Modernise squid_fragment LWRP

[chef.git] / cookbooks / squid / recipes / default.rb

diff --git a/cookbooks/squid/recipes/default.rb b/cookbooks/squid/recipes/default.rb
index def3d9187f2aa642c2c90a654ad588a83cc8b3f1..f024adcc6dfba19f1d0c5be94d083a4349092768 100644 (file)
--- a/cookbooks/squid/recipes/default.rb
+++ b/cookbooks/squid/recipes/default.rb
@@ -50,6 +50,11 @@ systemd_service "squid" do
   exec_start "/usr/sbin/squid -N $SQUID_ARGS"
   exec_reload "/usr/sbin/squid -k reconfigure"
   exec_stop "/usr/sbin/squid -k shutdown"
+  private_tmp true
+  private_devices true
+  protect_system "full"
+  protect_home true
+  no_new_privileges true
   restart "on-failure"
   timeout_sec 0
 end
@@ -67,7 +72,7 @@ log "squid-restart" do
   notifies :restart, "service[squid]"
   only_if do
     IO.popen(["squidclient", "--host=127.0.0.1", "--port=80", "mgr:counters"]) do |io|
-      io.each.grep(/^[a-z][a-z_.]+ = -[0-9]+$/).count > 0
+      io.each.grep(/^[a-z][a-z_.]+ = -[0-9]+$/).count.positive?
     end
   end
 end
@@ -80,3 +85,7 @@ munin_plugin "squid_icp"
 munin_plugin "squid_objectsize"
 munin_plugin "squid_requests"
 munin_plugin "squid_traffic"
+
+Dir.glob("/var/log/squid/zere.log*") do |log|
+  File.unlink(log)
+end