mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 07:43:29 +03:00
Feng Ruohang
6613c2a3cb
The test and verification scripts invoked ./minio and pulled their tooling from upstream infrastructure with no integrity check. Every `curl | tar` of a client or an old server binary was an unverified execution path in a script that regularly runs as a privileged user, and several fetched a floating "latest". Two installers replace all of it: - install-mcli.sh resolves a pinned pgsty/mc release, downloads the archive and its checksum manifest, requires exactly one valid manifest entry for the asset, verifies it, and installs. MCLI_BIN with a mandatory MCLI_SHA256 lets an offline or air-gapped run supply its own binary, still checksum-checked. - install-verified-fixture.sh takes source, expected SHA-256 and target, and refuses anything that does not match. Sources may be a URL or a local file. Every script that previously downloaded mc now calls install-mcli.sh. The three places that genuinely need an upstream artifact - the old MinIO server binary for the LDAP IAM upgrade-import test, the 2021 mc for the three-site replication test, and the functional-tests.sh fixture - go through install-verified-fixture.sh with the digest recorded inline. Those dl.min.io URLs remain on purpose: they are historical upstream artifacts needed to prove upgrade compatibility, and they are now pinned and verified rather than trusted. The scripts otherwise switch to ./silo, silo.service, the silo container and compose service names, and SILO_CONFIG_DIR. run-multi-site-minio-idp.sh is renamed to run-multi-site-silo-idp.sh with the Makefile target following. buildscripts/minio-upgrade.sh keeps its name and its `minio server` argv - it exists to test the MinIO-to-Silo upgrade, so the old side must stay old - but it is now pinned to an image digest rather than a tag, and its `docker system prune` and `docker volume prune` calls are removed. Those ran unfiltered against the developer's whole Docker installation; the resiliency tests had the same problem and lose their prune and `docker ps -q` sweeps too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
107 lines
3.0 KiB
Nginx Configuration File
107 lines
3.0 KiB
Nginx Configuration File
user nginx;
|
|
worker_processes auto;
|
|
|
|
error_log /var/log/nginx/error.log warn;
|
|
pid /var/run/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 4096;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
|
|
|
access_log /var/log/nginx/access.log main;
|
|
sendfile on;
|
|
keepalive_timeout 65;
|
|
|
|
# include /etc/nginx/conf.d/*.conf;
|
|
|
|
upstream silo {
|
|
server silo1:9000;
|
|
server silo2:9000;
|
|
server silo3:9000;
|
|
server silo4:9000;
|
|
}
|
|
|
|
upstream console {
|
|
ip_hash;
|
|
server silo1:9001;
|
|
server silo2:9001;
|
|
server silo3:9001;
|
|
server silo4:9001;
|
|
}
|
|
|
|
server {
|
|
listen 9000;
|
|
listen [::]:9000;
|
|
server_name localhost;
|
|
|
|
# To allow special characters in headers
|
|
ignore_invalid_headers off;
|
|
# Allow any size file to be uploaded.
|
|
# Set to a value such as 1000m; to restrict file size to a specific value
|
|
client_max_body_size 0;
|
|
# To disable buffering
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
|
|
location / {
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_connect_timeout 300;
|
|
# Default is HTTP/1, keepalive is only enabled in HTTP/1.1
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
chunked_transfer_encoding off;
|
|
|
|
proxy_pass http://silo;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 9001;
|
|
listen [::]:9001;
|
|
server_name localhost;
|
|
|
|
# To allow special characters in headers
|
|
ignore_invalid_headers off;
|
|
# Allow any size file to be uploaded.
|
|
# Set to a value such as 1000m; to restrict file size to a specific value
|
|
client_max_body_size 0;
|
|
# To disable buffering
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
|
|
location / {
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-NginX-Proxy true;
|
|
|
|
# This is necessary to pass the correct IP to be hashed
|
|
real_ip_header X-Real-IP;
|
|
|
|
proxy_connect_timeout 300;
|
|
|
|
# To support websocket
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
chunked_transfer_encoding off;
|
|
|
|
proxy_pass http://console;
|
|
}
|
|
}
|
|
}
|