nginx.conf

# Loosely based on the following:
# (note these do not work correctly in 2023)
# https://joelkleier.com/blog/2018-04-17-pypi-temporary-cache.html
# https://gist.github.com/dctrwatson/5785638#file-nginx-conf
# It's also very easy to end up not proxying requests; tests/mitmtest.sh should help verify that
# pip installs actually avoid hitting upstream

error_log /dev/stderr;
# Log to file, can be useful for dev
# error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;

worker_processes auto;

events {
    worker_connections 2048;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    sendfile on;
    tcp_nodelay on;
    tcp_nopush off;
    reset_timedout_connection on;
    server_tokens off;
    gzip on;
    gzip_types application/vnd.pypi.simple.v1+json;
    gzip_proxied any;
    gzip_vary on;

    log_format pypi_cache '$remote_addr - $host [$time_local] '
                          'request_time=$request_time upstream_time=$upstream_response_time '
                          'cache_status=$upstream_cache_status \t'
                          '$status "$request" $body_bytes_sent';
    access_log /dev/stdout pypi_cache buffer=64k flush=1s;
    # Log to file, can be useful for dev
    # access_log /var/log/nginx/cache.log pypi_cache buffer=64k flush=1s;

    # Cache 50G worth of packages for up to 1 month
    proxy_cache_path /var/lib/nginx/pypi levels=1:2 keys_zone=pypi:16m inactive=1M max_size=50G;

    # Having the same upstream server listed twice allegedly forces nginx to retry
    # connections and not fail the request immediately.
    upstream sg_pypi {
        server pypi.org:443;
        server pypi.org:443;
        keepalive 16;
    }
    upstream sg_pythonhosted {
        server files.pythonhosted.org:443;
        server files.pythonhosted.org:443;
        keepalive 16;
    }

    server {
        listen 80 default_server;

        proxy_cache pypi;
        proxy_cache_key $uri/$http_accept_encoding;
        proxy_cache_lock on;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;

        proxy_http_version 1.1;
        proxy_ssl_server_name on;

        # sub_filter can't apply to gzipped content, so be careful about that
        add_header X-Pypi-Cache $upstream_cache_status;
        sub_filter 'https://pypi.org' $scheme://$host;
        sub_filter 'https://files.pythonhosted.org/packages' $scheme://$host/packages;
        sub_filter_once off;
        sub_filter_types application/vnd.pypi.simple.v1+json application/vnd.pypi.simple.v1+html;

        location / {
            proxy_set_header Connection "";
            proxy_set_header Accept-Encoding "";
            proxy_cache_valid any 5m;
            proxy_cache_valid 404 1m;

            proxy_set_header Host pypi.org;
            proxy_ssl_name pypi.org;
            proxy_pass https://sg_pypi;
            proxy_redirect 'https://pypi.org' $scheme://$host;
        }

        location ^~ /simple {
            proxy_set_header Connection "";
            proxy_set_header Accept-Encoding "";
            proxy_cache_valid any 5m;
            proxy_cache_valid 404 1m;

            proxy_set_header Host pypi.org;
            proxy_ssl_name pypi.org;
            proxy_pass https://sg_pypi;
            proxy_redirect 'https://pypi.org' $scheme://$host;
        }

        location ^~ /packages {
            proxy_set_header Connection "";
            proxy_set_header Accept-Encoding "";
            proxy_cache_valid any 1M;
            proxy_cache_valid 404 1m;

            proxy_set_header Host files.pythonhosted.org;
            proxy_ssl_name files.pythonhosted.org;
            proxy_pass 'https://sg_pythonhosted/packages';
            proxy_redirect 'https://files.pythonhosted.org/packages' $scheme://$host/packages;
        }
    }
}