Move nginx SSL configuration to shared location in nginx cookbook

diff --git a/cookbooks/imagery/resources/site.rb b/cookbooks/imagery/resources/site.rb
index 9cea98f0a2cdff5c59b84c87f81e55127abdd7c5..e4c2c6f86257a5e6805468bc34a7306bd79a92f7 100644 (file)
--- a/cookbooks/imagery/resources/site.rb
+++ b/cookbooks/imagery/resources/site.rb
@@ -95,15 +95,11 @@ action :create do
     domains tile_domains
   end
 
     domains tile_domains
   end
 

-  resolvers = node[:networking][:nameservers].map do |resolver|
-    IPAddr.new(resolver).ipv6? ? "[#{resolver}]" : resolver
-  end
-

   nginx_site new_resource.site do
     template "nginx_imagery.conf.erb"
     directory "/srv/imagery/#{new_resource.site}"
     restart_nginx false
   nginx_site new_resource.site do
     template "nginx_imagery.conf.erb"
     directory "/srv/imagery/#{new_resource.site}"
     restart_nginx false

-    variables new_resource.to_hash.merge(:resolvers => resolvers)
+    variables new_resource.to_hash

   end
 end
 
   end
 end
 

diff --git a/cookbooks/imagery/templates/default/nginx_imagery.conf.erb b/cookbooks/imagery/templates/default/nginx_imagery.conf.erb
index b0fd86910d9f12e6f4b9c369ae64386e8b49f7ce..405949e24ae8bea66b99cdb4f2c0e67af7bff47a 100644 (file)
--- a/cookbooks/imagery/templates/default/nginx_imagery.conf.erb
+++ b/cookbooks/imagery/templates/default/nginx_imagery.conf.erb
@@ -15,16 +15,6 @@ server {
     ssl_certificate /etc/ssl/certs/<%= @name %>.pem;
     ssl_certificate_key /etc/ssl/private/<%= @name %>.key;
 
     ssl_certificate /etc/ssl/certs/<%= @name %>.pem;
     ssl_certificate_key /etc/ssl/private/<%= @name %>.key;
 

-    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-    ssl_ciphers <%= node[:ssl][:ciphers] -%>;
-    ssl_prefer_server_ciphers on;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_timeout 30m;
-    ssl_stapling on;
-    ssl_dhparam /etc/ssl/certs/dhparam.pem;
-    resolver <%= @resolvers.join(" ") %>;
-    resolver_timeout 5s;
-

     root "/srv/<%= @name %>";
 
     gzip on;
     root "/srv/<%= @name %>";
 
     gzip on;

diff --git a/cookbooks/nginx/recipes/default.rb b/cookbooks/nginx/recipes/default.rb
index 0c97546bde42f62777e8f7f2f3f6847fcf0924fd..6e3a60ff64743d205de569c4918b660162389f6d 100644 (file)
--- a/cookbooks/nginx/recipes/default.rb
+++ b/cookbooks/nginx/recipes/default.rb
@@ -19,13 +19,16 @@
 
 package "nginx"
 
 
 package "nginx"
 

-# admins = data_bag_item("nginx", "admins")
+resolvers = node[:networking][:nameservers].map do |resolver|
+  IPAddr.new(resolver).ipv6? ? "[#{resolver}]" : resolver
+end

 
 template "/etc/nginx/nginx.conf" do
   source "nginx.conf.erb"
   owner "root"
   group "root"
   mode 0o644
 
 template "/etc/nginx/nginx.conf" do
   source "nginx.conf.erb"
   owner "root"
   group "root"
   mode 0o644

+  variables :resolvers => resolvers

 end
 
 directory "/var/cache/nginx/fastcgi-cache" do
 end
 
 directory "/var/cache/nginx/fastcgi-cache" do

diff --git a/cookbooks/nginx/templates/default/nginx.conf.erb b/cookbooks/nginx/templates/default/nginx.conf.erb
index 67b080bf16d443a613b0faaf6076d730e915a07a..7bf95a7fbe351b04bce8833373dc10e3a02e2662 100644 (file)
--- a/cookbooks/nginx/templates/default/nginx.conf.erb
+++ b/cookbooks/nginx/templates/default/nginx.conf.erb
@@ -31,6 +31,16 @@ http {
 
     server_tokens off;
 
 
     server_tokens off;
 

+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers <%= node[:ssl][:ciphers] -%>;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_timeout 30m;
+    ssl_stapling on;
+    ssl_dhparam /etc/ssl/certs/dhparam.pem;
+    resolver <%= @resolvers.join(" ") %>;
+    resolver_timeout 5s;
+

     <% if node['nginx']['cache']['fastcgi']['enable'] -%>
     fastcgi_cache_path /var/cache/nginx/fastcgi-cache levels=1:2 keys_zone=<%= node['nginx']['cache']['fastcgi']['keys_zone'] %> inactive=<%= node['nginx']['cache']['fastcgi']['inactive'] %> max_size=<%= node['nginx']['cache']['fastcgi']['max_size'] %>;
     <% end -%>
     <% if node['nginx']['cache']['fastcgi']['enable'] -%>
     fastcgi_cache_path /var/cache/nginx/fastcgi-cache levels=1:2 keys_zone=<%= node['nginx']['cache']['fastcgi']['keys_zone'] %> inactive=<%= node['nginx']['cache']['fastcgi']['inactive'] %> max_size=<%= node['nginx']['cache']['fastcgi']['max_size'] %>;
     <% end -%>

diff --git a/cookbooks/tilecache/recipes/default.rb b/cookbooks/tilecache/recipes/default.rb
index 728d26f49a9ba54206e2f3919b5f31e3485fab56..994c6104aaf4cea4885362563d9108ca42ef371b 100644 (file)
--- a/cookbooks/tilecache/recipes/default.rb
+++ b/cookbooks/tilecache/recipes/default.rb
@@ -88,10 +88,6 @@ nginx_site "default" do
   action [:delete]
 end
 
   action [:delete]
 end
 

-resolvers = node[:networking][:nameservers].map do |resolver|
-  IPAddr.new(resolver).ipv6? ? "[#{resolver}]" : resolver
-end
-

 template "/usr/local/bin/nginx_generate_tilecache_qos_map" do
   source "nginx_generate_tilecache_qos_map.erb"
   owner "root"
 template "/usr/local/bin/nginx_generate_tilecache_qos_map" do
   source "nginx_generate_tilecache_qos_map.erb"
   owner "root"


@@ -123,7 +119,7 @@ end
 
 nginx_site "tile-ssl" do
   template "nginx_tile_ssl.conf.erb"
 
 nginx_site "tile-ssl" do
   template "nginx_tile_ssl.conf.erb"

-  variables :resolvers => resolvers, :caches => tilecaches
+  variables :caches => tilecaches

 end
 
 template "/etc/logrotate.d/nginx" do
 end
 
 template "/etc/logrotate.d/nginx" do

diff --git a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb
index c441c039c68e920027cbc01c3aaa35a9c35d7d13..7024817aece06780b6c279a59e40f3b05f8c69af 100644 (file)
--- a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb
+++ b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb
@@ -53,16 +53,6 @@ server {
     ssl_certificate      /etc/ssl/certs/tile.openstreetmap.org.pem;
     ssl_certificate_key  /etc/ssl/private/tile.openstreetmap.org.key;
 
     ssl_certificate      /etc/ssl/certs/tile.openstreetmap.org.pem;
     ssl_certificate_key  /etc/ssl/private/tile.openstreetmap.org.key;
 

-    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-    ssl_ciphers <%= node[:ssl][:ciphers] -%>;
-    ssl_prefer_server_ciphers on;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_timeout 30m;
-    ssl_stapling on;
-    ssl_dhparam /etc/ssl/certs/dhparam.pem;
-    resolver <%= @resolvers.join(" ") %>;
-    resolver_timeout 5s;
-

     location / {
       proxy_pass http://tile_cache_backend;
       proxy_set_header X-Forwarded-For $remote_addr;
     location / {
       proxy_pass http://tile_cache_backend;
       proxy_set_header X-Forwarded-For $remote_addr;