Re: /repos/ mirror

On Wed, 15 Jul 2026 at 21:57, Garrett Wollman <wollman(at)csail(dot)mit(dot)edu> wrote:

> <<On Wed, 15 Jul 2026 15:36:53 -0400, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> said:
>
> > Garrett Wollman <wollman(at)csail(dot)mit(dot)edu> writes:
> >> Over the past few months, our mirror server has been the subject of an
> >> apparent DDoS. Today I tracked it down to millions of attempted
> >> downloads from `http://postgres.csail.mit.edu/repos/`
> <http://postgres.csail.mit.edu/repos/> and I have
> >> configured the server to return a 403 error for that part of the site;
> >> we are happy to provide a mirror service for humans to use but we did
> >> not sign up for 720,000 (and counting) random Linux machines around
> >> the world to abuse our server and interfere with our own local access
> >> to the archives.
>
> > That is very strange. What did you have stored there --- was it a
> > mirror of our source code, or executables, or ???
>
> It is -- or I guess was, I had not realized that the rsync was
> commented out -- a mirror of rsync.postgresql.org::pgsql-ftp. Now
> that I've learned that the mirror hasn't been updated in at least a
> year, I'm going to completely unconfigure it.
>

That has indeed been discontinued. If you want to mirror the different
repos (apt/yum) for internal use you can use the tools from those
toolchains to mirror over https. There isn't really any point in keeping a
public mirror today, given CDNs.

We're up to 930,000 unique IPs banging on this so far today.
>

Not bad. As comparison, the main postgres repos get about 1.3-1.6 million
unique IPs per day, so you're catching up fast. It certainly sounds like
your hostname got listed as an official mirror in some package somewhere,
maybe a docker build or something?

Can you see the user-agent being used on the requests? That might give you
a hint..

//Magnus