imager: add tiler cookbook

diff --git a/.github/workflows/test-kitchen.yml b/.github/workflows/test-kitchen.yml
index 12502a628de9f380232655dd59ec9ed10cd9253c..343564cc6f6c3381534569d4e3955bd3551452dc 100644 (file)
--- a/.github/workflows/test-kitchen.yml
+++ b/.github/workflows/test-kitchen.yml
@@ -58,6 +58,7 @@ jobs:
           - hardware
           - hot
           - ideditor
+          - imagery-tiler
           - irc
           - kibana
           - letsencrypt

diff --git a/.kitchen.yml b/.kitchen.yml
index cb1c2ffde050cb678aa9e1398e3041260ab53849..39fbc4de241765a16145cb5e32629f6a15223b74 100644 (file)
--- a/.kitchen.yml
+++ b/.kitchen.yml
@@ -209,6 +209,9 @@ suites:
   - name: ideditor
     run_list:
       - recipe[ideditor::default]
+  - name: imagery-tiler
+    run_list:
+      - recipe[imagery::tiler]
   - name: irc
     run_list:
       - recipe[irc::default]

diff --git a/cookbooks/imagery/metadata.rb b/cookbooks/imagery/metadata.rb
index 9b091a89ec45820010b2572405b716612b443376..85dbc657c664365f3dcc24d88f2cd3cda46056ef 100644 (file)
--- a/cookbooks/imagery/metadata.rb
+++ b/cookbooks/imagery/metadata.rb
@@ -6,7 +6,9 @@ description       "Installs and configures imagery"
 
 version           "1.0.0"
 supports          "ubuntu"
-depends           "nginx"
+depends           "accounts"
 depends           "git"
-depends           "systemd"
+depends           "nginx"
+depends           "podman"
 depends           "ssl"
+depends           "systemd"

diff --git a/cookbooks/imagery/recipes/default.rb b/cookbooks/imagery/recipes/default.rb
index 316406e1336bef821c6b12402e104352e591abea..6b4cbe9db3e07460f991fa1a30e2cf6d98b6a6c2 100644 (file)
--- a/cookbooks/imagery/recipes/default.rb
+++ b/cookbooks/imagery/recipes/default.rb
@@ -17,6 +17,7 @@
 # limitations under the License.
 #
 
+include_recipe "accounts"
 include_recipe "nginx"
 include_recipe "git"
 

diff --git a/cookbooks/imagery/recipes/tiler.rb b/cookbooks/imagery/recipes/tiler.rb
new file mode 100644 (file)
index 0000000..12c6999
--- /dev/null
+++ b/cookbooks/imagery/recipes/tiler.rb
@@ -0,0 +1,45 @@
+#
+# Cookbook:: imagery
+# Recipe:: tiler
+#
+# Copyright:: 2023, OpenStreetMap Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+include_recipe "imagery"
+include_recipe "podman"
+
+# FIXME: until upstream supports arm64 images: https://github.com/developmentseed/titiler/pull/740
+container_image = if arm?
+                    "ghcr.io/firefishy/titiler:latest"
+                  else
+                    "ghcr.io/developmentseed/titiler:latest"
+                  end
+
+podman_service "titiler" do
+  description "Container service for titiler"
+  image container_image
+  ports 8080 => 8080
+  environment :PORT => 8080, :WORKERS_PER_CORE => 1, :GDAL_INGESTED_BYTES_AT_OPEN => 32768, :GDAL_DISABLE_READDIR_ON_OPEN => "EMPTY_DIR", :GDAL_HTTP_MERGE_CONSECUTIVE_RANGES => "YES", :GDAL_HTTP_MULTIPLEX => "YES", :GDAL_HTTP_VERSION => 2
+end
+
+ssl_certificate "tiler.openstreetmap.org" do
+  domains "tiler.openstreetmap.org"
+  notifies :reload, "service[nginx]"
+end
+
+nginx_site "tiler.openstreetmap.org" do
+  template "nginx_titiler.conf.erb"
+  variables :aliases => ["tiler.osm.org"]
+end

diff --git a/cookbooks/imagery/templates/default/nginx_titiler.conf.erb b/cookbooks/imagery/templates/default/nginx_titiler.conf.erb
new file mode 100644 (file)
index 0000000..2ce67a3
--- /dev/null
+++ b/cookbooks/imagery/templates/default/nginx_titiler.conf.erb
@@ -0,0 +1,44 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name <%= @name %> <% @aliases.each do |alias_name| %> <%= alias_name %><%- end -%>;
+
+    rewrite ^/\.well-known/acme-challenge/(.*)$ http://acme.openstreetmap.org/.well-known/acme-challenge/$1 permanent;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name <%= @name %> <% @aliases.each do |alias_name| %> <%= alias_name %><%- end -%>;
+
+    ssl_certificate /etc/ssl/certs/<%= @name %>.pem;
+    ssl_certificate_key /etc/ssl/private/<%= @name %>.key;
+<% if node[:ssl][:strict_transport_security] -%>
+
+    add_header Strict-Transport-Security "<%= node[:ssl][:strict_transport_security] %>" always;
+<% end -%>
+
+    # Requests sent within early data are subject to replay attacks.
+    # See: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data
+    ssl_early_data on;
+
+    # root "/srv/<%= @name %>";
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript application/x-javascript text/javascript text/xml application/xml application/rss+xml application/atom+xml application/rdf+xml image/svg+xml; # text/html is implicit
+    gzip_min_length 512;
+    gzip_http_version 1.0;
+    gzip_proxied any;
+    gzip_comp_level 9;
+    gzip_vary on;
+
+    location /api/v1/titiler {
+      rewrite ^/api/v1/titiler(.*)$ $1 break;
+      proxy_pass http://localhost:8080;
+      proxy_set_header HOST $host;
+      proxy_set_header Referer $http_referer;
+      proxy_set_header X-Forwarded-For $remote_addr;
+      proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

diff --git a/test/integration/imagery-tiler/inspec/nginx_spec.rb b/test/integration/imagery-tiler/inspec/nginx_spec.rb
new file mode 100644 (file)
index 0000000..366cecb
--- /dev/null
+++ b/test/integration/imagery-tiler/inspec/nginx_spec.rb
@@ -0,0 +1,8 @@
+describe package("nginx") do
+  it { should be_installed }
+end
+
+describe service("nginx") do
+  it { should be_enabled }
+  it { should be_running }
+end

diff --git a/test/integration/imagery-tiler/inspec/tiler_spec.rb b/test/integration/imagery-tiler/inspec/tiler_spec.rb
new file mode 100644 (file)
index 0000000..366cecb
--- /dev/null
+++ b/test/integration/imagery-tiler/inspec/tiler_spec.rb
@@ -0,0 +1,8 @@
+describe package("nginx") do
+  it { should be_installed }
+end
+
+describe service("nginx") do
+  it { should be_enabled }
+  it { should be_running }
+end