From e29e45b6cf7d91f3349a22b41e6ee5b23887e922 Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Thu, 30 May 2019 18:55:38 +0100
Subject: [PATCH 1/1] Configure shared TCP fastopen keys for tile and www

---
 cookbooks/networking/recipes/default.rb | 11 +++++++++++
 roles/tilecache.rb                      |  3 +++
 roles/web-frontend.rb                   |  3 +++
 3 files changed, 17 insertions(+)

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index 822f9042f..8b6b1f35f 100644
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -198,6 +198,17 @@ template "/etc/systemd/resolved.conf.d/99-chef.conf" do
   notifies :restart, "service[systemd-resolved]"
 end
 
+if node[:networking][:tcp_fastopen_key]
+  fastopen_keys = data_bag_item("networking", "fastopen")
+
+  node.normal[:sysctl][:tcp_fastopen] = {
+    :comment => "Set shared key for TCP fast open",
+    :parameters => {
+      "net.ipv4.tcp_fastopen_key" => fastopen_keys[node[:networking][:tcp_fastopen_key]]
+    }
+  }
+end
+
 node.interfaces(:role => :internal) do |interface|
   if interface[:gateway] && interface[:gateway] != interface[:address]
     search(:node, "networking_interfaces*address:#{interface[:gateway]}") do |gateway|
diff --git a/roles/tilecache.rb b/roles/tilecache.rb
index e2cad2518..a2e595f3b 100644
--- a/roles/tilecache.rb
+++ b/roles/tilecache.rb
@@ -12,6 +12,9 @@ default_attributes(
   :apt => {
     :sources => ["nginx"]
   },
+  :networking => {
+    :tcp_fastopen_key => "tile"
+  },
   :nginx => {
     :access_log => false
   },
diff --git a/roles/web-frontend.rb b/roles/web-frontend.rb
index 5010e555d..741a40b90 100644
--- a/roles/web-frontend.rb
+++ b/roles/web-frontend.rb
@@ -21,6 +21,9 @@ default_attributes(
       ]
     }
   },
+  :networking => {
+    :tcp_fastopen_key => "www"
+  },
   :passenger => {
     :max_pool_size => 50
   },
-- 
2.43.2