quay: improvements

conf.avail/http-krd.sh.conf

@@ -1,3 +1,28 @@
+map $remote_addr
+    $krdsh_remote_type
+{
+    default  external;
+
+    ## 127.0.0.0/8
+    ~^127\..+$  internal;
+    ## 10.0.0.0/8
+ #  ~^10\..+$  internal;
+    ## 172.16.0.0/12
+ #  ~^172\.(?:1[6-9]|2[0-9]|3[01])\..+$  internal;
+    ## 192.168.0.0/16
+ #  ~^192\.168\..+$  internal;
+    ## 192.0.2.0/24
+    ~^192\.0\.2\..+$  internal;
+    ## 198.51.0.0/24
+ #  ~^198\.51\.0\..+$  internal;
+    ## 198.18.0.0/15
+ #  ~^198\.1[89]\..+$  internal;
+    ## 203.0.113.0/24
+ #  ~^203\.0\.113\..+$  internal;
+    ## 240.0.0.0/4
+    ~^2(?:4[0-9]|5[0-5])\..+$  internal;
+}
+
 map $scheme:$host
     $krdsh_need_ssl
 {

njs/nexus.js

@@ -6,4 +6,4 @@ function statics(r) {
     r.return(307, s);
 }
 
-export default {statics};
+export default { statics };

njs/quay.js

@@ -0,0 +1,7 @@
+function route_ui(r)
+{
+    r.internalRedirect("@" + r.variables.krdsh_quay_ui_njs + "_ui");
+}
+
+
+export default { route_ui };

site.avail/http-ci.krd.sh.conf

@@ -0,0 +1,112 @@
+upstream krdsh_ci {
+    server 127.0.0.1:8000;
+}
+upstream krdsh_ci_grpc {
+    server 127.0.0.1:9000;
+}
+
+proxy_cache_path
+    /var/cache/angie/proxy/krdsh-ci
+    keys_zone=krdsh_cache_ci:10m
+    levels=1:2 inactive=1h;
+
+server {
+    server_name ci.krd.sh;
+
+    include snip.d/listen-http;
+
+    access_log off;
+    log_not_found off;
+
+    root /var/www/empty;
+
+    include snip.d/https-alt-svc;
+    include snip.d/http-security-headers;
+
+    keepalive_timeout 0;
+
+    include snip.d/empty-favicon;
+
+    location /
+    {
+        return 301 https://$host$uri$is_args$args;
+    }
+}
+
+server {
+    server_name ci.krd.sh;
+
+    include snip.d/listen-https;
+    include snip.d/ssl-krd.sh;
+
+    access_log off;
+    log_not_found off;
+
+    root /var/www/empty;
+
+    include snip.d/http-security-headers;
+
+    include snip.d/proxy-common-headers;
+    include snip.d/proxy-accept-encoding;
+    include snip.d/proxy-connection-keepalive;
+    include snip.d/proxy-early-data;
+
+    proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://$host/$1;
+
+    location /
+    {
+        proxy_pass http://krdsh_ci;
+
+        ## quirks
+        client_max_body_size 512M;
+        proxy_buffering off;
+    }
+
+    location @precache
+    {
+        proxy_pass http://krdsh_ci;
+
+        proxy_cache krdsh_cache_ci;
+
+        proxy_cache_key  $uri;
+
+        expires 2h;
+        proxy_cache_valid 200 4h;
+        proxy_cache_valid 10s;
+        proxy_ignore_client_abort on;
+
+        proxy_ignore_headers  Cache-Control Expires;
+        proxy_hide_header     Cache-Control;
+        proxy_hide_header     Expires;
+
+        ## quirks
+        proxy_method GET;
+        proxy_temp_file_write_size 4m;
+    }
+
+    location /assets/
+    {
+        try_files /.non-existent-uri @precache;
+    }
+}
+
+server {
+    server_name ci.krd.sh;
+
+    include snip.d/listen-grpcs;
+    include snip.d/ssl-krd.sh;
+
+    access_log off;
+    log_not_found off;
+
+    root /var/www/empty;
+
+    include snip.d/http-security-headers;
+
+    include snip.d/grpc-accept-encoding;
+
+    location /
+    {
+        grpc_pass grpc://krdsh_ci_grpc;
+    }
+}

site.avail/http-deb.krd.sh.conf

@@ -12,7 +12,8 @@ server {
 
     include snip.d/empty-favicon;
 
-    location / {
+    location /
+    {
         return 301 https://$host$request_uri;
 
         include snip.d/https-alt-svc;
@@ -24,8 +25,8 @@ server {
     location ~*/(?:InRelease|Release|Packages|Sources)$
              ~*/[^/]+/.*[^/]+\.(?:asc|dsc)$
     {
-        default_type text/plain;
         try_files $uri $uri/ =404;
+        default_type text/plain;
     }
 
     ## /*/dists/*/Release.gpg
@@ -38,9 +39,8 @@ server {
              ## various tarball file name extensions (sic!)
              ~*\.t(?:[agx]z|bz2?|[bz]2|bJ|zo|lz(?:|ma?)|zstd?|a?Z)$
     {
-        gzip off;
-        brotli off;
         try_files $uri $uri/ =404;
+        include snip.d/disable-comp;
     }
 }
 
@@ -58,7 +58,8 @@ server {
 
     include snip.d/empty-favicon;
 
-    location / {
+    location /
+    {
         try_files $uri $uri/ =404;
 
         include snip.d/https-alt-svc;
@@ -68,24 +69,23 @@ server {
     location ~*/(?:InRelease|Release|Packages|Sources)$
              ~*\.(?:asc|build|buildinfo|changes|dsc|list|log|sources)$
     {
-        default_type text/plain;
         try_files $uri $uri/ =404;
+        default_type text/plain;
     }
 
     location ~*\.(?:bz2|deb|gz|tar|udeb|xz|Z|zip|zstd?)$
              ## various tarball file name extensions (sic!)
              ~*\.t(?:[agx]z|bz2?|[bz]2|bJ|zo|lz(?:|ma?)|zstd?|a?Z)$
     {
-        gzip off;
-        brotli off;
         try_files $uri $uri/ =404;
+        include snip.d/disable-comp;
     }
 
     ## "meta" usually doesn't contain sensitive data
     # include snip.d/deny-dotfiles;
     location ~*^/[^/]+/\.meta/
     {
-        default_type text/plain;
         try_files $uri $uri/ =404;
+        default_type text/plain;
     }
 }

site.avail/http-git.krd.sh.conf

@@ -1,25 +1,14 @@
 upstream krdsh_git {
     server 127.0.0.1:3000;
 }
-upstream krdsh_ci {
-    server 127.0.0.1:8000;
-}
-upstream krdsh_ci_grpc {
-    server 127.0.0.1:9000;
-}
 
 proxy_cache_path
     /var/cache/angie/proxy/krdsh-git
     keys_zone=krdsh_cache_git:10m
     levels=1:2 inactive=1h;
 
-proxy_cache_path
-    /var/cache/angie/proxy/krdsh-ci
-    keys_zone=krdsh_cache_ci:10m
-    levels=1:2 inactive=1h;
-
 server {
-    server_name git.krd.sh ci.krd.sh;
+    server_name git.krd.sh;
 
     include snip.d/listen-http;
 
@@ -35,7 +24,8 @@ server {
 
     include snip.d/empty-favicon;
 
-    location / {
+    location /
+    {
         return 301 https://$host$uri$is_args$args;
     }
 }
@@ -58,111 +48,40 @@ server {
     include snip.d/proxy-connection-keepalive;
     include snip.d/proxy-early-data;
 
-    proxy_redirect  ~*^http://(ci|git)\.krd\.sh(?:|:[0-9]+)/(.*)$  https://$1.krd.sh/$2;
+    proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://$host/$1;
 
-    location / {
+    location /
+    {
         proxy_pass http://krdsh_git;
+
         ## quirks
         client_max_body_size 512M;
-        chunked_transfer_encoding off;
     }
 
-    location @precache {
+    location @precache
+    {
         proxy_pass http://krdsh_git;
 
         proxy_cache krdsh_cache_git;
+
         proxy_cache_key $uri;
-        proxy_cache_valid 200 1h;
+
-        proxy_cache_valid 30s;
+        expires 2h;
+        proxy_cache_valid 200 4h;
+        proxy_cache_valid 10s;
         proxy_ignore_client_abort on;
 
-        proxy_ignore_headers Cache-Control;
+        proxy_ignore_headers  Cache-Control Expires;
         proxy_hide_header     Cache-Control;
-        expires 2h;
+        proxy_hide_header     Expires;
 
         ## quirks
-        chunked_transfer_encoding off;
         proxy_method GET;
-        proxy_buffering on;
         proxy_temp_file_write_size 4m;
     }
 
-    location /assets/ {
+    location /assets/
+    {
         try_files /.non-existent-uri @precache;
-        # proxy_pass http://krdsh_git;
-    }
-}
-
-server {
-    server_name ci.krd.sh;
-
-    include snip.d/listen-https;
-    include snip.d/ssl-krd.sh;
-
-    access_log off;
-    log_not_found off;
-
-    root /var/www/empty;
-
-    include snip.d/http-security-headers;
-
-    include snip.d/proxy-common-headers;
-    include snip.d/proxy-accept-encoding;
-    include snip.d/proxy-connection-keepalive;
-    include snip.d/proxy-early-data;
-
-    proxy_redirect  ~*^http://(ci|git)\.krd\.sh(?:|:[0-9]+)/(.*)$  https://$1.krd.sh/$2;
-
-    location / {
-        proxy_pass http://krdsh_ci;
-        ## quirks
-        chunked_transfer_encoding off;
-        client_max_body_size 16M;
-        proxy_buffering off;
-    }
-
-    location @precache {
-        proxy_pass http://krdsh_ci;
-
-        proxy_cache krdsh_cache_ci;
-        proxy_cache_key $uri;
-        proxy_cache_valid 200 1h;
-        proxy_cache_valid 30s;
-        proxy_ignore_client_abort on;
-
-        proxy_ignore_headers Cache-Control;
-        proxy_hide_header Cache-Control;
-        expires 2h;
-
-        ## quirks
-        chunked_transfer_encoding off;
-        proxy_method GET;
-        proxy_buffering on;
-        proxy_temp_file_write_size 4m;
-    }
-
-    location /assets/ {
-        try_files /.non-existent-uri @precache;
-        # proxy_pass http://krdsh_ci;
-    }
-}
-
-server {
-    server_name ci.krd.sh;
-
-    include snip.d/listen-grpcs;
-    include snip.d/ssl-krd.sh;
-
-    access_log off;
-    log_not_found off;
-
-    root /var/www/empty;
-
-    include snip.d/http-security-headers;
-
-    include snip.d/grpc-accept-encoding;
-
-    location / {
-        grpc_pass grpc://krdsh_ci_grpc;
     }
 }

site.avail/http-nexus.krd.sh.conf

@@ -26,7 +26,8 @@ server {
 
     include snip.d/empty-favicon;
 
-    location / {
+    location /
+    {
         return 301 https://$host$uri$is_args$args;
     }
 
@@ -34,11 +35,11 @@ server {
 
     location ~*^/repository/apt_[^/]+/(?:dists|pool)/
     {
-        gzip off;
-        brotli off;
-
         proxy_pass http://krdsh_nexus;
+
         proxy_method GET;
+
+        include snip.d/disable-comp;
     }
 
     ## allow proxy repositories only for non-public usage
@@ -51,53 +52,9 @@ server {
         deny  all;
 
         proxy_pass http://krdsh_nexus;
+
         proxy_method GET;
     }
-
-    ## quirks
-    chunked_transfer_encoding off;
-}
-
-server {
-    server_name nexus-asis.krd.sh;
-
-    include snip.d/listen-https;
-    include snip.d/ssl-krd.sh;
-
-    access_log off;
-    log_not_found off;
-
-    root /var/www/empty;
-
-    include snip.d/http-security-headers;
-
-    include snip.d/proxy-common-headers;
-    include snip.d/proxy-accept-encoding;
-    include snip.d/proxy-connection-keepalive;
-    include snip.d/proxy-early-data;
-
-    proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://$host/$1;
-
-    location / {
-        proxy_pass http://krdsh_nexus;
-        ## quirks
-        client_max_body_size 1024M;
-    }
-
-    ## allow proxy repositories only for non-public usage
-
-    location ~*^/repository/proxy_[^/]+/
-    {
-        allow 127.0.0.0/8;
-        allow 192.0.2.0/24;
-        allow 240.0.0.0/4;
-        deny  all;
-
-        proxy_pass http://krdsh_nexus;
-    }
-
-    ## quirks
-    chunked_transfer_encoding off;
 }
 
 server {
@@ -120,10 +77,12 @@ server {
 
     proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://$host/$1;
 
-    location / {
+    location /
+    {
         proxy_pass http://krdsh_nexus;
+
         ## quirks
-        client_max_body_size 1024M;
+        client_max_body_size 10G;
     }
 
     ## allow proxy repositories only for non-public usage
@@ -140,12 +99,10 @@ server {
 
     js_import njs/nexus.js;
 
-    location /static/ {
+    location /static/
+    {
         js_content nexus.statics;
     }
-
-    ## quirks
-    chunked_transfer_encoding off;
 }
 
 server {
@@ -186,8 +143,9 @@ server {
     include snip.d/proxy-connection-close;
     include snip.d/proxy-early-data;
 
-    proxy_ignore_headers Cache-Control;
+    proxy_ignore_headers  Cache-Control Expires;
     proxy_hide_header     Cache-Control;
+    proxy_hide_header     Expires;
 
     proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://nexus.krd.sh/$1;
 
@@ -203,18 +161,16 @@ server {
         proxy_pass http://krdsh_nexus;
 
         proxy_cache krdsh_cache_nexus;
-        proxy_cache_key $uri$is_args$args;
+
-        proxy_cache_valid 200 1h;
+        proxy_cache_key  $uri;
-        proxy_cache_valid 30s;
+
-        proxy_ignore_client_abort on;
         expires 2h;
+        proxy_cache_valid 200 4h;
+        proxy_cache_valid 10s;
+        proxy_ignore_client_abort on;
 
         ## quirks
         proxy_method GET;
-        proxy_buffering on;
         proxy_temp_file_write_size 4m;
     }
-
-    ## quirks
-    chunked_transfer_encoding off;
 }

site.avail/http-nodejs-org.krd.sh.conf

@@ -14,7 +14,8 @@ server {
 
     root /var/www/empty;
 
-    location / {
+    location /
+    {
         try_files /.non-existent-uri @redirect;
     }
 
@@ -42,29 +43,33 @@ server {
     include snip.d/proxy-accept-encoding;
     include snip.d/proxy-connection-close;
 
-    location @redirect {
+    location @redirect
+    {
         return 301 https://nodejs.org$request_uri;
     }
 
-    location @download {
+    location @download
+    {
         proxy_pass  https://nodejs.org$uri$is_args$args;
 
         proxy_redirect  https://nodejs.org  $scheme://$server_name;
 
         proxy_cache nodejs_org;
-        proxy_cache_key $uri$is_args$args;
+
+        proxy_cache_key $uri;
+
+        expires 30m;
         proxy_cache_valid 200 1h;
         proxy_cache_valid 30s;
         proxy_ignore_client_abort on;
 
-        proxy_ignore_headers Cache-Control;
+        proxy_ignore_headers  Cache-Control Expires;
         proxy_hide_header     Cache-Control;
-        expires 30m;
+        proxy_hide_header     Expires;
 
         ## quirks
         chunked_transfer_encoding off;
         proxy_method GET;
-        proxy_buffering on;
         proxy_temp_file_write_size 4m;
     }
 }

site.avail/http-quay.krd.sh.conf

@@ -8,6 +8,11 @@ upstream krdsh_quay_secscan {
     server unix:/home/user/quay-run/gunicorn_secscan.sock fail_timeout=0;
 }
 
+proxy_cache_path
+    /var/cache/angie/proxy/krdsh-quay
+    keys_zone=krdsh_cache_quay:10m
+    levels=1:2;
+
 map $http2:$http3
     $krdsh_quay_http1_bucket
 {
@@ -16,6 +21,7 @@ map $http2:$http3
     ## current instanse is not behind LB/ingress,
     ## so $proxy_protocol_addr is meaningless
   # ":"  $proxy_protocol_addr;
+
     ":"  $remote_addr;
 }
 
@@ -40,41 +46,62 @@ map $uri
 {
     default  "";
 
+    ## ~*^/v2/([^/]+)(?:/[^/]+)+/blobs/  $1;
+    ## ~*^/v2/([^/]+)/[^/]+/tags/       $1;
+    ## ~*^/v2/([^/]+)/[^/]+/manifests/  $1;
     ~*^/v2/([^/]+)/.+/(?:blobs|manifests|tags)/  $1;
 }
 
 ## use $request_id to remove (tight) request limit
-map $krdsh_quay_namespace
+map $krdsh_quay_namespace:$krdsh_remote_type
     $krdsh_quay_http1_ns_bucket
 {
     default  $krdsh_quay_http1_bucket;
 
-    ~*^(?:k2|krd)$  $request_id;
+    ~*^(?:k2|krd):  $request_id;
+
+    ## remove limits for internal usage
+    ~^[^:]+:internal$  $request_id;
 }
-map $krdsh_quay_namespace
+map $krdsh_quay_namespace:$krdsh_remote_type
     $krdsh_quay_http2_ns_bucket
 {
     default  $krdsh_quay_http2_bucket;
 
-    ~*^(?:k2|krd)$  $request_id;
+    ~*^(?:k2|krd):  $request_id;
+
+    ## remove limits for internal usage
+    ~^[^:]+:internal$  $request_id;
 }
-map $krdsh_quay_namespace
+map $krdsh_quay_namespace:$krdsh_remote_type
     $krdsh_quay_http3_ns_bucket
 {
     default  $krdsh_quay_http3_bucket;
 
-    ~*^(?:k2|krd)$  $request_id;
+    ~*^(?:k2|krd):  $request_id;
+
+    ## remove limits for internal usage
+    ~^[^:]+:internal$  $request_id;
 }
 
 map $cookie_patternfly
     $krdsh_quay_ui
 {
-    volatile;
-
     default  old;
     true     new;
 }
 
+map $request_method:$uri
+    $krdsh_quay_nocache
+{
+    default  1;
+
+    ## cache requests:
+    ## - ^/api/v1/repository/.+/tag/$
+    ## - ^/api/v1/repository/.+/manifest/.+$
+    ~*^(?:GET|HEAD):/api/v1/repository/(?:krd|k2|library|docker_io|quay_io|gcr_io|ghcr_io|registry_k8s_io)/.+/(?:tag/|manifest/.+)$  "";
+}
+
 limit_req_zone  $http_authorization          zone=krdsh_quay_staticauth:10m  rate=30r/s;
 
 limit_req_zone  $krdsh_quay_http1_bucket     zone=krdsh_quay_http1_light:10m     rate=60r/s;
@@ -115,7 +142,8 @@ server {
 
     include snip.d/empty-favicon;
 
-    location / {
+    location /
+    {
         return 301 https://$host$uri$is_args$args;
     }
 }
@@ -144,7 +172,13 @@ server {
 
     error_page 502 /home/user/quay-run-static/static/502.html;
 
-    location /static/ {
+    limit_req_status    429;
+    limit_req_log_level warn;
+
+    js_import njs/quay.js;
+
+    location /static/
+    {
         root /home/user/quay-run-static;
 
         expires 1d;
@@ -156,7 +190,12 @@ server {
         error_page  404  /404;
     }
 
-    location / {
+    location @old_ui
+    {
+        proxy_pass http://krdsh_quay_web;
+    }
+    location @new_ui
+    {
         root /home/user/quay-run-static/static/patternfly;
         index index.html;
 
@@ -164,86 +203,123 @@ server {
         brotli_static  on;
         zstd_static    on;
 
-        if ($krdsh_quay_ui = "old") {
-            proxy_pass http://krdsh_quay_web;
-        }
-        if ($krdsh_quay_ui = "new") {
         rewrite
           ^/(?:overview|organization|repository|tag)
           /index.html
         break;
     }
+    location /
+    {
+        js_content  quay.route_ui;
+
+        js_var  $krdsh_quay_ui_njs  "$krdsh_quay_ui";
     }
 
-    location /angular {
+    location /angular
+    {
         # Expire cookie and switch to old UI
         add_header Set-Cookie "patternfly=deleted; path=/; Expires=Thu, Jan 01 1970 00:00:00 UTC";
         return 302 /$is_args$args;
     }
 
-    location /react {
+    location /react
+    {
         # Set cookie and witch to new UI
         add_header Set-Cookie "patternfly=true; path=/; SameSite=Lax; HttpOnly;" always;
         return 302 /$is_args$args;
     }
 
-    limit_req_status    429;
-    limit_req_log_level warn;
-
     # Temporarily force signin for old and new UI to route to web app
-    location /signin {
+    location /signin
+    {
         proxy_pass http://krdsh_quay_web/;
     }
 
     # Capture traffic that needs to go to web_app, see /web.py
-    location ~* ^/(?:config|csrf_token|oauth1|oauth2|webhooks|keys|.well-known|customtrigger|userfiles/) {
+    location ~* ^/(?:config|csrf_token|oauth1|oauth2|webhooks|keys|.well-known|customtrigger|userfiles/)
+    {
         proxy_pass http://krdsh_quay_web;
     }
 
     # Capture old UI paths that aren't present in new UI
-    location ~* ^/(?:user/|search) {
+    location ~* ^/(?:user/|search)
+    {
         proxy_pass http://krdsh_quay_web;
     }
 
-    location /push {
+    location /push
+    {
         proxy_pass http://krdsh_quay_web;
 
         client_max_body_size 5M;
     }
 
-    location /realtime {
+    location /realtime
+    {
         proxy_pass http://krdsh_quay_web;
 
         proxy_buffering off;
         proxy_request_buffering off;
     }
 
-    location /secscan/ {
+    location /secscan/
+    {
         proxy_pass http://krdsh_quay_secscan;
     }
 
     # location ~ ^/v2/.+/_trust/tuf/ {
     #     proxy_pass https://tuf.krd.sh$uri;
-    #
+
     #     include snip.d/proxy-common-headers;
     #     include snip.d/proxy-accept-encoding;
     #     include snip.d/proxy-connection-close;
     #     include snip.d/proxy-early-data;
-    #
+
-    #     proxy_set_header  Host  tuf.krd.sh;
+    #     proxy_set_header  Host  $host;
     # }
 
-    location /api/ {
+    location ~* ^/api/v1/repository(?:/.+/tag/|/.+/manifest/.+)$
+    {
+        limit_req zone=krdsh_quay_http1_medium burst=50 nodelay;
+        limit_req zone=krdsh_quay_http2_medium burst=100 nodelay;
+        limit_req zone=krdsh_quay_http3_medium burst=100 nodelay;
+
         proxy_pass http://krdsh_quay_web;
 
+        keepalive_timeout 0;
+
+        proxy_cache krdsh_cache_quay;
+        proxy_cache_key     $uri$is_args$args;
+        proxy_cache_bypass  $http_pragma  $http_authorization  $krdsh_quay_nocache;
+        proxy_no_cache      $http_pragma  $http_authorization  $krdsh_quay_nocache;
+
+        expires 30s;
+        proxy_cache_valid 200 1m;
+        proxy_cache_valid 10s;
+        proxy_ignore_client_abort on;
+
+        proxy_ignore_headers  Cache-Control  Expires  Set-Cookie  Vary;
+        proxy_hide_header     Cache-Control;
+        proxy_hide_header     Expires;
+        proxy_hide_header     Set-Cookie;
+        proxy_hide_header     Vary;
+
+        ## quirks
+        proxy_temp_file_write_size 4m;
+    }
+    location /api/
+    {
         limit_req zone=krdsh_quay_http1_heavy burst=25 nodelay;
         limit_req zone=krdsh_quay_http2_heavy burst=100 nodelay;
         limit_req zone=krdsh_quay_http3_heavy burst=100 nodelay;
 
+        proxy_pass http://krdsh_quay_web;
+
         keepalive_timeout 0;
     }
 
-    location /api/suconfig {
+    location /api/suconfig
+    {
         proxy_pass http://krdsh_quay_web;
 
         proxy_read_timeout 2000;
@@ -251,33 +327,36 @@ server {
 
     ## Docker Registry V2
 
-    location = /v2/auth {
+    location = /v2/auth
-        proxy_pass http://krdsh_quay_registry;
+    {
-
         limit_req zone=krdsh_quay_staticauth burst=10 nodelay;
 
+        proxy_pass http://krdsh_quay_registry;
+
         keepalive_timeout 0;
     }
 
-    location ~* ^/v2/_catalog {
+    location ~* ^/v2/_catalog
-        proxy_pass http://krdsh_quay_registry;
+    {
-
-        proxy_read_timeout 10;
-        keepalive_timeout 0;
-
         limit_req zone=krdsh_quay_http1_heavy burst=1 nodelay;
         limit_req zone=krdsh_quay_http2_heavy burst=5 nodelay;
         limit_req zone=krdsh_quay_http3_heavy burst=5 nodelay;
-    }
 
-    location ~* ^/v2/.+/blobs/ {
         proxy_pass http://krdsh_quay_registry;
 
-        # if ($request_method = HEAD) {
+        keepalive_timeout 0;
-        #     gzip   off;
+        proxy_read_timeout 10;
-        #     brotli off;
+    }
-        #     zstd   off;
+
-        # }
+    location ~* ^/v2/.+/blobs/
+    {
+        limit_req zone=krdsh_quay_http1_ns_medium burst=50 nodelay;
+        limit_req zone=krdsh_quay_http2_ns_medium burst=100 nodelay;
+        limit_req zone=krdsh_quay_http3_ns_medium burst=100 nodelay;
+
+        proxy_pass http://krdsh_quay_registry;
+
+        keepalive_timeout 0;
 
         proxy_buffering off;
         proxy_request_buffering off;
@@ -285,76 +364,76 @@ server {
         proxy_read_timeout  2000;
         proxy_send_timeout  2000;
 
-        client_max_body_size 10240M;
+        client_max_body_size 10G;
         http2_chunk_size 32k;
 
-        limit_req zone=krdsh_quay_http1_ns_medium burst=50 nodelay;
+        include snip.d/disable-comp;
-        limit_req zone=krdsh_quay_http2_ns_medium burst=100 nodelay;
-        limit_req zone=krdsh_quay_http3_ns_medium burst=100 nodelay;
-
-        keepalive_timeout 0;
     }
 
-    location ~* ^/v2/.+/tags/ {
+    location ~* ^/v2/.+/tags/
-        proxy_pass http://krdsh_quay_registry;
+    {
-
         limit_req zone=krdsh_quay_http1_ns_heavy burst=2 nodelay;
         limit_req zone=krdsh_quay_http2_ns_heavy burst=2 nodelay;
         limit_req zone=krdsh_quay_http3_ns_heavy burst=2 nodelay;
 
+        proxy_pass http://krdsh_quay_registry;
+
         keepalive_timeout 0;
     }
 
-    location ~* ^/v2/.+/manifests/ {
+    location ~* ^/v2/.+/manifests/
-        proxy_pass http://krdsh_quay_registry;
+    {
-
         limit_req zone=krdsh_quay_http1_ns_medium burst=10 nodelay;
         limit_req zone=krdsh_quay_http2_ns_medium burst=50 nodelay;
         limit_req zone=krdsh_quay_http3_ns_medium burst=50 nodelay;
 
+        proxy_pass http://krdsh_quay_registry;
+
         keepalive_timeout 0;
     }
 
-    location /v2/ {
+    location /v2/
-        proxy_pass http://krdsh_quay_registry;
+    {
-
-        # if ($request_method = HEAD) {
-        #     gzip   off;
-        #     brotli off;
-        #     zstd   off;
-        # }
-
         limit_req zone=krdsh_quay_http1_light burst=20 nodelay;
         limit_req zone=krdsh_quay_http2_light burst=80 nodelay;
         limit_req zone=krdsh_quay_http3_light burst=80 nodelay;
 
+        proxy_pass http://krdsh_quay_registry;
+
         keepalive_timeout 0;
     }
 
     ## Docker Registry V1
     ## KrD: seems to be legacy
 
-    location /v1/ {
+    location /v1/
-        proxy_pass http://krdsh_quay_registry;
+    {
-
+        return 444;
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        client_max_body_size 10240M;
-
-        limit_req zone=krdsh_quay_http1_heavy burst=5 nodelay;
-        limit_req zone=krdsh_quay_http2_heavy burst=25 nodelay;
-        limit_req zone=krdsh_quay_http3_heavy burst=25 nodelay;
-
-        keepalive_timeout 0;
     }
 
-    location = /v1/_ping {
+    # location /v1/
-        default_type text/plain;
+    # {
+    #     limit_req zone=krdsh_quay_http1_heavy burst=5 nodelay;
+    #     limit_req zone=krdsh_quay_http2_heavy burst=25 nodelay;
+    #     limit_req zone=krdsh_quay_http3_heavy burst=25 nodelay;
 
-        add_header  X-Docker-Registry-Version     0.6.0;
+    #     proxy_pass http://krdsh_quay_registry;
-        add_header  X-Docker-Registry-Standalone  0;
 
-        return 200 "true";
+    #     proxy_buffering off;
-    }
+    #     proxy_request_buffering off;
+
+    #     client_max_body_size 10G;
+
+    #     keepalive_timeout 0;
+    # }
+
+    # location = /v1/_ping
+    # {
+    #     default_type text/plain;
+
+    #     add_header  X-Docker-Registry-Version     0.6.0;
+    #     add_header  X-Docker-Registry-Standalone  0;
+
+    #     return 200 "true";
+    # }
 }

site.d/http-210-ci.krd.sh.conf

@@ -0,0 +1 @@
+../site.avail/http-ci.krd.sh.conf

snip.d/disable-comp

@@ -0,0 +1,3 @@
+gzip off;
+brotli off;
+zstd off;