#
-# Cookbook Name:: tilecache
+# Cookbook:: tilecache
# Recipe:: default
#
-# Copyright 2011, OpenStreetMap Foundation
+# Copyright:: 2011, OpenStreetMap Foundation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
include_recipe "ssl"
include_recipe "squid"
include_recipe "nginx"
+include_recipe "fail2ban"
package "apache2" do
action :remove
dest_ports "3128"
source_ports "1024:"
end
+
firewall_rule "accept-squid-icp" do
action :accept
family "inet"
dest_ports "3130"
source_ports "3130"
end
+
firewall_rule "accept-squid-icp-reply" do
action :accept
family "inet"
dest_ports "3130"
source_ports "3130"
end
+
+ firewall_rule "accept-squid-htcp" do
+ action :accept
+ family "inet"
+ source "net:#{address}"
+ dest "fw"
+ proto "udp"
+ dest_ports "4827"
+ source_ports "4827"
+ end
+
+ firewall_rule "accept-squid-htcp-reply" do
+ action :accept
+ family "inet"
+ source "fw"
+ dest "net:#{address}"
+ proto "udp"
+ dest_ports "4827"
+ source_ports "4827"
+ end
end
end
variables :caches => tilecaches, :renders => tilerenders
end
+package "rsync"
+
template "/etc/logrotate.d/squid" do
source "logrotate.squid.erb"
owner "root"
mode 0o644
end
+# Configure cron with lower cpu and IO priority
+systemd_service "cron-load" do
+ service "cron"
+ dropin "load"
+ nice 19
+ io_scheduling_class "best-effort"
+ io_scheduling_priority 7
+ notifies :restart, "service[cron]"
+end
+
nginx_site "default" do
action [:delete]
end
domains ["tile.openstreetmap.org",
"a.tile.openstreetmap.org",
"b.tile.openstreetmap.org",
- "c.tile.openstreetmap.org"]
+ "c.tile.openstreetmap.org",
+ "tile.osm.org",
+ "a.tile.osm.org",
+ "b.tile.osm.org",
+ "c.tile.osm.org"]
notifies :restart, "service[nginx]"
end
-nginx_site "tile-ssl" do
- template "nginx_tile_ssl.conf.erb"
+nginx_site "tile" do
+ template "nginx_tile.conf.erb"
variables :caches => tilecaches
end
mode 0o644
end
+fail2ban_jail "squid" do
+ maxretry 1000
+end
+
tilerenders.each do |render|
munin_plugin "ping_#{render[:fqdn]}" do
target "ping_"
conf_variables :host => render[:fqdn]
end
end
-
-Dir.glob("/var/log/nginx/access.log*") do |log|
- File.unlink(log)
-end