X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/4a78565948891c672bfdd5fc720a2395a547543f..262347df604997a1cef52df74ffdb687e5a6c22a:/cookbooks/tile/recipes/default.rb diff --git a/cookbooks/tile/recipes/default.rb b/cookbooks/tile/recipes/default.rb index c9f4d1371..b3001c1e5 100644 --- a/cookbooks/tile/recipes/default.rb +++ b/cookbooks/tile/recipes/default.rb @@ -21,9 +21,11 @@ include_recipe "apache" include_recipe "git" include_recipe "nodejs" include_recipe "postgresql" +include_recipe "python" include_recipe "tools" blocks = data_bag_item("tile", "blocks") +web_passwords = data_bag_item("web", "passwords") apache_module "alias" apache_module "cgi" @@ -62,9 +64,26 @@ end package "renderd" +systemd_service "renderd" do + description "Mapnik rendering daemon" + after "postgresql.service" + wants "postgresql.service" + user "www-data" + exec_start "/usr/bin/renderd -f" + runtime_directory "renderd" + standard_error "null" + private_tmp true + private_devices true + private_network true + protect_system "full" + protect_home true + no_new_privileges true + restart "on-failure" +end + service "renderd" do action [:enable, :start] - supports :status => false, :restart => true, :reload => false + subscribes :restart, "systemd_service[renderd]" end directory "/srv/tile.openstreetmap.org/tiles" do @@ -101,23 +120,15 @@ end package "python-cairo" package "python-mapnik" +package "python-setuptools" -package "ttf-dejavu" -package "ttf-unifont" +python_package "pyotp" -if node[:lsb][:release].to_f >= 16.04 - package "fonts-droid-fallback" -else - package "fonts-droid" -end - -package "fonts-sipa-arundina" -package "fonts-sil-padauk" -package "fonts-khmeros" -package "fonts-beng-extra" -package "fonts-gargi" -package "fonts-taml-tscu" -package "fonts-tibetan-machine" +package "fonts-noto-cjk" +package "fonts-noto-hinted" +package "fonts-noto-unhinted" +package "fonts-hanazono" +package "ttf-unifont" directory "/srv/tile.openstreetmap.org/cgi-bin" do owner "tile" @@ -130,7 +141,7 @@ template "/srv/tile.openstreetmap.org/cgi-bin/export" do owner "tile" group "tile" mode 0o755 - variables :blocks => blocks + variables :blocks => blocks, :totp_key => web_passwords["totp_key"] end template "/srv/tile.openstreetmap.org/cgi-bin/debug" do @@ -158,12 +169,17 @@ package "mapnik-utils" node[:tile][:data].each_value do |data| url = data[:url] file = "/srv/tile.openstreetmap.org/data/#{File.basename(url)}" - directory = "/srv/tile.openstreetmap.org/data/#{data[:directory]}" - directory directory do - owner "tile" - group "tile" - mode 0o755 + if data[:directory] + directory = "/srv/tile.openstreetmap.org/data/#{data[:directory]}" + + directory directory do + owner "tile" + group "tile" + mode 0o755 + end + else + directory = "/srv/tile.openstreetmap.org/data" end if file =~ /\.tgz$/ @@ -225,6 +241,19 @@ end nodejs_package "carto" nodejs_package "millstone" +systemd_service "update-lowzoom@" do + description "Low zoom tile update service for %i layer" + user "tile" + exec_start "/usr/local/bin/update-lowzoom-%i" + private_tmp true + private_devices true + private_network true + protect_system "full" + protect_home true + no_new_privileges true + restart "on-failure" +end + directory "/srv/tile.openstreetmap.org/styles" do owner "tile" group "tile" @@ -243,15 +272,7 @@ node[:tile][:styles].each do |name, details| variables :style => name end - template "/etc/init.d/update-lowzoom-#{name}" do - source "update-lowzoom.init.erb" - owner "root" - group "root" - mode 0o755 - variables :style => name - end - - service "update-lowzoom-#{name}" do + service "update-lowzoom@#{name}" do action :disable supports :restart => true end @@ -307,17 +328,20 @@ node[:tile][:styles].each do |name, details| execute "#{style_directory}/project.mml" do action :nothing - command "carto project.mml > project.xml" + command "carto -a 3.0.0 project.mml > project.xml" cwd style_directory user "tile" group "tile" subscribes :run, "git[#{style_directory}]" notifies :restart, "service[renderd]", :immediately - notifies :restart, "service[update-lowzoom-#{name}]" + notifies :restart, "service[update-lowzoom@#{name}]" end end +postgresql_version = node[:tile][:database][:cluster].split("/").first + package "postgis" +package "postgresql-#{postgresql_version}-postgis-2.3" postgresql_user "jburgess" do cluster node[:tile][:database][:cluster] @@ -411,19 +435,18 @@ template "/usr/local/bin/expire-tiles" do mode 0o755 end -template "/etc/sudoers.d/tile" do - source "sudoers.erb" - owner "root" - group "root" - mode 0o440 -end - directory "/var/lib/replicate" do owner "tile" group "tile" mode 0o755 end +directory "/var/lib/replicate/expire-queue" do + owner "tile" + group "www-data" + mode 0o775 +end + template "/var/lib/replicate/configuration.txt" do source "replicate.configuration.erb" owner "tile" @@ -438,18 +461,47 @@ template "/usr/local/bin/replicate" do mode 0o755 end -template "/etc/init.d/replicate" do - source "replicate.init.erb" - owner "root" - group "root" - mode 0o755 +systemd_service "expire-tiles" do + description "Tile dirtying service" + type "simple" + user "www-data" + exec_start "/usr/local/bin/expire-tiles" + standard_output "null" + private_tmp true + private_devices true + protect_system "full" + protect_home true + no_new_privileges true +end + +systemd_path "expire-tiles" do + description "Tile dirtying trigger" + directory_not_empty "/var/lib/replicate/expire-queue" +end + +service "expire-tiles.path" do + action [:enable, :start] + subscribes :restart, "systemd_path[expire-tiles]" +end + +systemd_service "replicate" do + description "Rendering database replication service" + after "postgresql.service" + wants "postgresql.service" + user "tile" + exec_start "/usr/local/bin/replicate" + private_tmp true + private_devices true + protect_system "full" + protect_home true + no_new_privileges true + restart "on-failure" end service "replicate" do action [:enable, :start] - supports :restart => true subscribes :restart, "template[/usr/local/bin/replicate]" - subscribes :restart, "template[/etc/init.d/replicate]" + subscribes :restart, "systemd_service[replicate]" end template "/etc/logrotate.d/replicate" do @@ -473,32 +525,6 @@ template "/etc/cron.d/render-lowzoom" do mode 0o644 end -if node[:lsb][:release].to_f >= 16.04 - file "/etc/rsyslog.d/20-renderd.conf" do - action :delete - notifies :restart, "service[rsyslog]" - end - - file "/etc/logrotate.d/renderd" do - action :delete - end -else - template "/etc/rsyslog.d/20-renderd.conf" do - source "renderd.rsyslog.erb" - owner "root" - group "root" - mode 0o644 - notifies :restart, "service[rsyslog]" - end - - template "/etc/logrotate.d/renderd" do - source "renderd.logrotate.erb" - owner "root" - group "root" - mode 0o644 - end -end - package "liblockfile-simple-perl" package "libfilesys-df-perl"