not be something
that scrapers normally do.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
The /pub/alt/virtio-win directory had in it some 11 year old things.
One was a readme noting that it moved 11 years ago and nothing was
still here. The others were links to .
The scrapers, being as dumb as posts followed all those links over and
over again to the tune of millions per day.
I removed the links, but of course they were still trying, so
lets be a bit more aggressive and just 403 them all.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
selinux was preventing anubis from reading its policy file.
So, set the right context here so it is happy.
Note that we cannot use :Z in the podman call, because it runs as the
anubis user which cannot chcon those files on the host.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
Right now, podman on el9 isn't reading the policy correctly.
This is because the env for the unit isn't getting picked up
by podman, so instead pass --env-file to read it from a file.
Also, we want to setup a private key for the download servers
so they all have the same challenge creation (so if you hit 01
you want your challenge to be good on 02, etc).
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
