Use same http options as tile servers, i.a. enable http2

[chef.git] / cookbooks / planet / templates / default / apache.erb

diff --git a/cookbooks/planet/templates/default/apache.erb b/cookbooks/planet/templates/default/apache.erb
index ef2834fd811172a0b6559a3c56aa3c69ba43625c..6ad68703a8f2eca2f7e81ef50df936e71cc106fd 100644 (file)
--- a/cookbooks/planet/templates/default/apache.erb
+++ b/cookbooks/planet/templates/default/apache.erb
@@ -1,6 +1,6 @@
 # DO NOT EDIT - This file is being maintained by Chef
 
 # DO NOT EDIT - This file is being maintained by Chef
 

-<VirtualHost *:80>
+<VirtualHost *:443>

         ServerName planet.openstreetmap.org
         ServerAlias planet.osm.org
         ServerAdmin webmaster@openstreetmap.org
         ServerName planet.openstreetmap.org
         ServerAlias planet.osm.org
         ServerAdmin webmaster@openstreetmap.org


@@ -8,6 +8,10 @@
         CustomLog /var/log/apache2/planet.openstreetmap.org-access.log combined
         ErrorLog /var/log/apache2/planet.openstreetmap.org-error.log
 
         CustomLog /var/log/apache2/planet.openstreetmap.org-access.log combined
         ErrorLog /var/log/apache2/planet.openstreetmap.org-error.log
 

+        SSLEngine on
+        SSLCertificateFile /etc/ssl/certs/planet.openstreetmap.org.pem
+        SSLCertificateKeyFile /etc/ssl/private/planet.openstreetmap.org.key
+

         DocumentRoot /store/planet
 
         <Directory /store/planet>
         DocumentRoot /store/planet
 
         <Directory /store/planet>


@@ -25,46 +29,57 @@
         ProxyPass /replication/streaming http://127.0.0.1:8080
 
         <Location /replication/steaming>
         ProxyPass /replication/streaming http://127.0.0.1:8080
 
         <Location /replication/steaming>

-                Order deny,allow
-                Allow from all
+                Require all granted

         </Location>
 
         Redirect /pbf-experimental/    /pbf/
 
         </Location>
 
         Redirect /pbf-experimental/    /pbf/
 

-       <IfModule mod_headers.c>
-               Header set Access-Control-Allow-Origin "*"
-       </IfModule>
+        <IfModule mod_headers.c>
+                Header set Access-Control-Allow-Origin "*"
+        </IfModule>

 
         RewriteEngine on
         RewriteMap latestplanet prg:/usr/local/bin/apache-latest-planet-filename
 
         #Direct, no redirect for the following
 
         RewriteEngine on
         RewriteMap latestplanet prg:/usr/local/bin/apache-latest-planet-filename
 
         #Direct, no redirect for the following

-        RewriteCond    %{REMOTE_ADDR}  ^193\.63\.              [OR]
-        RewriteCond    %{REMOTE_ADDR}  ^127\.                  [OR]
-        RewriteCond    %{REMOTE_ADDR}  ^10\.                   [OR]
-        RewriteCond    %{REMOTE_ADDR}  ^193\.1\.219\.88        [OR]
-        RewriteCond    %{REMOTE_ADDR}  ^193\.1\.193\.64        [OR]
-        RewriteCond     %{REMOTE_ADDR}  ^146\.169\.             [OR]
-        RewriteCond     %{REMOTE_ADDR}  ^129\.31\.              [OR]
-       RewriteCond     %{REMOTE_ADDR}  ^193\.60\.              [OR]
-       RewriteCond     %{REMOTE_ADDR}  ^193\.61\.              [OR]
-       RewriteCond     %{REMOTE_ADDR}  ^193\.62\.              [OR]
-       RewriteCond     %{REMOTE_ADDR}  ^193\.63\.              [OR]
-        RewriteCond    %{QUERY_STRING} nomirror
+        RewriteCond %{REMOTE_ADDR}  ^127\.                          [OR]
+        RewriteCond %{REMOTE_ADDR}  ^10\.                             [OR]
+        RewriteCond %{REMOTE_ADDR}  ^193\.60\.       [OR]
+        RewriteCond %{REMOTE_ADDR}  ^193\.61\.       [OR]
+        RewriteCond %{REMOTE_ADDR}  ^193\.62\.       [OR]
+        RewriteCond %{REMOTE_ADDR}  ^193\.63\.       [OR]
+        RewriteCond %{QUERY_STRING} nomirror

         RewriteRule    .*      - [L]
 
         RewriteRule    .*      - [L]
 

-        RewriteRule     ^(/planet/planet\-latest\.osm\.bz2)$    ${latestplanet:$1}      [R,L]
+        RewriteRule ^(/planet/planet\-latest\.osm\.bz2)$                ${latestplanet:$1} [R,L]
+        RewriteRule ^(/planet/full\-history/history\-latest\.osm\.bz2)$ ${latestplanet:$1} [R,L]
+        RewriteRule ^(/planet/changesets\-latest\.osm\.bz2)$            ${latestplanet:$1} [R,L]
+        RewriteRule ^(/planet/discussions\-latest\.osm\.bz2)$           ${latestplanet:$1} [R,L]
+
+        RewriteRule ^(/pbf/planet\-latest\.osm\.pbf)$                   ${latestplanet:$1} [R,L]
+        RewriteRule ^(/pbf/full\-history/history\-latest\.osm\.pbf)$    ${latestplanet:$1} [R,L]
+
+        RewriteRule ^(/cc\-by\-sa/pbf/planet\-latest\.osm\.pbf)$        ${latestplanet:$1} [R,L]
+        RewriteRule ^(/cc\-by\-sa/planet\-latest\.osm\.bz2)$            ${latestplanet:$1} [R,L]
+        RewriteRule ^(/cc\-by\-sa/changesets\-latest\.osm\.bz2)$        ${latestplanet:$1} [R,L]
+        RewriteRule ^(/cc\-by\-sa/relations\-latest\.osm\.bz2)$         ${latestplanet:$1} [R,L]
+
+        # Temporary download rate limit due to upstream fibre connection issues. - 13 Jan 2020
+        <FilesMatch ".+\.(7z|bz2|gz|pbf|tgz|xz)$">
+          SetOutputFilter RATE_LIMIT
+          SetEnv rate-limit 2048
+          SetEnv rate-initial-burst 4096
+        </FilesMatch>

 </VirtualHost>
 
 </VirtualHost>
 

-<VirtualHost *:443>
+<VirtualHost *:80>

         ServerName planet.openstreetmap.org
         ServerAlias planet.osm.org
         ServerAdmin webmaster@openstreetmap.org
 
         ServerName planet.openstreetmap.org
         ServerAlias planet.osm.org
         ServerAdmin webmaster@openstreetmap.org
 

-        SSLEngine on
-

         CustomLog /var/log/apache2/planet.openstreetmap.org-access.log combined
         ErrorLog /var/log/apache2/planet.openstreetmap.org-error.log
 
         CustomLog /var/log/apache2/planet.openstreetmap.org-access.log combined
         ErrorLog /var/log/apache2/planet.openstreetmap.org-error.log
 

-        Redirect / http://planet.openstreetmap.org/
+        RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
+        RedirectPermanent / https://planet.openstreetmap.org/

 </VirtualHost>
 </VirtualHost>