X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/fa63c845987967418edaff22b75958916b19f19a..5b2560e7d50f01a674b8da3d8f30100c92877958:/cookbooks/squid/templates/default/squid.conf.erb diff --git a/cookbooks/squid/templates/default/squid.conf.erb b/cookbooks/squid/templates/default/squid.conf.erb deleted file mode 100644 index 61008078a..000000000 --- a/cookbooks/squid/templates/default/squid.conf.erb +++ /dev/null @@ -1,168 +0,0 @@ -# DO NOT EDIT - This file is being maintained by Chef - -# configure host name -visible_hostname <%= node.name %> - -cache_mem <%= node[:squid][:cache_mem] %> -<% if node[:squid][:version] > 2 -%> - -workers <%= [ node[:cpu][:total] - 2, 1 ].max.ceil %> -cpu_affinity_map process_numbers=<%= (1..[ node[:cpu][:total] - 2, 1 ].max.ceil).to_a.join(',') %> cores=<%=(1..[ node[:cpu][:total] - 2, 1 ].max.ceil).to_a.join(',') %> - -# Set short clean shutdown interval -shutdown_lifetime 2 seconds - -error_log_languages off -<% end -%> - -max_filedescriptors 98304 - -<% if node[:squid][:version] > 3 -%> -# Use RFC6891 recommended max size -dns_packet_max 4096 bytes -# Use low initial retry interval (backoff start) -dns_retransmit_interval 2 seconds -# Set low timeout -dns_timeout 15 seconds -<% end -%> -dns_v4_first on - -# used by squidclient / munin -http_port 3128 -# HTCP -htcp_port 4827 -# ICP -icp_port 3130 -log_icp_queries off - -<% if node[:squid][:version] < 3 -%> -http_port 80 accel defaultsite=tile.openstreetmap.org tcpkeepalive=60,10,6 http11 -<% else -%> -http_port 8080 accel no-vhost defaultsite=tile.openstreetmap.org tcpkeepalive=60,10,6 -<% end -%> - -cache_effective_user proxy -cache_effective_group proxy - -<% Array(node[:squid][:cache_dir]).each do |cache_dir| -%> -cache_dir <%= cache_dir %> -<% end -%> - -<% if node[:squid][:version] < 3 -%> -cache_swap_log /var/spool/squid/%s -<% end -%> - -cache_mgr webmaster@openstreetmap.org - -quick_abort_min 0 KB -quick_abort_max 0 KB - -read_ahead_gap 64 KB - -maximum_object_size 256 KB -maximum_object_size_in_memory 64 KB - -cache_replacement_policy heap LFUDA -memory_replacement_policy heap GDSF - -server_persistent_connections on -<% if node[:squid][:version] < 3 -%> -persistent_request_timeout 1 minutes -<% else -%> -client_idle_pconn_timeout 1 minutes -<% end -%> -<% if node[:squid][:version] > 3 -%> -pconn_lifetime 5 minutes -<% end -%> - -negative_ttl 15 seconds -<% if node[:squid][:version] < 3 -%> -pipeline_prefetch on -<% end -%> - -read_timeout 90 seconds -request_timeout 90 seconds -connect_timeout 20 seconds -client_lifetime 1 hours - -<% if node[:squid][:version] < 3 -%> -refresh_stale_hit 300 seconds -<% end -%> - -# Recommended minimum configuration: -# ---------------------------------- -<% if node[:squid][:version] < 3 -%> -acl all src all -acl manager proto cache_object -acl localhost src 127.0.0.1/32 -acl to_localhost dst 127.0.0.0/8 -<% end -%> -acl SSL_ports port 443 -acl Safe_ports port 80 # http -acl Safe_ports port 21 # ftp -acl Safe_ports port 443 # https -acl Safe_ports port 70 # gopher -acl Safe_ports port 210 # wais -acl Safe_ports port 1025-65535 # unregistered ports -acl Safe_ports port 280 # http-mgmt -acl Safe_ports port 488 # gss-http -acl Safe_ports port 591 # filemaker -acl Safe_ports port 777 # multiling http -acl CONNECT method CONNECT -http_access allow manager localhost - -http_access allow manager - -http_access deny manager -http_access deny !Safe_ports -http_access deny CONNECT !SSL_ports -# ---------------------------------- - -acl purge_hosts src 127.0.0.0/8 -acl PURGE method purge -http_access allow purge purge_hosts -http_access deny purge - -forwarded_for on -follow_x_forwarded_for allow localhost - -<% if node[:squid][:version] < 3 -%> -logformat openstreetmap %ts.%03tu %tr %>a %Ss/%03Hs %h" "%{User-Agent}>h" -access_log <%= node[:squid][:access_log] %> -<% else -%> -logformat openstreetmap %ts.%03tu %tr %>a %Ss/%03>Hs %rp %Sh/%h" "%{User-Agent}>h" -access_log daemon:<%= node[:squid][:access_log] %> -<% end -%> -cache_log /var/log/squid/cache.log -cache_store_log none - -buffered_logs on - -client_db off -strip_query_terms off -<% if node[:squid][:version] > 2 -%> -# Work around bug in squid 3 that causes log_fqdn to be -# turned on by some of the (unused by us) default formats: -# http://lists.squid-cache.org/pipermail/squid-users/2016-February/thread.html#8999 -url_rewrite_extras "%>a %un %>rm myip=%la myport=%lp" -store_id_extras "%>a %un %>rm myip=%la myport=%lp" -<% end -%> - -digest_generation off - -refresh_pattern . 0 50% 20160 -refresh_pattern -i tile.openstreetmap.org 60 80% 20160 reload-into-ims - -# ZERO required for logrotate to work properly -logfile_rotate 0 - -<% Dir.glob("/etc/squid/squid.conf.d/*.conf") do |file| -%> -<%= File.read(file) %> -<% end -%> - -# MUST BE LAST ACL -# -------------- -http_access deny all -htcp_access deny all -icp_access deny all -# --------------