#
-# Cookbook Name:: tilecache
+# Cookbook:: tilecache
# Recipe:: default
#
-# Copyright 2011, OpenStreetMap Foundation
+# Copyright:: 2011, OpenStreetMap Foundation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
-# http://www.apache.org/licenses/LICENSE-2.0
+# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
require "ipaddr"
-certificate = node[:tilecache][:ssl][:certificate]
-node.default[:ssl][:certificates] = node[:ssl][:certificates] | [certificate]
-
-include_recipe "ssl"
-include_recipe "squid"
+include_recipe "fail2ban"
+include_recipe "munin"
include_recipe "nginx"
+include_recipe "squid"
+include_recipe "ssl"
package "apache2" do
action :remove
end
-package "xz-utils"
-package "openssl"
+package %w[
+ curl
+ xz-utils
+ openssl
+]
# oathtool for QoS token
package "oathtool"
tilecaches = search(:node, "roles:tilecache").sort_by { |n| n[:hostname] }
tilerenders = search(:node, "roles:tile").sort_by { |n| n[:hostname] }
-tilecache_tokens = data_bag_item("tilecache", "tokens")
+web_passwords = data_bag_item("web", "passwords")
tilecaches.each do |cache|
cache.ipaddresses(:family => :inet, :role => :external).sort.each do |address|
dest_ports "3128"
source_ports "1024:"
end
+
firewall_rule "accept-squid-icp" do
action :accept
family "inet"
dest_ports "3130"
source_ports "3130"
end
+
firewall_rule "accept-squid-icp-reply" do
action :accept
family "inet"
dest_ports "3130"
source_ports "3130"
end
+
+ firewall_rule "accept-squid-htcp" do
+ action :accept
+ family "inet"
+ source "net:#{address}"
+ dest "fw"
+ proto "udp"
+ dest_ports "4827"
+ source_ports "4827"
+ end
+
+ firewall_rule "accept-squid-htcp-reply" do
+ action :accept
+ family "inet"
+ source "fw"
+ dest "net:#{address}"
+ proto "udp"
+ dest_ports "4827"
+ source_ports "4827"
+ end
end
end
variables :caches => tilecaches, :renders => tilerenders
end
+package "rsync"
+
template "/etc/logrotate.d/squid" do
source "logrotate.squid.erb"
owner "root"
group "root"
- mode 0o644
+ mode "644"
end
nginx_site "default" do
action [:delete]
end
-resolvers = node[:networking][:nameservers].map do |resolver|
- IPAddr.new(resolver).ipv6? ? "[#{resolver}]" : resolver
-end
-
-nginx_site "tile-ssl" do
- template "nginx_tile_ssl.conf.erb"
- variables :certificate => certificate, :resolvers => resolvers, :caches => tilecaches
-end
-
template "/usr/local/bin/nginx_generate_tilecache_qos_map" do
source "nginx_generate_tilecache_qos_map.erb"
owner "root"
group "root"
- mode 0o750
- variables :tokens => tilecache_tokens
+ mode "750"
+ variables :totp_key => web_passwords["totp_key"]
end
-template "/etc/cron.d/tilecache" do
- source "cron.erb"
- owner "root"
- group "root"
- mode 0o644
+cron_d "tilecache" do
+ action :delete
+end
+
+cron_d "tilecache-generate-qos-map" do
+ minute "0"
+ user "root"
+ command "/usr/local/bin/nginx_generate_tilecache_qos_map"
+end
+
+cron_d "tilecache-curl-time" do
+ user "www-data"
+ command "/srv/tilecache/tilecache-curl-time"
+end
+
+cron_d "tilecache-curl-time-cleanup" do
+ minute "15"
+ hour "0"
+ user "www-data"
+ command "/srv/tilecache/tilecache-curl-time-cleanup"
end
execute "execute_nginx_generate_tilecache_qos_map" do
action :run
end
-service "nginx-certificate-restart" do
- service_name "nginx"
- action :nothing
- subscribes :restart, "cookbook_file[/etc/ssl/certs/rapidssl.pem]"
- subscribes :restart, "file[/etc/ssl/certs/#{certificate}.pem]"
- subscribes :restart, "file[/etc/ssl/private/#{certificate}.key]"
+ssl_certificate "tile.openstreetmap.org" do
+ domains ["tile.openstreetmap.org",
+ "a.tile.openstreetmap.org",
+ "b.tile.openstreetmap.org",
+ "c.tile.openstreetmap.org",
+ "tile.osm.org",
+ "a.tile.osm.org",
+ "b.tile.osm.org",
+ "c.tile.osm.org"]
+ notifies :restart, "service[nginx]"
+end
+
+nginx_site "tile" do
+ template "nginx_tile.conf.erb"
+ variables :caches => tilecaches
end
template "/etc/logrotate.d/nginx" do
source "logrotate.nginx.erb"
owner "root"
group "root"
- mode 0o644
+ mode "644"
+end
+
+fail2ban_jail "squid" do
+ maxretry 1000
end
tilerenders.each do |render|
conf_variables :host => render[:fqdn]
end
end
+
+directory "/srv/tilecache" do
+ owner "root"
+ group "root"
+ mode "755"
+end
+
+directory "/srv/tilecache/data" do
+ owner "www-data"
+ group "www-data"
+ mode "755"
+end
+
+cookbook_file "/srv/tilecache/tilecache-curl-time.txt" do
+ source "tilecache-curl-time.txt"
+ owner "root"
+ group "root"
+ mode "755"
+end
+
+template "/srv/tilecache/tilecache-curl-time" do
+ source "tilecache-curl-time.erb"
+ owner "root"
+ group "root"
+ mode "755"
+ variables :caches => tilecaches, :renders => tilerenders
+end
+
+template "/srv/tilecache/tilecache-curl-time-cleanup" do
+ source "tilecache-curl-time-cleanup.erb"
+ owner "root"
+ group "root"
+ mode "755"
+end
+
+ohai_plugin "tilecache" do
+ template "ohai.rb.erb"
+end
projects / chef.git / blobdiff