nftables: allow 169.254.169.0/24 and set log level to notice

[chef.git] / cookbooks / matomo / recipes / default.rb

diff --git a/cookbooks/matomo/recipes/default.rb b/cookbooks/matomo/recipes/default.rb
index 2bc613e13ffd4e2e046ea11db46554c6b82a75a2..5557d78d09a878067ca60e0f7a21fb1e928eef53 100644 (file)
--- a/cookbooks/matomo/recipes/default.rb
+++ b/cookbooks/matomo/recipes/default.rb
@@ -37,6 +37,8 @@ package %w[
 ]
 
 apache_module "expires"
+apache_module "proxy"
+apache_module "proxy_fcgi"
 apache_module "rewrite"
 
 version = node[:matomo][:version]
@@ -203,7 +205,8 @@ systemd_service "matomo-archive" do
   description "Matomo report archiving"
   exec_start "/usr/bin/php /srv/matomo.openstreetmap.org/console core:archive --url=https://matomo.openstreetmap.org/"
   user "www-data"
-  sandbox :enable_network => true
+  sandbox true
+  proc_subset "all"
   memory_deny_write_execute false
   restrict_address_families "AF_UNIX"
   read_write_paths "/opt/matomo-#{version}/matomo/tmp"
@@ -211,7 +214,8 @@ end
 
 systemd_timer "matomo-archive" do
   description "Matomo report archiving"
-  on_calendar "*:05"
+  on_boot_sec "30m"
+  on_unit_inactive_sec "30m"
 end
 
 service "matomo-archive.timer" do