45 lines
1.6 KiB
Plaintext
45 lines
1.6 KiB
Plaintext
# The only route out of the dev-server worker.
|
|
#
|
|
# It allows CONNECT tunnels to the package registries and refuses everything else. There is no
|
|
# interception and no certificate of ours in the middle: the proxy sees the host a client asks for
|
|
# and nothing more. That is the whole boundary, and it is worth being clear about what it is not -
|
|
# a package pulled from an allowed registry is still third-party code, which is why installs run
|
|
# with scripts disabled.
|
|
#
|
|
# Add a host here only when an install has failed for the want of it, and add the exact host.
|
|
|
|
http_port 3128
|
|
|
|
acl registries dstdomain \
|
|
registry.npmjs.org \
|
|
.npmjs.org \
|
|
pypi.org \
|
|
files.pythonhosted.org \
|
|
repo.maven.apache.org \
|
|
repo1.maven.org
|
|
|
|
acl ssl_ports port 443
|
|
acl connect_method method CONNECT
|
|
|
|
# CONNECT to an allowed registry on 443, and that is all. Plain HTTP is not allowed even to these
|
|
# hosts: every one of them serves HTTPS, so a plain request would be a downgrade, not a fallback.
|
|
http_access allow connect_method registries ssl_ports
|
|
http_access deny all
|
|
|
|
# Nothing is cached: with no cache there is no cache to poison, and the measured benefit of
|
|
# caching was npm's alone - where the worker's own shared npm cache already provides it.
|
|
cache deny all
|
|
cache_mem 8 MB
|
|
|
|
# One line per request, so a refused host can be found without guessing.
|
|
access_log stdio:/dev/stdout
|
|
cache_log stdio:/dev/stderr
|
|
|
|
# A client that cannot reach the internet should learn so quickly rather than hang.
|
|
connect_timeout 15 seconds
|
|
request_timeout 60 seconds
|
|
|
|
forwarded_for delete
|
|
via off
|
|
httpd_suppress_version_string on
|