Reloaded-II icon indicating copy to clipboard operation
Reloaded-II copied to clipboard

[Help Wanted!!] Backup NuGet Mirror and/or New Site

Open Sewer56 opened this issue 3 years ago • 0 comments

Background Currently Reloaded II stores common code mod dependencies (shared libraries etc.) on a BaGet server located at http://packages.sewer56.moe:5000/upload , to which any user can upload to.

This is problematic as this is a singular/only source for a lot of my own mods (latest versions) and packages used as dependencies by other 3rd party mods. If the server goes down, we're gonna have a bad time.

screencapture-167-71-128-50-5000-home-2020-08-19-22_32_04

Security Concerns While weekly backups of the server content are taken, there are no moderation tools available on this NuGet mirror; not even I can delete stuff without manually editing the on server files and database. There is unfortunately nothing stopping anyone from just flooding the server with dummy packages at the current moment in time and filling up all of the server's storage to effectively take it down.

Describe the Solution This really requires a two step solution:

The first is to make improvements to the BaGet Server:

  1. Implement moderation tools into the BaGet server, to allow packages to be removed by superusers.
  2. Allow superusers to restrict downloads.
  3. Add rate limits to prevent spamming of packages onto the server.

The second is to make a mirror for the server and have Reloaded pull from there when the primary server is down:

The Reloaded NuGet server should use a backup server for dependency fetching such as nuget.org, when the default server is not available. This server should however NOT be used in the Download Mods menu.

Sewer56 avatar Aug 19 '20 21:08 Sewer56