Misc updates

deployment/conf/pkgserver.nginx.conf

@@ -71,3 +71,16 @@ ${MIRROR_BLOCK}
     access_log /logs/access_${FQDN}.log pkgserver_logformat buffer=4k flush=1m;
     error_log  /logs/error_${FQDN}.log;
 }
+
+# Expose basic status information on /stub_status to be consumed by nginx-prometheus-exporter
+# https://nginx.org/en/docs/http/ngx_http_stub_status_module.html#stub_status
+server {
+    listen 8080;
+    listen [::]:8080;
+    location = /stub_status {
+        stub_status;
+    }
+    location / {
+        return 444;
+    }
+}

deployment/conf/stanza_tls.conf

@@ -1,7 +1,8 @@
     listen              8000;
     listen              [::]:8000;
-    listen              443 ssl http2;
-    listen              [::]:443 ssl http2;
+    listen              443 ssl;
+    listen              [::]:443 ssl;
+    http2               on;
     server_name         ${SERVERNAMES};
     ssl_certificate     /etc/letsencrypt/live/${FQDN}/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/${FQDN}/privkey.pem;

deployment/docker-compose.yml

@@ -1,5 +1,4 @@
 # This is the production docker-compose setup, complete with nginx TLS terminator
-version: '3.4'
 services:
     pkgserver:
         image: juliapackaging/pkgserver.jl
@@ -32,14 +31,15 @@ services:
             start_period: 5m
 
     frontend:
-        image: jonasal/nginx-certbot:3.3.1
+        image: jonasal/nginx-certbot:5.0.1
         restart: unless-stopped
         environment:
             CERTBOT_EMAIL: "${CERTBOT_EMAIL:[email protected]}"
         ports:
             - 80:80/tcp
             - 443:443/tcp
             - 8000:8000/tcp
+            - 8080:8080/tcp # nginx /stub_status
         depends_on:
             - pkgserver
         volumes:

loadbalancer/conf/loadbalancer.nginx.conf

@@ -20,20 +20,20 @@ ${PKGSERVERS_SERVER_BLOCK}
 }
 
 server {
-    listen              443 ssl http2;
-    listen              [::]:443 ssl http2;
+    listen              443 ssl;
+    listen              [::]:443 ssl;
+    http2               on;
     server_name         ${REGION}.pkg.julialang.org loadbalancer-${REGION}.ip.cflo.at loadbalancer-${REGION}.ipv4.cflo.at loadbalancer-${REGION}.ipv6.cflo.at;
     ssl_certificate     /etc/letsencrypt/live/${FQDN}/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/${FQDN}/privkey.pem;
-    
+
     # We pass all content-addressed URLs off to consistent PkgServer locations,
     # so that each package server only needs to keep track of a portion of these resources
     location ~ /(registry|package|artifact|mirror)/ {
         proxy_next_upstream error timeout http_502;
         set $upstream pkgservers_hashed;
         try_files $uri @loadbalance;
     }
-
     # Everything else (`/registries`, `/meta`, etc...) gets round-robined
     location / {
         proxy_next_upstream error timeout;
@@ -65,3 +65,16 @@ server {
     access_log /logs/access_${FQDN}.log pkgserver_logformat buffer=4k flush=1m;
     error_log  /logs/error_${FQDN}.log;
 }
+
+# Expose basic status information on /stub_status to be consumed by nginx-prometheus-exporter
+# https://nginx.org/en/docs/http/ngx_http_stub_status_module.html#stub_status
+server {
+    listen 8080;
+    listen [::]:8080;
+    location = /stub_status {
+        stub_status;
+    }
+    location / {
+        return 444;
+    }
+}

loadbalancer/docker-compose.yml

@@ -1,8 +1,7 @@
 # This is the production docker-compose setup, complete with nginx TLS terminator
-version: '2.3'
 services:
     loadbalancer:
-        image: jonasal/nginx-certbot:3.3.1
+        image: jonasal/nginx-certbot:5.0.1
         restart: unless-stopped
         environment:
             CERTBOT_EMAIL: "${CERTBOT_EMAIL:[email protected]}"