X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/09427e939f8dae89b524ebc2c8037c74fa22969c..9f7bd649654a83e58e87f4d3605f7097abeb42fb:/cookbooks/tilecache/recipes/default.rb?ds=inline diff --git a/cookbooks/tilecache/recipes/default.rb b/cookbooks/tilecache/recipes/default.rb index 53b5abb42..16a8af1be 100644 --- a/cookbooks/tilecache/recipes/default.rb +++ b/cookbooks/tilecache/recipes/default.rb @@ -1,14 +1,14 @@ # -# Cookbook Name:: tilecache +# Cookbook:: tilecache # Recipe:: default # -# Copyright 2011, OpenStreetMap Foundation +# Copyright:: 2011, OpenStreetMap Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # -# http://www.apache.org/licenses/LICENSE-2.0 +# https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, @@ -17,14 +17,32 @@ # limitations under the License. # -node.default[:ssl][:certificates] = node[:ssl][:certificates] | [ "tile.openstreetmap" ] +require "ipaddr" -include_recipe "ssl" +include_recipe "fail2ban" +include_recipe "munin" +include_recipe "nginx" include_recipe "squid" +include_recipe "ssl" + +package "apache2" do + action :remove +end + +package %w[ + curl + xz-utils + openssl +] + +# oathtool for QoS token +package "oathtool" tilecaches = search(:node, "roles:tilecache").sort_by { |n| n[:hostname] } tilerenders = search(:node, "roles:tile").sort_by { |n| n[:hostname] } +web_passwords = data_bag_item("web", "passwords") + tilecaches.each do |cache| cache.ipaddresses(:family => :inet, :role => :external).sort.each do |address| firewall_rule "accept-squid" do @@ -36,6 +54,7 @@ tilecaches.each do |cache| dest_ports "3128" source_ports "1024:" end + firewall_rule "accept-squid-icp" do action :accept family "inet" @@ -43,7 +62,37 @@ tilecaches.each do |cache| dest "fw" proto "udp" dest_ports "3130" - source_ports "1024:" + source_ports "3130" + end + + firewall_rule "accept-squid-icp-reply" do + action :accept + family "inet" + source "fw" + dest "net:#{address}" + proto "udp" + dest_ports "3130" + source_ports "3130" + end + + firewall_rule "accept-squid-htcp" do + action :accept + family "inet" + source "net:#{address}" + dest "fw" + proto "udp" + dest_ports "4827" + source_ports "4827" + end + + firewall_rule "accept-squid-htcp-reply" do + action :accept + family "inet" + source "fw" + dest "net:#{address}" + proto "udp" + dest_ports "4827" + source_ports "4827" end end end @@ -53,10 +102,114 @@ squid_fragment "tilecache" do variables :caches => tilecaches, :renders => tilerenders end +package "rsync" + template "/etc/logrotate.d/squid" do source "logrotate.squid.erb" owner "root" group "root" - mode 0644 + mode 0o644 +end + +nginx_site "default" do + action [:delete] +end + +template "/usr/local/bin/nginx_generate_tilecache_qos_map" do + source "nginx_generate_tilecache_qos_map.erb" + owner "root" + group "root" + mode 0o750 + variables :totp_key => web_passwords["totp_key"] +end + +template "/etc/cron.d/tilecache" do + source "cron.erb" + owner "root" + group "root" + mode 0o644 end +execute "execute_nginx_generate_tilecache_qos_map" do + command "/usr/local/bin/nginx_generate_tilecache_qos_map" + creates "/etc/nginx/conf.d/tile_qos_rates.map" + action :run +end + +ssl_certificate "tile.openstreetmap.org" do + domains ["tile.openstreetmap.org", + "a.tile.openstreetmap.org", + "b.tile.openstreetmap.org", + "c.tile.openstreetmap.org", + "tile.osm.org", + "a.tile.osm.org", + "b.tile.osm.org", + "c.tile.osm.org"] + notifies :restart, "service[nginx]" +end + +nginx_site "tile" do + template "nginx_tile.conf.erb" + variables :caches => tilecaches +end + +template "/etc/logrotate.d/nginx" do + source "logrotate.nginx.erb" + owner "root" + group "root" + mode 0o644 +end + +fail2ban_jail "squid" do + maxretry 1000 +end + +tilerenders.each do |render| + munin_plugin "ping_#{render[:fqdn]}" do + target "ping_" + conf "munin.ping.erb" + conf_variables :host => render[:fqdn] + end +end + +template "/etc/cron.d/tilecache" do + source "cron.erb" + owner "root" + group "root" + mode 0o644 +end + +directory "/srv/tilecache" do + owner "root" + group "root" + mode 0o755 +end + +directory "/srv/tilecache/data" do + owner "www-data" + group "www-data" + mode 0o755 +end + +cookbook_file "/srv/tilecache/tilecache-curl-time.txt" do + source "tilecache-curl-time.txt" + owner "root" + group "root" + mode 0o755 +end + +template "/srv/tilecache/tilecache-curl-time" do + source "tilecache-curl-time.erb" + owner "root" + group "root" + mode 0o755 + variables :caches => tilecaches, :renders => tilerenders +end + +file "/srv/tilecache/tilecache-fastest-peers" do + action :delete +end + +ohai_plugin "tilecache" do + template "ohai.rb.erb" +end