X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/37ad8f9cc2cc71005fbfc4046fe47c99c577b500..901782e5452c232c7e6f644f2c56a3903b09edf3:/cookbooks/tilecache/recipes/default.rb?ds=sidebyside diff --git a/cookbooks/tilecache/recipes/default.rb b/cookbooks/tilecache/recipes/default.rb index 5c1cdba3c..f1bab2e57 100644 --- a/cookbooks/tilecache/recipes/default.rb +++ b/cookbooks/tilecache/recipes/default.rb @@ -1,8 +1,8 @@ # -# Cookbook Name:: tilecache +# Cookbook:: tilecache # Recipe:: default # -# Copyright 2011, OpenStreetMap Foundation +# Copyright:: 2011, OpenStreetMap Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -19,9 +19,11 @@ require "ipaddr" -include_recipe "ssl" -include_recipe "squid" +include_recipe "fail2ban" +include_recipe "munin" include_recipe "nginx" +include_recipe "squid" +include_recipe "ssl" package "apache2" do action :remove @@ -51,6 +53,7 @@ tilecaches.each do |cache| dest_ports "3128" source_ports "1024:" end + firewall_rule "accept-squid-icp" do action :accept family "inet" @@ -60,6 +63,7 @@ tilecaches.each do |cache| dest_ports "3130" source_ports "3130" end + firewall_rule "accept-squid-icp-reply" do action :accept family "inet" @@ -69,6 +73,26 @@ tilecaches.each do |cache| dest_ports "3130" source_ports "3130" end + + firewall_rule "accept-squid-htcp" do + action :accept + family "inet" + source "net:#{address}" + dest "fw" + proto "udp" + dest_ports "4827" + source_ports "4827" + end + + firewall_rule "accept-squid-htcp-reply" do + action :accept + family "inet" + source "fw" + dest "net:#{address}" + proto "udp" + dest_ports "4827" + source_ports "4827" + end end end @@ -77,6 +101,8 @@ squid_fragment "tilecache" do variables :caches => tilecaches, :renders => tilerenders end +package "rsync" + template "/etc/logrotate.d/squid" do source "logrotate.squid.erb" owner "root" @@ -113,7 +139,11 @@ ssl_certificate "tile.openstreetmap.org" do domains ["tile.openstreetmap.org", "a.tile.openstreetmap.org", "b.tile.openstreetmap.org", - "c.tile.openstreetmap.org"] + "c.tile.openstreetmap.org", + "tile.osm.org", + "a.tile.osm.org", + "b.tile.osm.org", + "c.tile.osm.org"] notifies :restart, "service[nginx]" end @@ -129,6 +159,10 @@ template "/etc/logrotate.d/nginx" do mode 0o644 end +fail2ban_jail "squid" do + maxretry 1000 +end + tilerenders.each do |render| munin_plugin "ping_#{render[:fqdn]}" do target "ping_" @@ -136,7 +170,3 @@ tilerenders.each do |render| conf_variables :host => render[:fqdn] end end - -Dir.glob("/var/log/nginx/access.log*") do |log| - File.unlink(log) -end