X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/672db0ffdbfdec5510c282e7eeb2adc30d535111..b11f888a94a141f24b709819e32bf8d5b76a3ffe:/cookbooks/tilecache/templates/default/nginx_tile.conf.erb

diff --git a/cookbooks/tilecache/templates/default/nginx_tile.conf.erb b/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
index 0b77171e8..76b3f26f5 100644
--- a/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
+++ b/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
@@ -1,18 +1,15 @@
 # DO NOT EDIT - This file is being maintained by Chef
 
 upstream tile_cache_backend {
-  server 127.0.0.1;
-  server 127.0.0.2;
-  server 127.0.0.3;
+  server 127.0.0.1:80;
+  server 127.0.0.2:80;
 
   # Add the other caches to relieve pressure if local squid failing
   # Balancer: round-robin
 <% @caches.each do |cache| -%>
 <% if cache[:hostname] != node[:hostname] -%>
-<% if node[:tilecache][:tile_siblings].include? cache[:fqdn] -%>
 <% cache.ipaddresses(:family => :inet, :role => :external).sort.each do |address| -%>
-  server <%= address %> backup; # Server <%= cache[:hostname] %>
-<% end -%>
+  server <%= address %>:80 backup; # Server <%= cache[:hostname] %>
 <% end -%>
 <% end -%>
 <% end -%>
@@ -74,22 +71,22 @@ map $http_referer $denied_referer {
 }
 
 map $http_referer $osm_referer {
-  default                                 0;     # False
+  default                                 '';    # False
   '~^https:\/\/www\.openstreetmap\.org\/' 'osm'; # True
 }
 
 # Limit Cache-Control header to only approved User-Agents
-map $http_user_agent $limit_http_cache_control {
-  default '';                              # Unset Header
-  '~^Mozilla\/5\.0\ QGIS\/' '';            # Unset Header
-  '~^Mozilla\/5\.0\ ' $http_cache_control; # Pass Header
+map $osm_referer$http_user_agent $limit_http_cache_control {
+  default '';                                # Unset Header
+  '~^osmMozilla\/5\.0\ QGIS\/' '';            # Unset Header
+  '~^osmMozilla\/5\.0\ ' $http_cache_control; # Pass Header
 }
 
 # Limit Pragma header to only approved User-Agents
-map $http_user_agent $limit_http_pragma {
-  default '';                       # Unset Header
-  '~^Mozilla\/5\.0\ QGIS\/' '';     # Unset Header
-  '~^Mozilla\/5\.0\ ' $http_pragma; # Pass Header
+map $osm_referer$http_user_agent $limit_http_pragma {
+  default '';                          # Unset Header
+  '~^osmMozilla\/5\.0\ QGIS\/' '';     # Unset Header
+  '~^osmMozilla\/5\.0\ ' $http_pragma; # Pass Header
 }
 
 server {
@@ -179,6 +176,11 @@ server {
     # Dedicated zoom handler for caching
     location /<%= i %>/ {
 <% end %>
+      # Only allow GET / HEAD / OPTIONS (CORS) requests
+      limit_except GET HEAD OPTIONS {
+        deny all;
+      }
+
       proxy_pass http://tile_cache_backend;
       proxy_set_header X-Forwarded-For $remote_addr;
       proxy_http_version 1.1;
@@ -254,20 +256,12 @@ server {
         return 418;
       }
 
-      # Only allow cache purges if from OpenStreetMap referer
-      if ($osm_referer) {
-        # Allow cache purging headers only from select User-Agents (uses nginx Map)
-        proxy_set_header Cache-Control $limit_http_cache_control;
-        proxy_set_header Pragma $limit_http_pragma;
-      }
-      # nginx has no if else logic
-      if ($osm_referer != 'osm') {
-        proxy_set_header Cache-Control '';
-        proxy_set_header Pragma '';
-      }
-
       # Strip any ?query parameters from urls
       set $args '';
+
+      # Allow cache purging headers only from select User-Agents (uses nginx Map)
+      proxy_set_header Cache-Control $limit_http_cache_control;
+      proxy_set_header Pragma $limit_http_pragma;
     }
 <% end %>
 }