]> git.openstreetmap.org Git - chef.git/blob - cookbooks/web/recipes/rails.rb
imagery: fix quote linting
[chef.git] / cookbooks / web / recipes / rails.rb
1 #
2 # Cookbook:: web
3 # Recipe:: rails
4 #
5 # Copyright:: 2011, OpenStreetMap Foundation
6 #
7 # Licensed under the Apache License, Version 2.0 (the "License");
8 # you may not use this file except in compliance with the License.
9 # You may obtain a copy of the License at
10 #
11 #     https://www.apache.org/licenses/LICENSE-2.0
12 #
13 # Unless required by applicable law or agreed to in writing, software
14 # distributed under the License is distributed on an "AS IS" BASIS,
15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 # See the License for the specific language governing permissions and
17 # limitations under the License.
18 #
19
20 include_recipe "apache"
21 include_recipe "apt"
22 include_recipe "git"
23 include_recipe "geoipupdate"
24 include_recipe "nodejs"
25 include_recipe "passenger"
26 include_recipe "ruby"
27 include_recipe "tools"
28 include_recipe "web::base"
29
30 web_passwords = data_bag_item("web", "passwords")
31 db_passwords = data_bag_item("db", "passwords")
32
33 ssl_certificate "www.openstreetmap.org" do
34   domains ["www.openstreetmap.org", "www.osm.org", "www.openstreetmap.com",
35            "api.openstreetmap.org", "api.osm.org",
36            "maps.openstreetmap.org", "maps.osm.org",
37            "mapz.openstreetmap.org", "mapz.osm.org",
38            "openstreetmap.org", "osm.org", "openstreetmap.com"]
39   notifies :reload, "service[apache2]"
40 end
41
42 nodejs_package "svgo"
43
44 rails_directory = "#{node[:web][:base_directory]}/rails"
45
46 matomo = data_bag_item("web", "matomo")
47
48 storage = {
49   "avatars" => {
50     "service" => "S3",
51     "access_key_id" => "AKIASQUXHPE7AMJQRFOS",
52     "secret_access_key" => web_passwords["aws_key"],
53     "region" => "eu-west-1",
54     "bucket" => "openstreetmap-user-avatars",
55     "public" => true,
56     "use_dualstack_endpoint" => true,
57     "upload" => {
58       "acl" => "public-read",
59       "cache_control" => "public, max-age=31536000, immutable"
60     }
61   },
62   "gps_traces" => {
63     "service" => "S3",
64     "access_key_id" => "AKIASQUXHPE7AMJQRFOS",
65     "secret_access_key" => web_passwords["aws_key"],
66     "region" => "eu-west-1",
67     "bucket" => "openstreetmap-gps-traces",
68     "use_dualstack_endpoint" => true,
69     "public" => true,
70     "upload" => {
71       "acl" => "public-read",
72       "cache_control" => "public, max-age=31536000, immutable"
73     }
74   },
75   "gps_images" => {
76     "service" => "S3",
77     "access_key_id" => "AKIASQUXHPE7AMJQRFOS",
78     "secret_access_key" => web_passwords["aws_key"],
79     "region" => "eu-west-1",
80     "bucket" => "openstreetmap-gps-images",
81     "use_dualstack_endpoint" => true,
82     "public" => true,
83     "upload" => {
84       "acl" => "public-read",
85       "cache_control" => "public, max-age=31536000, immutable"
86     }
87   }
88 }
89
90 db_host = if node[:web][:status] == "database_readonly"
91             node[:web][:readonly_database_host]
92           else
93             node[:web][:database_host]
94           end
95
96 rails_port "www.openstreetmap.org" do
97   directory rails_directory
98   user "rails"
99   group "rails"
100   repository "https://git.openstreetmap.org/public/rails.git"
101   revision "live"
102   database_host db_host
103   database_name "openstreetmap"
104   database_username "rails"
105   database_password db_passwords["rails"]
106   email_from "OpenStreetMap <web@noreply.openstreetmap.org>"
107   status node[:web][:status]
108   messages_domain "messages.openstreetmap.org"
109   log_path "#{node[:web][:log_directory]}/rails.log"
110   logstash_path "#{node[:web][:log_directory]}/rails-logstash.log"
111   memcache_servers node[:web][:memcached_servers]
112   potlatch2_key web_passwords["potlatch2_key"]
113   id_key web_passwords["id_key"]
114   id_application web_passwords["id_application"]
115   oauth_key web_passwords["oauth_key"]
116   oauth_application web_passwords["oauth_application"]
117   matomo_configuration "location" => matomo[:location],
118                        "site" => matomo[:site],
119                        "visitor_cookie_timeout" => matomo[:visitor_cookie_timeout],
120                        "referral_cookie_timeout" => matomo[:referral_cookie_timeout],
121                        "session_cookie_timeout" => matomo[:session_cookie_timeout],
122                        "goals" => matomo[:goals].to_hash
123   google_auth_id "651529786092-6c5ahcu0tpp95emiec8uibg11asmk34t.apps.googleusercontent.com"
124   google_auth_secret web_passwords["google_auth_secret"]
125   google_openid_realm "https://www.openstreetmap.org"
126   facebook_auth_id "427915424036881"
127   facebook_auth_secret web_passwords["facebook_auth_secret"]
128   microsoft_auth_id "e34f14f1-f790-40f3-9fa4-3c5f1a027c38"
129   microsoft_auth_secret web_passwords["microsoft_auth_secret"]
130   github_auth_id "acf7da34edee99e35499"
131   github_auth_secret web_passwords["github_auth_secret"]
132   wikipedia_auth_id "e4fe0c2c5855d23ed7e1f1c0fa1f1c58"
133   wikipedia_auth_secret web_passwords["wikipedia_auth_secret"]
134   thunderforest_key web_passwords["thunderforest_key"]
135   tracestrack_key web_passwords["tracestrack_key"]
136   totp_key web_passwords["totp_key"]
137   csp_enforce true
138   trace_use_job_queue true
139   diary_feed_delay 12
140   storage_configuration storage
141   avatar_storage "avatars"
142   trace_file_storage "gps_traces"
143   trace_image_storage "gps_images"
144   trace_icon_storage "gps_images"
145   avatar_storage_url "https://openstreetmap-user-avatars.s3.dualstack.eu-west-1.amazonaws.com"
146   trace_image_storage_url "https://openstreetmap-gps-images.s3.dualstack.eu-west-1.amazonaws.com"
147   overpass_url "https://query.openstreetmap.org/query-features"
148   overpass_credentials true
149   signup_ip_per_day 24
150   signup_ip_max_burst 48
151   signup_email_per_day 1
152   signup_email_max_burst 2
153   doorkeeper_signing_key web_passwords["openid_connect_key"].join("\n")
154   user_account_deletion_delay 7 * 24
155   # Requests to modify the imagery blacklist should come from the DWG only
156   imagery_blacklist [
157     # Current Google imagery URLs have google or googleapis in the domain
158     ".*\\.google(apis)?\\..*/.*",
159     # Blacklist VWorld
160     "http://xdworld\\.vworld\\.kr:8080/.*",
161     # Blacklist here
162     ".*\\.here\\.com[/:].*",
163     # Blacklist Mapy.cz
164     ".*\\.mapy\\.cz.*",
165     # Blacklist Yandex
166     ".*\\.api-maps\\.yandex\\.ru/.*",
167     ".*\\.maps\\.yandex\\.net/.*",
168     # Blacklist 2gis
169     ".*\\.maps\\.2gis\\.com/.*"
170   ]
171 end
172
173 systemd_service "rails-jobs@" do
174   description "Rails job queue runner"
175   type "simple"
176   environment "RAILS_ENV" => "production",
177               "QUEUE" => "%I",
178               "SLEEP_DELAY" => "60",
179               "SECRET_KEY_BASE" => web_passwords["secret_key_base"]
180   user "rails"
181   working_directory rails_directory
182   exec_start "#{node[:ruby][:bundle]} exec rails jobs:work"
183   restart "on-failure"
184   nice 10
185   sandbox :enable_network => true
186   memory_deny_write_execute false
187   read_write_paths "/var/log/web"
188 end
189
190 package "libjson-xs-perl"
191
192 template "/usr/local/bin/cleanup-rails-assets" do
193   source "cleanup-assets.erb"
194   owner "root"
195   group "root"
196   mode "755"
197 end
198
199 gem_package "apachelogregex" do
200   gem_binary node[:ruby][:gem]
201 end
202
203 gem_package "file-tail" do
204   gem_binary node[:ruby][:gem]
205 end
206
207 template "/usr/local/bin/api-statistics" do
208   source "api-statistics.erb"
209   owner "root"
210   group "root"
211   mode "755"
212 end
213
214 systemd_service "api-statistics" do
215   description "OpenStreetMap API Statistics Daemon"
216   user "rails"
217   group "adm"
218   exec_start "/usr/local/bin/api-statistics"
219   nice 10
220   sandbox true
221   read_write_paths [
222     "/srv/www.openstreetmap.org/rails/tmp",
223     "/var/lib/prometheus/node-exporter"
224   ]
225   restart "on-failure"
226 end
227
228 service "api-statistics" do
229   action [:enable, :start]
230   supports :restart => true
231   subscribes :restart, "template[/usr/local/bin/api-statistics]"
232   subscribes :restart, "systemd_service[api-statistics]"
233 end
234
235 gem_package "hpricot" do
236   gem_binary node[:ruby][:gem]
237 end