5 # Copyright:: 2011, OpenStreetMap Foundation
7 # Licensed under the Apache License, Version 2.0 (the "License");
8 # you may not use this file except in compliance with the License.
9 # You may obtain a copy of the License at
11 # https://www.apache.org/licenses/LICENSE-2.0
13 # Unless required by applicable law or agreed to in writing, software
14 # distributed under the License is distributed on an "AS IS" BASIS,
15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 # See the License for the specific language governing permissions and
17 # limitations under the License.
20 include_recipe "apache"
23 include_recipe "geoipupdate"
24 include_recipe "nodejs"
25 include_recipe "passenger"
27 include_recipe "tools"
28 include_recipe "web::base"
30 web_passwords = data_bag_item("web", "passwords")
31 db_passwords = data_bag_item("db", "passwords")
33 ssl_certificate "www.openstreetmap.org" do
34 domains ["www.openstreetmap.org", "www.osm.org", "www.openstreetmap.com",
35 "api.openstreetmap.org", "api.osm.org",
36 "maps.openstreetmap.org", "maps.osm.org",
37 "mapz.openstreetmap.org", "mapz.osm.org",
38 "openstreetmap.org", "osm.org", "openstreetmap.com"]
39 notifies :reload, "service[apache2]"
44 rails_directory = "#{node[:web][:base_directory]}/rails"
46 matomo = data_bag_item("web", "matomo")
51 "access_key_id" => "AKIASQUXHPE7AMJQRFOS",
52 "secret_access_key" => web_passwords["aws_key"],
53 "region" => "eu-west-1",
54 "bucket" => "openstreetmap-user-avatars",
56 "use_dualstack_endpoint" => true,
58 "acl" => "public-read",
59 "cache_control" => "public, max-age=31536000, immutable"
64 "access_key_id" => "AKIASQUXHPE7AMJQRFOS",
65 "secret_access_key" => web_passwords["aws_key"],
66 "region" => "eu-west-1",
67 "bucket" => "openstreetmap-gps-traces",
68 "use_dualstack_endpoint" => true,
71 "acl" => "public-read",
72 "cache_control" => "public, max-age=31536000, immutable"
77 "access_key_id" => "AKIASQUXHPE7AMJQRFOS",
78 "secret_access_key" => web_passwords["aws_key"],
79 "region" => "eu-west-1",
80 "bucket" => "openstreetmap-gps-images",
81 "use_dualstack_endpoint" => true,
84 "acl" => "public-read",
85 "cache_control" => "public, max-age=31536000, immutable"
90 db_host = if node[:web][:status] == "database_readonly"
91 node[:web][:readonly_database_host]
93 node[:web][:database_host]
96 rails_port "www.openstreetmap.org" do
97 directory rails_directory
100 repository "https://git.openstreetmap.org/public/rails.git"
102 database_host db_host
103 database_name "openstreetmap"
104 database_username "rails"
105 database_password db_passwords["rails"]
106 email_from "OpenStreetMap <web@noreply.openstreetmap.org>"
107 status node[:web][:status]
108 messages_domain "messages.openstreetmap.org"
109 log_path "#{node[:web][:log_directory]}/rails.log"
110 logstash_path "#{node[:web][:log_directory]}/rails-logstash.log"
111 memcache_servers node[:web][:memcached_servers]
112 potlatch2_key web_passwords["potlatch2_key"]
113 id_key web_passwords["id_key"]
114 id_application web_passwords["id_application"]
115 oauth_key web_passwords["oauth_key"]
116 oauth_application web_passwords["oauth_application"]
117 matomo_configuration "location" => matomo[:location],
118 "site" => matomo[:site],
119 "visitor_cookie_timeout" => matomo[:visitor_cookie_timeout],
120 "referral_cookie_timeout" => matomo[:referral_cookie_timeout],
121 "session_cookie_timeout" => matomo[:session_cookie_timeout],
122 "goals" => matomo[:goals].to_hash
123 google_auth_id "651529786092-6c5ahcu0tpp95emiec8uibg11asmk34t.apps.googleusercontent.com"
124 google_auth_secret web_passwords["google_auth_secret"]
125 google_openid_realm "https://www.openstreetmap.org"
126 facebook_auth_id "427915424036881"
127 facebook_auth_secret web_passwords["facebook_auth_secret"]
128 microsoft_auth_id "e34f14f1-f790-40f3-9fa4-3c5f1a027c38"
129 microsoft_auth_secret web_passwords["microsoft_auth_secret"]
130 github_auth_id "acf7da34edee99e35499"
131 github_auth_secret web_passwords["github_auth_secret"]
132 wikipedia_auth_id "e4fe0c2c5855d23ed7e1f1c0fa1f1c58"
133 wikipedia_auth_secret web_passwords["wikipedia_auth_secret"]
134 thunderforest_key web_passwords["thunderforest_key"]
135 tracestrack_key web_passwords["tracestrack_key"]
136 totp_key web_passwords["totp_key"]
138 trace_use_job_queue true
140 storage_configuration storage
141 avatar_storage "avatars"
142 trace_file_storage "gps_traces"
143 trace_image_storage "gps_images"
144 trace_icon_storage "gps_images"
145 avatar_storage_url "https://openstreetmap-user-avatars.s3.dualstack.eu-west-1.amazonaws.com"
146 trace_image_storage_url "https://openstreetmap-gps-images.s3.dualstack.eu-west-1.amazonaws.com"
147 overpass_url "https://query.openstreetmap.org/query-features"
148 overpass_credentials true
150 signup_ip_max_burst 48
151 signup_email_per_day 1
152 signup_email_max_burst 2
153 doorkeeper_signing_key web_passwords["openid_connect_key"].join("\n")
154 user_account_deletion_delay 7 * 24
155 # Requests to modify the imagery blacklist should come from the DWG only
157 # Current Google imagery URLs have google or googleapis in the domain
158 ".*\\.google(apis)?\\..*/.*",
160 "http://xdworld\\.vworld\\.kr:8080/.*",
162 ".*\\.here\\.com[/:].*",
166 ".*\\.api-maps\\.yandex\\.ru/.*",
167 ".*\\.maps\\.yandex\\.net/.*",
169 ".*\\.maps\\.2gis\\.com/.*"
173 systemd_service "rails-jobs@" do
174 description "Rails job queue runner"
176 environment "RAILS_ENV" => "production",
178 "SLEEP_DELAY" => "60",
179 "SECRET_KEY_BASE" => web_passwords["secret_key_base"]
181 working_directory rails_directory
182 exec_start "#{node[:ruby][:bundle]} exec rails jobs:work"
185 sandbox :enable_network => true
186 memory_deny_write_execute false
187 read_write_paths "/var/log/web"
190 package "libjson-xs-perl"
192 template "/usr/local/bin/cleanup-rails-assets" do
193 source "cleanup-assets.erb"
199 gem_package "apachelogregex" do
200 gem_binary node[:ruby][:gem]
203 gem_package "file-tail" do
204 gem_binary node[:ruby][:gem]
207 template "/usr/local/bin/api-statistics" do
208 source "api-statistics.erb"
214 systemd_service "api-statistics" do
215 description "OpenStreetMap API Statistics Daemon"
218 exec_start "/usr/local/bin/api-statistics"
222 "/srv/www.openstreetmap.org/rails/tmp",
223 "/var/lib/prometheus/node-exporter"
228 service "api-statistics" do
229 action [:enable, :start]
230 supports :restart => true
231 subscribes :restart, "template[/usr/local/bin/api-statistics]"
232 subscribes :restart, "systemd_service[api-statistics]"
235 gem_package "hpricot" do
236 gem_binary node[:ruby][:gem]