X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/985c2fc143fde1f5c74b587a617baf79e8c58db1..6fecdd677ea97324e8307dc3d19bdc294d9456e6:/cookbooks/tilecache/recipes/default.rb?ds=inline diff --git a/cookbooks/tilecache/recipes/default.rb b/cookbooks/tilecache/recipes/default.rb index 5b44be21f..1f02661b7 100644 --- a/cookbooks/tilecache/recipes/default.rb +++ b/cookbooks/tilecache/recipes/default.rb @@ -17,11 +17,94 @@ # limitations under the License. # +require "ipaddr" + +certificate = node[:tilecache][:ssl][:certificate] +node.default[:ssl][:certificates] = node[:ssl][:certificates] | [certificate] + +include_recipe "ssl" include_recipe "squid" +include_recipe "nginx" + +package "apache2" do + action :remove +end + +package "xz-utils" +package "openssl" tilecaches = search(:node, "roles:tilecache").sort_by { |n| n[:hostname] } +tilerenders = search(:node, "roles:tile").sort_by { |n| n[:hostname] } + +tilecaches.each do |cache| + cache.ipaddresses(:family => :inet, :role => :external).sort.each do |address| + firewall_rule "accept-squid" do + action :accept + family "inet" + source "net:#{address}" + dest "fw" + proto "tcp:syn" + dest_ports "3128" + source_ports "1024:" + end + firewall_rule "accept-squid-icp" do + action :accept + family "inet" + source "net:#{address}" + dest "fw" + proto "udp" + dest_ports "3130" + source_ports "3130" + end + firewall_rule "accept-squid-icp-reply" do + action :accept + family "inet" + source "fw" + dest "net:#{address}" + proto "udp" + dest_ports "3130" + source_ports "3130" + end + end +end squid_fragment "tilecache" do template "squid.conf.erb" - variables :caches => tilecaches + variables :caches => tilecaches, :renders => tilerenders +end + +template "/etc/logrotate.d/squid" do + source "logrotate.squid.erb" + owner "root" + group "root" + mode 0644 +end + +nginx_site "default" do + action [:delete] +end + +resolvers = node[:networking][:nameservers].map do |resolver| + IPAddr.new(resolver).ipv6? ? "[#{resolver}]" : resolver +end + +nginx_site "tile-ssl" do + template "nginx_tile_ssl.conf.erb" + variables :certificate => certificate, :resolvers => resolvers, :caches => tilecaches +end + +service "nginx-certificate-restart" do + service_name "nginx" + action :nothing + subscribes :restart, "cookbook_file[/etc/ssl/certs/rapidssl.pem]" + subscribes :restart, "cookbook_file[/etc/ssl/certs/#{certificate}.pem]" + subscribes :restart, "file[/etc/ssl/private/#{certificate}.key]" +end + +tilerenders.each do |render| + munin_plugin "ping_#{render[:fqdn]}" do + target "ping_" + conf "munin.ping.erb" + conf_variables :host => render[:fqdn] + end end