X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/a839868a4ce8d05946a97f83c1aa451028c07889..67c2aceb91955ff583c41807759d203a4478e4b1:/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb diff --git a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb index 0b587e242..60d7d451f 100644 --- a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb +++ b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb @@ -1,17 +1,51 @@ +# DO NOT EDIT - This file is being maintained by Chef + upstream tile_cache_backend { server 127.0.0.1; <% @caches.each do |cache| -%> + <% if cache[:hostname] != node[:hostname] -%> #Server <%= cache[:hostname] %> <% cache.ipaddresses(:family => :inet, :role => :external).sort.each do |address| -%> server <%= address %> backup; <% end -%> <% end -%> + <% end -%> keepalive 32; } +# Rates table based on current cookie value +map $cookie_qos_token $limit_rate_qos { + include /etc/nginx/conf.d/tile_qos_rates.map; +} + +# Set-Cookie table based on current cookie value +map $cookie_qos_token $cookie_qos_token_set { + include /etc/nginx/conf.d/tile_qos_cookies.map; +} + +map $http_user_agent $approved_scraper { + default ''; # Not approved + '~^JOSM\/' 'JOSM'; + '~^Mozilla\/5\.0\ QGIS\/' 'QGIS'; +} + +# Limit Cache-Control header to only approved User-Agents +map $http_user_agent $limit_http_cache_control { + default ''; # Unset Header + '~^Mozilla\/5\.0\ QGIS\/' ''; # Unset Header + '~^Mozilla\/5\.0\ ' $http_cache_control; # Pass Header +} + +# Limit Pragma header to only approved User-Agents +map $http_user_agent $limit_http_pragma { + default ''; # Unset Header + '~^Mozilla\/5\.0\ QGIS\/' ''; # Unset Header + '~^Mozilla\/5\.0\ ' $http_pragma; # Pass Header +} + server { - listen 443 ssl spdy default_server; + listen 443 ssl fastopen=2048 http2 default_server; server_name localhost; proxy_buffers 8 64k; @@ -27,10 +61,41 @@ server { ssl_stapling on; ssl_dhparam /etc/ssl/certs/dhparam.pem; resolver <%= @resolvers.join(" ") %>; + resolver_timeout 5s; location / { proxy_pass http://tile_cache_backend; proxy_set_header X-Forwarded-For $remote_addr; proxy_http_version 1.1; + proxy_set_header Connection ''; + + proxy_connect_timeout 5s; + + # Do not pass cookies to backends. + proxy_set_header Cookie ''; + # Do not pass Accept-Encoding to backends. + proxy_set_header Accept-Encoding ''; + + # Do not allow setting cookies from backends due to caching. + proxy_ignore_headers Set-Cookie; + proxy_hide_header Set-Cookie; + + # Set a QoS cookie if none presented (uses nginx Map) + add_header Set-Cookie $cookie_qos_token_set; + + # QoS Traffic Rate see $limit_rate on http://nginx.org/en/docs/http/ngx_http_core_module.html + set $limit_rate $limit_rate_qos; + + # Allow Higher Traffic Rate from Approved User-Agents which do not support cookies (uses nginx Map) + if ($approved_scraper) { + set $limit_rate 32768; + } + + # Strip any ?query parameters from urls + set $args ''; + + # Allow cache purging headers only from select User-Agents (uses nginx Map) + proxy_set_header Cache-Control $limit_http_cache_control; + proxy_set_header Pragma $limit_http_pragma; } }