X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/0f3cdcb49d8f3e8e1eedc01800aeeb51bfd34ff3..db3ddf9fd9e9028b4c151efba2b3f9e5bfb0504e:/cookbooks/tilecache/recipes/default.rb diff --git a/cookbooks/tilecache/recipes/default.rb b/cookbooks/tilecache/recipes/default.rb index f18896479..d3f1dccfa 100644 --- a/cookbooks/tilecache/recipes/default.rb +++ b/cookbooks/tilecache/recipes/default.rb @@ -1,14 +1,14 @@ # -# Cookbook Name:: tilecache +# Cookbook:: tilecache # Recipe:: default # -# Copyright 2011, OpenStreetMap Foundation +# Copyright:: 2011, OpenStreetMap Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # -# http://www.apache.org/licenses/LICENSE-2.0 +# https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, @@ -19,19 +19,21 @@ require "ipaddr" -certificate = node[:tilecache][:ssl][:certificate] -node.default[:ssl][:certificates] = node[:ssl][:certificates] | [certificate] - -include_recipe "ssl" -include_recipe "squid" +include_recipe "fail2ban" +include_recipe "munin" include_recipe "nginx" +include_recipe "squid" +include_recipe "ssl" package "apache2" do action :remove end -package "xz-utils" -package "openssl" +package %w[ + curl + xz-utils + openssl +] # oathtool for QoS token package "oathtool" @@ -52,6 +54,7 @@ tilecaches.each do |cache| dest_ports "3128" source_ports "1024:" end + firewall_rule "accept-squid-icp" do action :accept family "inet" @@ -61,6 +64,7 @@ tilecaches.each do |cache| dest_ports "3130" source_ports "3130" end + firewall_rule "accept-squid-icp-reply" do action :accept family "inet" @@ -70,6 +74,26 @@ tilecaches.each do |cache| dest_ports "3130" source_ports "3130" end + + firewall_rule "accept-squid-htcp" do + action :accept + family "inet" + source "net:#{address}" + dest "fw" + proto "udp" + dest_ports "4827" + source_ports "4827" + end + + firewall_rule "accept-squid-htcp-reply" do + action :accept + family "inet" + source "fw" + dest "net:#{address}" + proto "udp" + dest_ports "4827" + source_ports "4827" + end end end @@ -78,39 +102,47 @@ squid_fragment "tilecache" do variables :caches => tilecaches, :renders => tilerenders end +package "rsync" + template "/etc/logrotate.d/squid" do source "logrotate.squid.erb" owner "root" group "root" - mode 0o644 + mode "644" end nginx_site "default" do action [:delete] end -resolvers = node[:networking][:nameservers].map do |resolver| - IPAddr.new(resolver).ipv6? ? "[#{resolver}]" : resolver -end - -nginx_site "tile-ssl" do - template "nginx_tile_ssl.conf.erb" - variables :certificate => certificate, :resolvers => resolvers, :caches => tilecaches -end - template "/usr/local/bin/nginx_generate_tilecache_qos_map" do source "nginx_generate_tilecache_qos_map.erb" owner "root" group "root" - mode 0o750 - variables :web_passwords => web_passwords + mode "750" + variables :totp_key => web_passwords["totp_key"] end -template "/etc/cron.d/tilecache" do - source "cron.erb" - owner "root" - group "root" - mode 0o644 +cron_d "tilecache" do + action :delete +end + +cron_d "tilecache-generate-qos-map" do + minute "0" + user "root" + command "/usr/local/bin/nginx_generate_tilecache_qos_map" +end + +cron_d "tilecache-curl-time" do + user "www-data" + command "/srv/tilecache/tilecache-curl-time" +end + +cron_d "tilecache-curl-time-cleanup" do + minute "15" + hour "0" + user "www-data" + command "/srv/tilecache/tilecache-curl-time-cleanup" end execute "execute_nginx_generate_tilecache_qos_map" do @@ -119,19 +151,32 @@ execute "execute_nginx_generate_tilecache_qos_map" do action :run end -service "nginx-certificate-restart" do - service_name "nginx" - action :nothing - subscribes :restart, "cookbook_file[/etc/ssl/certs/rapidssl.pem]" - subscribes :restart, "file[/etc/ssl/certs/#{certificate}.pem]" - subscribes :restart, "file[/etc/ssl/private/#{certificate}.key]" +ssl_certificate "tile.openstreetmap.org" do + domains ["tile.openstreetmap.org", + "a.tile.openstreetmap.org", + "b.tile.openstreetmap.org", + "c.tile.openstreetmap.org", + "tile.osm.org", + "a.tile.osm.org", + "b.tile.osm.org", + "c.tile.osm.org"] + notifies :restart, "service[nginx]" +end + +nginx_site "tile" do + template "nginx_tile.conf.erb" + variables :caches => tilecaches end template "/etc/logrotate.d/nginx" do source "logrotate.nginx.erb" owner "root" group "root" - mode 0o644 + mode "644" +end + +fail2ban_jail "squid" do + maxretry 1000 end tilerenders.each do |render| @@ -141,3 +186,41 @@ tilerenders.each do |render| conf_variables :host => render[:fqdn] end end + +directory "/srv/tilecache" do + owner "root" + group "root" + mode "755" +end + +directory "/srv/tilecache/data" do + owner "www-data" + group "www-data" + mode "755" +end + +cookbook_file "/srv/tilecache/tilecache-curl-time.txt" do + source "tilecache-curl-time.txt" + owner "root" + group "root" + mode "755" +end + +template "/srv/tilecache/tilecache-curl-time" do + source "tilecache-curl-time.erb" + owner "root" + group "root" + mode "755" + variables :caches => tilecaches, :renders => tilerenders +end + +template "/srv/tilecache/tilecache-curl-time-cleanup" do + source "tilecache-curl-time-cleanup.erb" + owner "root" + group "root" + mode "755" +end + +ohai_plugin "tilecache" do + template "ohai.rb.erb" +end