quay: improvements

conf.avail/core-worker-rlimit-nofile.conf

@@ -1 +1 @@
-worker_rlimit_nofile 1048576;
+worker_rlimit_nofile 262144;

conf.avail/core_events-worker-connections.conf

@@ -1 +1 @@
-worker_connections 16384;
+worker_connections 65536;

conf.avail/http-brotli.conf

@@ -2,8 +2,10 @@ brotli on;
 
 ## default is 6
 brotli_comp_level  5;
-brotli_min_length  1024;
+## default is 512k
+brotli_window 64k;
 
+brotli_min_length  1024;
 brotli_buffers     32  16k;
 
 brotli_types

conf.avail/http-gzip.conf

@@ -2,14 +2,14 @@ gzip on;
 
 ## default is 1
 gzip_comp_level  2;
+
 gzip_min_length  1024;
+gzip_buffers     32  16k;
+gunzip_buffers   32  16k;
 
 gzip_vary     on;
 gzip_proxied  any;
 
-gzip_buffers    32  16k;
-gunzip_buffers  32  16k;
-
 gzip_types
     application/atom+xml
     application/javascript

conf.avail/http-krd.sh.conf

@@ -1,3 +1,28 @@
+map $remote_addr
+    $krdsh_remote_type
+{
+    default  external;
+
+    ## 127.0.0.0/8
+    ~^127\..+$  internal;
+    ## 10.0.0.0/8
+ #  ~^10\..+$  internal;
+    ## 172.16.0.0/12
+ #  ~^172\.(?:1[6-9]|2[0-9]|3[01])\..+$  internal;
+    ## 192.168.0.0/16
+ #  ~^192\.168\..+$  internal;
+    ## 192.0.2.0/24
+    ~^192\.0\.2\..+$  internal;
+    ## 198.51.0.0/24
+ #  ~^198\.51\.0\..+$  internal;
+    ## 198.18.0.0/15
+ #  ~^198\.1[89]\..+$  internal;
+    ## 203.0.113.0/24
+ #  ~^203\.0\.113\..+$  internal;
+    ## 240.0.0.0/4
+    ~^2(?:4[0-9]|5[0-5])\..+$  internal;
+}
+
 map $scheme:$host
     $krdsh_need_ssl
 {

conf.avail/http-zstd.conf

@@ -0,0 +1,24 @@
+zstd on;
+
+## default is 1
+zstd_comp_level  2;
+
+zstd_min_length  1024;
+zstd_buffers     32  16k;
+
+zstd_types
+    application/atom+xml
+    application/javascript
+    application/json
+    application/vnd.api+json
+    application/rss+xml
+    application/x-javascript
+    application/xhtml+xml
+    application/xml
+    image/svg+xml
+    image/x-icon
+    text/css
+    text/javascript
+    text/plain
+    text/xml
+;

conf.d/http-zstd.conf

@@ -0,0 +1 @@
+../conf.avail/http-zstd.conf

mod.avail/http-zstd.conf

@@ -0,0 +1,2 @@
+load_module modules/ngx_http_zstd_filter_module.so;
+load_module modules/ngx_http_zstd_static_module.so;

mod.d/http-zstd.conf

@@ -0,0 +1 @@
+../mod.avail/http-zstd.conf

njs/nexus.js

@@ -6,4 +6,4 @@ function statics(r) {
     r.return(307, s);
 }
 
-export default {statics};
+export default { statics };

njs/quay.js

@@ -0,0 +1,7 @@
+function route_ui(r)
+{
+    r.internalRedirect("@" + r.variables.krdsh_quay_ui_njs + "_ui");
+}
+
+
+export default { route_ui };

site.avail/http-ci.krd.sh.conf

@@ -0,0 +1,112 @@
+upstream krdsh_ci {
+    server 127.0.0.1:8000;
+}
+upstream krdsh_ci_grpc {
+    server 127.0.0.1:9000;
+}
+
+proxy_cache_path
+    /var/cache/angie/proxy/krdsh-ci
+    keys_zone=krdsh_cache_ci:10m
+    levels=1:2 inactive=1h;
+
+server {
+    server_name ci.krd.sh;
+
+    include snip.d/listen-http;
+
+    access_log off;
+    log_not_found off;
+
+    root /var/www/empty;
+
+    include snip.d/https-alt-svc;
+    include snip.d/http-security-headers;
+
+    keepalive_timeout 0;
+
+    include snip.d/empty-favicon;
+
+    location /
+    {
+        return 301 https://$host$uri$is_args$args;
+    }
+}
+
+server {
+    server_name ci.krd.sh;
+
+    include snip.d/listen-https;
+    include snip.d/ssl-krd.sh;
+
+    access_log off;
+    log_not_found off;
+
+    root /var/www/empty;
+
+    include snip.d/http-security-headers;
+
+    include snip.d/proxy-common-headers;
+    include snip.d/proxy-accept-encoding;
+    include snip.d/proxy-connection-keepalive;
+    include snip.d/proxy-early-data;
+
+    proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://$host/$1;
+
+    location /
+    {
+        proxy_pass http://krdsh_ci;
+
+        ## quirks
+        client_max_body_size 512M;
+        proxy_buffering off;
+    }
+
+    location @precache
+    {
+        proxy_pass http://krdsh_ci;
+
+        proxy_cache krdsh_cache_ci;
+
+        proxy_cache_key  $uri;
+
+        expires 2h;
+        proxy_cache_valid 200 4h;
+        proxy_cache_valid 10s;
+        proxy_ignore_client_abort on;
+
+        proxy_ignore_headers  Cache-Control Expires;
+        proxy_hide_header     Cache-Control;
+        proxy_hide_header     Expires;
+
+        ## quirks
+        proxy_method GET;
+        proxy_temp_file_write_size 4m;
+    }
+
+    location /assets/
+    {
+        try_files /.non-existent-uri @precache;
+    }
+}
+
+server {
+    server_name ci.krd.sh;
+
+    include snip.d/listen-grpcs;
+    include snip.d/ssl-krd.sh;
+
+    access_log off;
+    log_not_found off;
+
+    root /var/www/empty;
+
+    include snip.d/http-security-headers;
+
+    include snip.d/grpc-accept-encoding;
+
+    location /
+    {
+        grpc_pass grpc://krdsh_ci_grpc;
+    }
+}

site.avail/http-deb.krd.sh.conf

@@ -12,7 +12,8 @@ server {
 
     include snip.d/empty-favicon;
 
-    location / {
+    location /
+    {
         return 301 https://$host$request_uri;
 
         include snip.d/https-alt-svc;
@@ -24,8 +25,8 @@ server {
     location ~*/(?:InRelease|Release|Packages|Sources)$
              ~*/[^/]+/.*[^/]+\.(?:asc|dsc)$
     {
-        default_type text/plain;
         try_files $uri $uri/ =404;
+        default_type text/plain;
     }
 
     ## /*/dists/*/Release.gpg
@@ -38,9 +39,8 @@ server {
              ## various tarball file name extensions (sic!)
              ~*\.t(?:[agx]z|bz2?|[bz]2|bJ|zo|lz(?:|ma?)|zstd?|a?Z)$
     {
-        gzip off;
-        brotli off;
         try_files $uri $uri/ =404;
+        include snip.d/disable-comp;
     }
 }
 
@@ -58,7 +58,8 @@ server {
 
     include snip.d/empty-favicon;
 
-    location / {
+    location /
+    {
         try_files $uri $uri/ =404;
 
         include snip.d/https-alt-svc;
@@ -68,24 +69,23 @@ server {
     location ~*/(?:InRelease|Release|Packages|Sources)$
              ~*\.(?:asc|build|buildinfo|changes|dsc|list|log|sources)$
     {
-        default_type text/plain;
         try_files $uri $uri/ =404;
+        default_type text/plain;
     }
 
     location ~*\.(?:bz2|deb|gz|tar|udeb|xz|Z|zip|zstd?)$
              ## various tarball file name extensions (sic!)
              ~*\.t(?:[agx]z|bz2?|[bz]2|bJ|zo|lz(?:|ma?)|zstd?|a?Z)$
     {
-        gzip off;
-        brotli off;
         try_files $uri $uri/ =404;
+        include snip.d/disable-comp;
     }
 
     ## "meta" usually doesn't contain sensitive data
     # include snip.d/deny-dotfiles;
     location ~*^/[^/]+/\.meta/
     {
-        default_type text/plain;
         try_files $uri $uri/ =404;
+        default_type text/plain;
     }
 }

site.avail/http-git.krd.sh.conf

@@ -1,5 +1,14 @@
+upstream krdsh_git {
+    server 127.0.0.1:3000;
+}
+
+proxy_cache_path
+    /var/cache/angie/proxy/krdsh-git
+    keys_zone=krdsh_cache_git:10m
+    levels=1:2 inactive=1h;
+
 server {
-    server_name git.krd.sh ci.krd.sh;
+    server_name git.krd.sh;
 
     include snip.d/listen-http;
 
@@ -15,16 +24,12 @@ server {
 
     include snip.d/empty-favicon;
 
-    location / {
+    location /
+    {
         return 301 https://$host$uri$is_args$args;
     }
 }
 
-proxy_cache_path
-    /var/cache/angie/proxy/krdsh-git
-    keys_zone=krdsh_git:10m
-    levels=1:2 inactive=1h;
-
 server {
     server_name git.krd.sh;
 
@@ -43,116 +48,40 @@ server {
     include snip.d/proxy-connection-keepalive;
     include snip.d/proxy-early-data;
 
-    proxy_redirect  ~*^http://(ci|git)\.krd\.sh(?:|:[0-9]+)/(.*)$  https://$1.krd.sh/$2;
+    proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://$host/$1;
+
+    location /
+    {
+        proxy_pass http://krdsh_git;
 
-    location / {
-        proxy_pass http://127.0.0.1:3000;
         ## quirks
         client_max_body_size 512M;
-        chunked_transfer_encoding off;
     }
 
-    location @precache {
+    location @precache
-        proxy_pass http://127.0.0.1:3000;
+    {
+        proxy_pass http://krdsh_git;
+
+        proxy_cache krdsh_cache_git;
 
-        proxy_cache krdsh_git;
         proxy_cache_key $uri;
-        proxy_cache_valid 200 1h;
+
-        proxy_cache_valid 30s;
+        expires 2h;
+        proxy_cache_valid 200 4h;
+        proxy_cache_valid 10s;
         proxy_ignore_client_abort on;
 
-        proxy_ignore_headers Cache-Control;
+        proxy_ignore_headers  Cache-Control Expires;
         proxy_hide_header     Cache-Control;
-        expires 2h;
+        proxy_hide_header     Expires;
 
         ## quirks
-        chunked_transfer_encoding off;
         proxy_method GET;
-        proxy_buffering on;
         proxy_temp_file_write_size 4m;
     }
 
-    location /assets/ {
+    location /assets/
+    {
         try_files /.non-existent-uri @precache;
-        # proxy_pass http://127.0.0.1:3000;
-    }
-}
-
-proxy_cache_path
-    /var/cache/angie/proxy/krdsh-ci
-    keys_zone=krdsh_ci:10m
-    levels=1:2 inactive=1h;
-
-server {
-    server_name ci.krd.sh;
-
-    include snip.d/listen-https;
-    include snip.d/ssl-krd.sh;
-
-    access_log off;
-    log_not_found off;
-
-    root /var/www/empty;
-
-    include snip.d/http-security-headers;
-
-    include snip.d/proxy-common-headers;
-    include snip.d/proxy-accept-encoding;
-    include snip.d/proxy-connection-keepalive;
-    include snip.d/proxy-early-data;
-
-    proxy_redirect  ~*^http://(ci|git)\.krd\.sh(?:|:[0-9]+)/(.*)$  https://$1.krd.sh/$2;
-
-    location / {
-        proxy_pass http://127.0.0.1:8000;
-        ## quirks
-        chunked_transfer_encoding off;
-        client_max_body_size 16M;
-        proxy_buffering off;
-    }
-
-    location @precache {
-        proxy_pass http://127.0.0.1:8000;
-
-        proxy_cache krdsh_ci;
-        proxy_cache_key $uri;
-        proxy_cache_valid 200 1h;
-        proxy_cache_valid 30s;
-        proxy_ignore_client_abort on;
-
-        proxy_ignore_headers Cache-Control;
-        proxy_hide_header Cache-Control;
-        expires 2h;
-
-        ## quirks
-        chunked_transfer_encoding off;
-        proxy_method GET;
-        proxy_buffering on;
-        proxy_temp_file_write_size 4m;
-    }
-
-    location /assets/ {
-        try_files /.non-existent-uri @precache;
-        # proxy_pass http://127.0.0.1:8000;
-    }
-}
-
-server {
-    server_name ci.krd.sh;
-
-    include snip.d/listen-grpcs;
-    include snip.d/ssl-krd.sh;
-
-    access_log off;
-    log_not_found off;
-
-    root /var/www/empty;
-
-    include snip.d/http-security-headers;
-
-    include snip.d/grpc-accept-encoding;
-
-    location / {
-        grpc_pass grpc://127.0.0.1:9000;
     }
 }

site.avail/http-nexus.krd.sh.conf

@@ -1,3 +1,12 @@
+upstream krdsh_nexus {
+    server 127.0.0.1:8081;
+}
+
+proxy_cache_path
+    /var/cache/angie/proxy/krdsh-nexus
+    keys_zone=krdsh_cache_nexus:10m
+    levels=1:2 inactive=1h;
+
 server {
     server_name nexus.krd.sh;
 
@@ -17,7 +26,8 @@ server {
 
     include snip.d/empty-favicon;
 
-    location / {
+    location /
+    {
         return 301 https://$host$uri$is_args$args;
     }
 
@@ -25,11 +35,11 @@ server {
 
     location ~*^/repository/apt_[^/]+/(?:dists|pool)/
     {
-        gzip off;
+        proxy_pass http://krdsh_nexus;
-        brotli off;
 
-        proxy_pass http://127.0.0.1:8081;
         proxy_method GET;
+
+        include snip.d/disable-comp;
     }
 
     ## allow proxy repositories only for non-public usage
@@ -41,54 +51,10 @@ server {
         allow 240.0.0.0/4;
         deny  all;
 
-        proxy_pass http://127.0.0.1:8081;
+        proxy_pass http://krdsh_nexus;
+
         proxy_method GET;
     }
-
-    ## quirks
-    chunked_transfer_encoding off;
-}
-
-server {
-    server_name nexus-asis.krd.sh;
-
-    include snip.d/listen-https;
-    include snip.d/ssl-krd.sh;
-
-    access_log off;
-    log_not_found off;
-
-    root /var/www/empty;
-
-    include snip.d/http-security-headers;
-
-    include snip.d/proxy-common-headers;
-    include snip.d/proxy-accept-encoding;
-    include snip.d/proxy-connection-keepalive;
-    include snip.d/proxy-early-data;
-
-    proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://$host/$1;
-
-    location / {
-        proxy_pass http://127.0.0.1:8081;
-        ## quirks
-        client_max_body_size 1024M;
-    }
-
-    ## allow proxy repositories only for non-public usage
-
-    location ~*^/repository/proxy_[^/]+/
-    {
-        allow 127.0.0.0/8;
-        allow 192.0.2.0/24;
-        allow 240.0.0.0/4;
-        deny  all;
-
-        proxy_pass http://127.0.0.1:8081;
-    }
-
-    ## quirks
-    chunked_transfer_encoding off;
 }
 
 server {
@@ -111,10 +77,12 @@ server {
 
     proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://$host/$1;
 
-    location / {
+    location /
-        proxy_pass http://127.0.0.1:8081;
+    {
+        proxy_pass http://krdsh_nexus;
+
         ## quirks
-        client_max_body_size 1024M;
+        client_max_body_size 10G;
     }
 
     ## allow proxy repositories only for non-public usage
@@ -126,24 +94,17 @@ server {
         allow 240.0.0.0/4;
         deny  all;
 
-        proxy_pass http://127.0.0.1:8081;
+        proxy_pass http://krdsh_nexus;
     }
 
     js_import njs/nexus.js;
 
-    location /static/ {
+    location /static/
+    {
         js_content nexus.statics;
     }
-
-    ## quirks
-    chunked_transfer_encoding off;
 }
 
-proxy_cache_path
-    /var/cache/angie/proxy/krdsh-nexus
-    keys_zone=krdsh_nexus:10m
-    levels=1:2 inactive=1h;
-
 server {
     ## PITA
     server_name
@@ -182,8 +143,9 @@ server {
     include snip.d/proxy-connection-close;
     include snip.d/proxy-early-data;
 
-    proxy_ignore_headers Cache-Control;
+    proxy_ignore_headers  Cache-Control Expires;
     proxy_hide_header     Cache-Control;
+    proxy_hide_header     Expires;
 
     proxy_redirect  ~*^http://$host(?:|:[0-9]+)/(.*)$  https://nexus.krd.sh/$1;
 
@@ -196,21 +158,19 @@ server {
     }
 
     location @precache {
-        proxy_pass http://127.0.0.1:8081;
+        proxy_pass http://krdsh_nexus;
+
+        proxy_cache krdsh_cache_nexus;
+
+        proxy_cache_key  $uri;
 
-        proxy_cache krdsh_nexus;
-        proxy_cache_key $uri$is_args$args;
-        proxy_cache_valid 200 1h;
-        proxy_cache_valid 30s;
-        proxy_ignore_client_abort on;
         expires 2h;
+        proxy_cache_valid 200 4h;
+        proxy_cache_valid 10s;
+        proxy_ignore_client_abort on;
 
         ## quirks
         proxy_method GET;
-        proxy_buffering on;
         proxy_temp_file_write_size 4m;
     }
-
-    ## quirks
-    chunked_transfer_encoding off;
 }

site.avail/http-nodejs-org.krd.sh.conf

@@ -14,7 +14,8 @@ server {
 
     root /var/www/empty;
 
-    location / {
+    location /
+    {
         try_files /.non-existent-uri @redirect;
     }
 
@@ -42,29 +43,33 @@ server {
     include snip.d/proxy-accept-encoding;
     include snip.d/proxy-connection-close;
 
-    location @redirect {
+    location @redirect
+    {
         return 301 https://nodejs.org$request_uri;
     }
 
-    location @download {
+    location @download
+    {
         proxy_pass  https://nodejs.org$uri$is_args$args;
 
         proxy_redirect  https://nodejs.org  $scheme://$server_name;
 
         proxy_cache nodejs_org;
-        proxy_cache_key $uri$is_args$args;
+
+        proxy_cache_key $uri;
+
+        expires 30m;
         proxy_cache_valid 200 1h;
         proxy_cache_valid 30s;
         proxy_ignore_client_abort on;
 
-        proxy_ignore_headers Cache-Control;
+        proxy_ignore_headers  Cache-Control Expires;
         proxy_hide_header     Cache-Control;
-        expires 30m;
+        proxy_hide_header     Expires;
 
         ## quirks
         chunked_transfer_encoding off;
         proxy_method GET;
-        proxy_buffering on;
         proxy_temp_file_write_size 4m;
     }
 }

site.avail/http-quay.krd.sh.conf

@@ -0,0 +1,439 @@
+upstream krdsh_quay_web {
+    server unix:/home/user/quay-run/gunicorn_web.sock fail_timeout=0;
+}
+upstream krdsh_quay_registry {
+    server unix:/home/user/quay-run/gunicorn_registry.sock fail_timeout=0;
+}
+upstream krdsh_quay_secscan {
+    server unix:/home/user/quay-run/gunicorn_secscan.sock fail_timeout=0;
+}
+
+proxy_cache_path
+    /var/cache/angie/proxy/krdsh-quay
+    keys_zone=krdsh_cache_quay:10m
+    levels=1:2;
+
+map $http2:$http3
+    $krdsh_quay_http1_bucket
+{
+    default  $request_id;
+
+    ## current instanse is not behind LB/ingress,
+    ## so $proxy_protocol_addr is meaningless
+  # ":"  $proxy_protocol_addr;
+
+    ":"  $remote_addr;
+}
+
+map $http2
+    $krdsh_quay_http2_bucket
+{
+    default  $connection;
+
+    ""  $request_id;
+}
+
+map $http3
+    $krdsh_quay_http3_bucket
+{
+    default  $quic_connection;
+
+    ""  $request_id;
+}
+
+map $uri
+    $krdsh_quay_namespace
+{
+    default  "";
+
+    ## ~*^/v2/([^/]+)(?:/[^/]+)+/blobs/  $1;
+    ## ~*^/v2/([^/]+)/[^/]+/tags/       $1;
+    ## ~*^/v2/([^/]+)/[^/]+/manifests/  $1;
+    ~*^/v2/([^/]+)/.+/(?:blobs|manifests|tags)/  $1;
+}
+
+## use $request_id to remove (tight) request limit
+map $krdsh_quay_namespace:$krdsh_remote_type
+    $krdsh_quay_http1_ns_bucket
+{
+    default  $krdsh_quay_http1_bucket;
+
+    ~*^(?:k2|krd):  $request_id;
+
+    ## remove limits for internal usage
+    ~^[^:]+:internal$  $request_id;
+}
+map $krdsh_quay_namespace:$krdsh_remote_type
+    $krdsh_quay_http2_ns_bucket
+{
+    default  $krdsh_quay_http2_bucket;
+
+    ~*^(?:k2|krd):  $request_id;
+
+    ## remove limits for internal usage
+    ~^[^:]+:internal$  $request_id;
+}
+map $krdsh_quay_namespace:$krdsh_remote_type
+    $krdsh_quay_http3_ns_bucket
+{
+    default  $krdsh_quay_http3_bucket;
+
+    ~*^(?:k2|krd):  $request_id;
+
+    ## remove limits for internal usage
+    ~^[^:]+:internal$  $request_id;
+}
+
+map $cookie_patternfly
+    $krdsh_quay_ui
+{
+    default  old;
+    true     new;
+}
+
+map $request_method:$uri
+    $krdsh_quay_nocache
+{
+    default  1;
+
+    ## cache requests:
+    ## - ^/api/v1/repository/.+/tag/$
+    ## - ^/api/v1/repository/.+/manifest/.+$
+    ~*^(?:GET|HEAD):/api/v1/repository/(?:krd|k2|library|docker_io|quay_io|gcr_io|ghcr_io|registry_k8s_io)/.+/(?:tag/|manifest/.+)$  "";
+}
+
+limit_req_zone  $http_authorization          zone=krdsh_quay_staticauth:10m  rate=30r/s;
+
+limit_req_zone  $krdsh_quay_http1_bucket     zone=krdsh_quay_http1_light:10m     rate=60r/s;
+limit_req_zone  $krdsh_quay_http2_bucket     zone=krdsh_quay_http2_light:10m     rate=600r/s;
+limit_req_zone  $krdsh_quay_http3_bucket     zone=krdsh_quay_http3_light:10m     rate=600r/s;
+limit_req_zone  $krdsh_quay_http1_ns_bucket  zone=krdsh_quay_http1_ns_light:10m  rate=60r/s;
+limit_req_zone  $krdsh_quay_http2_ns_bucket  zone=krdsh_quay_http2_ns_light:10m  rate=600r/s;
+limit_req_zone  $krdsh_quay_http3_ns_bucket  zone=krdsh_quay_http3_ns_light:10m  rate=600r/s;
+
+limit_req_zone  $krdsh_quay_http1_bucket     zone=krdsh_quay_http1_medium:10m     rate=50r/s;
+limit_req_zone  $krdsh_quay_http2_bucket     zone=krdsh_quay_http2_medium:10m     rate=500r/s;
+limit_req_zone  $krdsh_quay_http3_bucket     zone=krdsh_quay_http3_medium:10m     rate=500r/s;
+limit_req_zone  $krdsh_quay_http1_ns_bucket  zone=krdsh_quay_http1_ns_medium:10m  rate=50r/s;
+limit_req_zone  $krdsh_quay_http2_ns_bucket  zone=krdsh_quay_http2_ns_medium:10m  rate=500r/s;
+limit_req_zone  $krdsh_quay_http3_ns_bucket  zone=krdsh_quay_http3_ns_medium:10m  rate=500r/s;
+
+limit_req_zone  $krdsh_quay_http1_bucket     zone=krdsh_quay_http1_heavy:10m     rate=5r/s;
+limit_req_zone  $krdsh_quay_http2_bucket     zone=krdsh_quay_http2_heavy:10m     rate=50r/s;
+limit_req_zone  $krdsh_quay_http3_bucket     zone=krdsh_quay_http3_heavy:10m     rate=50r/s;
+limit_req_zone  $krdsh_quay_http1_ns_bucket  zone=krdsh_quay_http1_ns_heavy:10m  rate=5r/s;
+limit_req_zone  $krdsh_quay_http2_ns_bucket  zone=krdsh_quay_http2_ns_heavy:10m  rate=50r/s;
+limit_req_zone  $krdsh_quay_http3_ns_bucket  zone=krdsh_quay_http3_ns_heavy:10m  rate=50r/s;
+
+server {
+    server_name quay.krd.sh;
+
+    include snip.d/listen-http;
+
+    access_log off;
+    log_not_found off;
+
+    root /var/www/empty;
+
+    include snip.d/https-alt-svc;
+    include snip.d/http-base-security-headers;
+
+    keepalive_timeout 0;
+
+    include snip.d/empty-favicon;
+
+    location /
+    {
+        return 301 https://$host$uri$is_args$args;
+    }
+}
+
+server {
+    server_name quay.krd.sh;
+
+    include snip.d/listen-https;
+    include snip.d/ssl-krd.sh;
+
+    access_log off;
+    log_not_found off;
+
+    root /var/www/empty;
+
+    include snip.d/http-base-security-headers;
+    include snip.d/proxy-common-headers;
+    include snip.d/proxy-accept-encoding;
+    include snip.d/proxy-connection-close;
+    include snip.d/proxy-early-data;
+
+    proxy_set_header  Host  $host;
+    proxy_set_header  Transfer-Encoding  $http_transfer_encoding;
+
+    proxy_redirect  ~*^https?://$host(?:|:[0-9]+)/(.*)$  https://$host/$1;
+
+    error_page 502 /home/user/quay-run-static/static/502.html;
+
+    limit_req_status    429;
+    limit_req_log_level warn;
+
+    js_import njs/quay.js;
+
+    location /static/
+    {
+        root /home/user/quay-run-static;
+
+        expires 1d;
+
+        gzip_static    on;
+        brotli_static  on;
+        zstd_static    on;
+
+        error_page  404  /404;
+    }
+
+    location @old_ui
+    {
+        proxy_pass http://krdsh_quay_web;
+    }
+    location @new_ui
+    {
+        root /home/user/quay-run-static/static/patternfly;
+        index index.html;
+
+        gzip_static    on;
+        brotli_static  on;
+        zstd_static    on;
+
+        rewrite
+          ^/(?:overview|organization|repository|tag)
+          /index.html
+        break;
+    }
+    location /
+    {
+        js_content  quay.route_ui;
+
+        js_var  $krdsh_quay_ui_njs  "$krdsh_quay_ui";
+    }
+
+    location /angular
+    {
+        # Expire cookie and switch to old UI
+        add_header Set-Cookie "patternfly=deleted; path=/; Expires=Thu, Jan 01 1970 00:00:00 UTC";
+        return 302 /$is_args$args;
+    }
+
+    location /react
+    {
+        # Set cookie and witch to new UI
+        add_header Set-Cookie "patternfly=true; path=/; SameSite=Lax; HttpOnly;" always;
+        return 302 /$is_args$args;
+    }
+
+    # Temporarily force signin for old and new UI to route to web app
+    location /signin
+    {
+        proxy_pass http://krdsh_quay_web/;
+    }
+
+    # Capture traffic that needs to go to web_app, see /web.py
+    location ~* ^/(?:config|csrf_token|oauth1|oauth2|webhooks|keys|.well-known|customtrigger|userfiles/)
+    {
+        proxy_pass http://krdsh_quay_web;
+    }
+
+    # Capture old UI paths that aren't present in new UI
+    location ~* ^/(?:user/|search)
+    {
+        proxy_pass http://krdsh_quay_web;
+    }
+
+    location /push
+    {
+        proxy_pass http://krdsh_quay_web;
+
+        client_max_body_size 5M;
+    }
+
+    location /realtime
+    {
+        proxy_pass http://krdsh_quay_web;
+
+        proxy_buffering off;
+        proxy_request_buffering off;
+    }
+
+    location /secscan/
+    {
+        proxy_pass http://krdsh_quay_secscan;
+    }
+
+    # location ~ ^/v2/.+/_trust/tuf/ {
+    #     proxy_pass https://tuf.krd.sh$uri;
+
+    #     include snip.d/proxy-common-headers;
+    #     include snip.d/proxy-accept-encoding;
+    #     include snip.d/proxy-connection-close;
+    #     include snip.d/proxy-early-data;
+
+    #     proxy_set_header  Host  $host;
+    # }
+
+    location ~* ^/api/v1/repository(?:/.+/tag/|/.+/manifest/.+)$
+    {
+        limit_req zone=krdsh_quay_http1_medium burst=50 nodelay;
+        limit_req zone=krdsh_quay_http2_medium burst=100 nodelay;
+        limit_req zone=krdsh_quay_http3_medium burst=100 nodelay;
+
+        proxy_pass http://krdsh_quay_web;
+
+        keepalive_timeout 0;
+
+        proxy_cache krdsh_cache_quay;
+        proxy_cache_key     $uri$is_args$args;
+        proxy_cache_bypass  $http_pragma  $http_authorization  $krdsh_quay_nocache;
+        proxy_no_cache      $http_pragma  $http_authorization  $krdsh_quay_nocache;
+
+        expires 30s;
+        proxy_cache_valid 200 1m;
+        proxy_cache_valid 10s;
+        proxy_ignore_client_abort on;
+
+        proxy_ignore_headers  Cache-Control  Expires  Set-Cookie  Vary;
+        proxy_hide_header     Cache-Control;
+        proxy_hide_header     Expires;
+        proxy_hide_header     Set-Cookie;
+        proxy_hide_header     Vary;
+
+        ## quirks
+        proxy_temp_file_write_size 4m;
+    }
+    location /api/
+    {
+        limit_req zone=krdsh_quay_http1_heavy burst=25 nodelay;
+        limit_req zone=krdsh_quay_http2_heavy burst=100 nodelay;
+        limit_req zone=krdsh_quay_http3_heavy burst=100 nodelay;
+
+        proxy_pass http://krdsh_quay_web;
+
+        keepalive_timeout 0;
+    }
+
+    location /api/suconfig
+    {
+        proxy_pass http://krdsh_quay_web;
+
+        proxy_read_timeout 2000;
+    }
+
+    ## Docker Registry V2
+
+    location = /v2/auth
+    {
+        limit_req zone=krdsh_quay_staticauth burst=10 nodelay;
+
+        proxy_pass http://krdsh_quay_registry;
+
+        keepalive_timeout 0;
+    }
+
+    location ~* ^/v2/_catalog
+    {
+        limit_req zone=krdsh_quay_http1_heavy burst=1 nodelay;
+        limit_req zone=krdsh_quay_http2_heavy burst=5 nodelay;
+        limit_req zone=krdsh_quay_http3_heavy burst=5 nodelay;
+
+        proxy_pass http://krdsh_quay_registry;
+
+        keepalive_timeout 0;
+        proxy_read_timeout 10;
+    }
+
+    location ~* ^/v2/.+/blobs/
+    {
+        limit_req zone=krdsh_quay_http1_ns_medium burst=50 nodelay;
+        limit_req zone=krdsh_quay_http2_ns_medium burst=100 nodelay;
+        limit_req zone=krdsh_quay_http3_ns_medium burst=100 nodelay;
+
+        proxy_pass http://krdsh_quay_registry;
+
+        keepalive_timeout 0;
+
+        proxy_buffering off;
+        proxy_request_buffering off;
+
+        proxy_read_timeout  2000;
+        proxy_send_timeout  2000;
+
+        client_max_body_size 10G;
+        http2_chunk_size 32k;
+
+        include snip.d/disable-comp;
+    }
+
+    location ~* ^/v2/.+/tags/
+    {
+        limit_req zone=krdsh_quay_http1_ns_heavy burst=2 nodelay;
+        limit_req zone=krdsh_quay_http2_ns_heavy burst=2 nodelay;
+        limit_req zone=krdsh_quay_http3_ns_heavy burst=2 nodelay;
+
+        proxy_pass http://krdsh_quay_registry;
+
+        keepalive_timeout 0;
+    }
+
+    location ~* ^/v2/.+/manifests/
+    {
+        limit_req zone=krdsh_quay_http1_ns_medium burst=10 nodelay;
+        limit_req zone=krdsh_quay_http2_ns_medium burst=50 nodelay;
+        limit_req zone=krdsh_quay_http3_ns_medium burst=50 nodelay;
+
+        proxy_pass http://krdsh_quay_registry;
+
+        keepalive_timeout 0;
+    }
+
+    location /v2/
+    {
+        limit_req zone=krdsh_quay_http1_light burst=20 nodelay;
+        limit_req zone=krdsh_quay_http2_light burst=80 nodelay;
+        limit_req zone=krdsh_quay_http3_light burst=80 nodelay;
+
+        proxy_pass http://krdsh_quay_registry;
+
+        keepalive_timeout 0;
+    }
+
+    ## Docker Registry V1
+    ## KrD: seems to be legacy
+
+    location /v1/
+    {
+        return 444;
+    }
+
+    # location /v1/
+    # {
+    #     limit_req zone=krdsh_quay_http1_heavy burst=5 nodelay;
+    #     limit_req zone=krdsh_quay_http2_heavy burst=25 nodelay;
+    #     limit_req zone=krdsh_quay_http3_heavy burst=25 nodelay;
+
+    #     proxy_pass http://krdsh_quay_registry;
+
+    #     proxy_buffering off;
+    #     proxy_request_buffering off;
+
+    #     client_max_body_size 10G;
+
+    #     keepalive_timeout 0;
+    # }
+
+    # location = /v1/_ping
+    # {
+    #     default_type text/plain;
+
+    #     add_header  X-Docker-Registry-Version     0.6.0;
+    #     add_header  X-Docker-Registry-Standalone  0;
+
+    #     return 200 "true";
+    # }
+}

site.d/http-210-ci.krd.sh.conf

@@ -0,0 +1 @@
+../site.avail/http-ci.krd.sh.conf

site.d/http-230-quay.krd.sh.conf

@@ -0,0 +1 @@
+../site.avail/http-quay.krd.sh.conf

snip.d/disable-comp

@@ -0,0 +1,3 @@
+gzip off;
+brotli off;
+zstd off;

snip.d/tls-intermediate

@@ -3,7 +3,7 @@
 include snip.d/tls-common;
 
 ssl_protocols              TLSv1.2 TLSv1.3;
-ssl_session_cache          shared:tls-intermediate:10m;
+ssl_session_cache          shared:tls-intermediate:20m;
 ssl_prefer_server_ciphers  off;
 ssl_ciphers                ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
 

snip.d/tls-modern

@@ -1,6 +1,6 @@
 include snip.d/tls-common;
 
 ssl_protocols              TLSv1.3;
-ssl_session_cache          shared:ssl-modern:10m;
+ssl_session_cache          shared:ssl-modern:20m;
 ssl_prefer_server_ciphers  off;
 ssl_early_data             on;

snip.d/tls-old

@@ -1,7 +1,7 @@
 include snip.d/tls-common;
 
 ssl_protocols              TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
-ssl_session_cache          shared:tls-old:10m;
+ssl_session_cache          shared:tls-old:20m;
 ssl_prefer_server_ciphers  on;
 ssl_ciphers                ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;