# DO NOT EDIT - This file is being maintained by Chef # configure host name visible_hostname <%= node.name %> cache_mem <%= node[:squid][:cache_mem] %> <% if node[:squid][:version] > 2 -%> workers <%= [ node[:cpu][:total] - 2, 1 ].max.ceil %> cpu_affinity_map process_numbers=<%= (1..[ node[:cpu][:total] - 2, 1 ].max.ceil).to_a.join(',') %> cores=<%=(1..[ node[:cpu][:total] - 2, 1 ].max.ceil).to_a.join(',') %> error_log_languages off <% end -%> max_filedescriptors 98304 <% if node[:squid][:version] > 3 -%> # Use RFC6891 recommended max size dns_packet_max 4096 bytes # Use low initial retry interval (backoff start) dns_retransmit_interval 2 seconds # Set low timeout dns_timeout 15 seconds <% end -%> # used by squidclient / munin http_port 3128 # HTCP htcp_port 4827 # ICP icp_port 3130 log_icp_queries off <% if node[:squid][:version] < 3 -%> http_port 80 accel defaultsite=tile.openstreetmap.org tcpkeepalive=60,10,6 http11 <% else -%> http_port 80 accel no-vhost defaultsite=tile.openstreetmap.org tcpkeepalive=60,10,6 <% end -%> cache_effective_user proxy cache_effective_group proxy <% Array(node[:squid][:cache_dir]).each do |cache_dir| -%> cache_dir <%= cache_dir %> <% end -%> <% if node[:squid][:version] < 3 -%> cache_swap_log /var/spool/squid/%s <% end -%> cache_mgr webmaster@openstreetmap.org quick_abort_min 0 KB quick_abort_max 0 KB read_ahead_gap 64 KB maximum_object_size 256 KB maximum_object_size_in_memory 64 KB cache_replacement_policy heap LFUDA memory_replacement_policy heap GDSF server_persistent_connections on <% if node[:squid][:version] < 3 -%> persistent_request_timeout 1 minutes <% else -%> client_idle_pconn_timeout 1 minutes <% end -%> <% if node[:squid][:version] > 3 -%> pconn_lifetime 5 minutes <% end -%> negative_ttl 15 seconds <% if node[:squid][:version] < 3 -%> pipeline_prefetch on <% end -%> read_timeout 90 seconds request_timeout 90 seconds connect_timeout 20 seconds client_lifetime 1 hours <% if node[:squid][:version] < 3 -%> refresh_stale_hit 300 seconds <% end -%> # Recommended minimum configuration: # ---------------------------------- <% if node[:squid][:version] < 3 -%> acl all src all acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 <% end -%> acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access allow manager http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports # ---------------------------------- acl purge_hosts src 127.0.0.0/8 acl PURGE method purge http_access allow purge purge_hosts http_access deny purge forwarded_for on follow_x_forwarded_for allow localhost <% if node[:squid][:version] < 3 -%> logformat openstreetmap %ts.%03tu %tr %>a %Ss/%03Hs %h" "%{User-Agent}>h" access_log <%= node[:squid][:access_log] %> <% else -%> logformat openstreetmap %ts.%03tu %tr %>a %Ss/%03>Hs %rp %Sh/%h" "%{User-Agent}>h" access_log daemon:<%= node[:squid][:access_log] %> <% end -%> cache_log /var/log/squid/cache.log cache_store_log none client_db off strip_query_terms off <% if node[:squid][:version] > 2 -%> # Work around bug in squid 3 that causes log_fqdn to be # turned on by some of the (unused by us) default formats: # http://lists.squid-cache.org/pipermail/squid-users/2016-February/thread.html#8999 url_rewrite_extras "%>a %un %>rm myip=%la myport=%lp" store_id_extras "%>a %un %>rm myip=%la myport=%lp" <% end -%> digest_generation on refresh_pattern . 0 50% 20160 refresh_pattern -i tile.openstreetmap.org 60 80% 20160 reload-into-ims # ZERO required for logrotate to work properly logfile_rotate 0 <% Dir.glob("/etc/squid/squid.conf.d/*.conf") do |file| -%> <%= File.read(file) %> <% end -%> # MUST BE LAST ACL # -------------- http_access deny all htcp_access deny all icp_access deny all # --------------