certificate-transparency/cheese
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Compare commits

base: certificate-transparency:105a2452398a532f63d490d406e0ec61c8a8e4aa
Branches Tags
certificate-transparency:main certificate-transparency:checkconf certificate-transparency:custom-domain
...
compare: certificate-transparency:main
Branches Tags
certificate-transparency:main certificate-transparency:checkconf certificate-transparency:custom-domain

3 Commits
105a245239 ... main

Author SHA1 Message Date
Pim van Pelt
1e7a41660f Add more lenient pushback flags after an issue with Halloumi2025h2 sending 429s on Google's AddChain/AddPreChain requests 2025-09-10 12:35:49 +02:00
Pim van Pelt
b646bca642 Only send caching headers for existing objects (response code equals 200, 201, 204, 206, 301, 302, 303, 304, 307 or 308) 2025-09-05 12:05:07 +02:00
Pim van Pelt
425b485f5f Remove generated roots 2025-08-28 21:19:14 +02:00
4 changed files with 20 additions and 6396 deletions
Expand all files Collapse all files

2
.gitignore vendored
View File

@@ -1,2 +1,2 @@
tesseract-genconf
roots.pem
*roots.pem

6380
production-roots.pem
View File

File diff suppressed because it is too large Load Diff

4
tesseract/genconf/env.go
View File

@@ -35,6 +35,10 @@ func generateEnv(yamlFile string, wantDiff bool, allowWrite bool, useColor bool)
fmt.Sprintf("--origin=%s", logEntry.Origin),
fmt.Sprintf("--storage_dir=%s", logEntry.LocalDirectory),
fmt.Sprintf("--roots_pem_file=%s", rootsPemPath),
"--batch_max_size=512",
"--batch_max_age=500ms",
"--pushback_max_outstanding=4096",
"--pushback_max_dedupe_in_flight=250",
}
// Add http_endpoint if Listen is specified

30
tesseract/genconf/nginx.go
View File

@@ -23,48 +23,48 @@ const nginxTemplate = `server {
location = / {
try_files /index.html =404;
add_header Content-Type "text/html; charset=utf-8" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Content-Type "text/html; charset=utf-8";
add_header Access-Control-Allow-Origin "*";
}
# Checkpoint endpoint - no caching
location = /checkpoint {
try_files /checkpoint =404;
add_header Content-Type "text/plain; charset=utf-8" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Cache-Control "no-store" always;
add_header Content-Type "text/plain; charset=utf-8";
add_header Access-Control-Allow-Origin "*";
add_header Cache-Control "no-store";
}
# Log info endpoint
location = /log.v3.json {
try_files /log.v3.json =404;
add_header Content-Type "application/json" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Cache-Control "public, max-age=3600, immutable" always;
add_header Content-Type "application/json";
add_header Access-Control-Allow-Origin "*";
add_header Cache-Control "public, max-age=3600, immutable";
}
# Issuer certificate endpoint - long cache
location ~ ^/issuer/(.+)$ {
try_files /issuer/$1 =404;
add_header Content-Type "application/pkix-cert" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Cache-Control "public, max-age=604800, immutable" always;
add_header Content-Type "application/pkix-cert";
add_header Access-Control-Allow-Origin "*";
add_header Cache-Control "public, max-age=604800, immutable";
}
# Tile data endpoint - long cache, may have gzip
location ~ ^/tile/(.+)$ {
try_files /tile/$1 =404;
add_header Content-Type "application/octet-stream" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Cache-Control "public, max-age=604800, immutable" always;
add_header Content-Type "application/octet-stream";
add_header Access-Control-Allow-Origin "*";
add_header Cache-Control "public, max-age=604800, immutable";
# Gzip encoding for .gz files
location ~ \.gz$ {
add_header Content-Encoding "gzip" always;
add_header Content-Encoding "gzip";
}
}
}