From: Tom Hughes <tom@compton.nu>
Date: Wed, 3 Aug 2022 09:56:30 +0000 (+0100)
Subject: Revert "Block requests for tiles unless they come from a CDN node"
X-Git-Url: https://git.openstreetmap.org/chef.git/commitdiff_plain/9d29e75a6270004f3fcba753ad0654a13218654a?hp=14e316cd3e1ab5f25a54d0765ebad61ac665ccb4

Revert "Block requests for tiles unless they come from a CDN node"

This reverts commit 97f7effc3f4ac2d812e6e32a832731c1eeb796c7.
---

diff --git a/cookbooks/tile/recipes/default.rb b/cookbooks/tile/recipes/default.rb
index e8bef858c..4de4200bc 100644
--- a/cookbooks/tile/recipes/default.rb
+++ b/cookbooks/tile/recipes/default.rb
@@ -29,7 +29,6 @@ include_recipe "ruby"
 include_recipe "tools"
 
 blocks = data_bag_item("tile", "blocks")
-admins = data_bag_item("apache", "admins")
 web_passwords = data_bag_item("web", "passwords")
 
 apache_module "alias"
@@ -60,14 +59,6 @@ end
 
 fastlyips = JSON.parse(IO.read("#{Chef::Config[:file_cache_path]}/fastly-ip-list.json"))
 
-remote_file "#{Chef::Config[:file_cache_path]}/statuscake-locations.json" do
-  source "https://app.statuscake.com/Workfloor/Locations.php?format=json"
-  compile_time true
-  ignore_failure true
-end
-
-statuscakelocations = JSON.parse(IO.read("#{Chef::Config[:file_cache_path]}/statuscake-locations.json"))
-
 apache_site "default" do
   action :disable
 end
@@ -78,9 +69,7 @@ end
 
 apache_site "tile.openstreetmap.org" do
   template "apache.erb"
-  variables :fastly => fastlyips["addresses"] + fastlyips["ipv6_addresses"],
-            :statuscake => statuscakelocations.flat_map { |_, v| [v["ip"], v["ipv6"]] },
-            :admins => admins["hosts"]
+  variables :fastly => fastlyips["addresses"]
 end
 
 template "/etc/logrotate.d/apache2" do
diff --git a/cookbooks/tile/templates/default/apache.erb b/cookbooks/tile/templates/default/apache.erb
index a707cba05..f7cba541b 100644
--- a/cookbooks/tile/templates/default/apache.erb
+++ b/cookbooks/tile/templates/default/apache.erb
@@ -19,6 +19,12 @@
   DocumentRoot /srv/tile.openstreetmap.org/html
   ScriptAlias /cgi-bin/ /srv/tile.openstreetmap.org/cgi-bin/
 
+  # Get the real remote IP for requests via a trusted proxy
+  RemoteIPHeader Fastly-Client-IP
+<% @fastly.sort.each do |address| -%>
+  RemoteIPTrustedProxy <%= address %>
+<% end -%>
+
   # Setup logging
   LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined_with_remoteip
   CustomLog /var/log/apache2/access.log combined_with_remoteip
@@ -41,6 +47,11 @@
   # Enable the rewrite engine
   RewriteEngine on
 
+  # Enforce rate limits
+  RewriteMap ipmap txt:/srv/tile.openstreetmap.org/conf/ip.map
+  RewriteCond ${ipmap:%{REMOTE_ADDR}} ^.+$
+  RewriteRule ^.*$ /${ipmap:%{REMOTE_ADDR}} [PT]
+
   # Rewrite tile requests to the default style
   RewriteRule ^/(\d+)/(\d+)/(\d+)\.png$ /default/$1/$2/$3.png [PT,T=image/png,L]
   RewriteRule ^/(\d+)/(\d+)/(\d+)\.png/status/?$  /default/$1/$2/$3.png/status [PT,T=text/plain,L]
@@ -54,35 +65,6 @@
   # Redirect ACME certificate challenges
   RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
 
-  # Restrict tile access to CDN nodes and admins
-  <LocationMatch ^/default/\d+/\d+/\d+\.png$>
-<% @fastly.sort.each do |address| -%>
-    Require ip <%= address %>
-<% end -%>
-<% @statuscake.sort.reject { |address| address.empty? }.each do |address| -%>
-    Require ip <%= address %>
-<% end -%>
-<% @admins.sort.each do |address| -%>
-    Require ip <%= address %>
-<% end -%>
-    Require ip 130.117.76.0/27
-    Require ip 2001:978:2:2C::/64
-    Require ip 184.104.226.96/27
-    Require ip 2001:470:1:b3b::/64
-    Require ip 193.60.236.0/24
-  </LocationMatch>
-
-  # Get the real remote IP for requests via a trusted proxy
-  RemoteIPHeader Fastly-Client-IP
-<% @fastly.sort.each do |address| -%>
-  RemoteIPTrustedProxy <%= address %>
-<% end -%>
-
-  # Enforce rate limits
-  RewriteMap ipmap txt:/srv/tile.openstreetmap.org/conf/ip.map
-  RewriteCond ${ipmap:%{REMOTE_ADDR}} ^.+$
-  RewriteRule ^.*$ /${ipmap:%{REMOTE_ADDR}} [PT]
-
   # Internal endpoint for blocked users
   <Location /blocked>
     Header always set Cache-Control private