FreeBSD package cache

http {
        sendfile        on;

        # Define the cache locations and format. Expire after 90d.
        proxy_cache_path /var/cache/packages levels=1:2 keys_zone=pkgcache:100m
                max_size=50g inactive=90d use_temp_path=off;

        server {
                listen *:80;
                server_name           pkg-cache pkg-cache.lan.yelnah.org;
                access_log            /var/log/nginx/pkg-cache.access.log;
                error_log             /var/log/nginx/pkg-cache.error.log;

                # Disable ipv6 since not all clients hosts are using it.
                resolver 10.0.1.1 valid=300s ipv6=off;

                proxy_set_header Host pkg.freebsd.org;
                proxy_ssl_server_name on;
                proxy_ssl_name pkg.freebsd.org;

                proxy_cache pkgcache;
                proxy_cache_key "pkg.freebsd.org$request_uri";
                proxy_cache_lock on;
                proxy_cache_lock_timeout 60s;
                proxy_cache_lock_age 120s;
                proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
                proxy_cache_revalidate on;
                # Ignore pkg.FreeBSD.org cache headers
                proxy_ignore_headers Cache-Control Expires Set-Cookie;
                add_header X-Cache-Status $upstream_cache_status always;

                # Long cache on immutable pkg files
                location ~* /All/.+\.pkg$ {
                        proxy_cache_valid 200 365d;
                        proxy_pass https://pkg.freebsd.org$request_uri;
                }
                # Short cache on metadata
                location ~* /(meta\.(conf|txz|tzst)|packagesite\.(pkg|txz|tzst)|data\.(pkg|txz|tzst))$ {
                        proxy_cache_valid 200 1m;
                        proxy_pass https://pkg.freebsd.org$request_uri;
                }
                # Cache audit vulnerability database: VULNXML_SITE=http://<cache-host>/vuxml/vuln.xml.xz
                location ^~ /vuxml/ {
                        proxy_cache_valid 200 1h;
                        proxy_set_header Host vuxml.freebsd.org;
                        proxy_ssl_name vuxml.freebsd.org;
                        rewrite ^/vuxml/(.*)$ /freebsd/$1 break;
                        proxy_pass https://vuxml.freebsd.org$uri$is_args$args;
                }
                location / {
                        proxy_cache_valid 200 10m;
                        proxy_pass https://pkg.freebsd.org$request_uri;
                }
        }
}