X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/38c8960ea8385b58b60492fc51da0e217d3275a8..32d0a85d5b8dd9f5787bd259d7092cc84fcb9615:/cookbooks/squid/recipes/default.rb?ds=inline diff --git a/cookbooks/squid/recipes/default.rb b/cookbooks/squid/recipes/default.rb index 917834eb2..e26ffe2dd 100644 --- a/cookbooks/squid/recipes/default.rb +++ b/cookbooks/squid/recipes/default.rb @@ -8,7 +8,7 @@ # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # -# http://www.apache.org/licenses/LICENSE-2.0 +# https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, @@ -17,6 +17,35 @@ # limitations under the License. # +if node[:squid][:version] == "3" + apt_package "squid" do + action :unlock + end + + apt_package "squid-common" do + action :unlock + end + + apt_package "squid" do + action :purge + only_if "dpkg-query -W squid | fgrep -q 2." + end + + apt_package "squid-common" do + action :purge + only_if "dpkg-query -W squid-common | fgrep -q 2." + end + + file "/store/squid/coss-01" do + action :delete + backup false + end + + package "squidclient" do + action :upgrade + end +end + package "squid" package "squidclient" @@ -27,29 +56,45 @@ template "/etc/squid/squid.conf" do mode 0o644 end -template "/etc/default/squid" do - source "squid.erb" - owner "root" - group "root" - mode 0o644 -end - directory "/etc/squid/squid.conf.d" do owner "root" group "root" mode 0o755 end +if node[:squid][:cache_dir] =~ /^coss (\S+) / + cache_dir = File.dirname(Regexp.last_match(1)) +elsif node[:squid][:cache_dir] =~ /^\S+ (\S+) / + cache_dir = Regexp.last_match(1) +end + +directory cache_dir do + owner "proxy" + group "proxy" + mode 0o750 + recursive true +end + +systemd_tmpfile "/var/run/squid" do + type "d" + owner "proxy" + group "proxy" + mode "0755" +end + systemd_service "squid" do description "Squid caching proxy" after ["network.target", "nss-lookup.target"] - limit_nofile 65536 - environment "SQUID_ARGS" => "-D" - environment_file "/etc/default/squid" - exec_start_pre "/usr/sbin/squid $SQUID_ARGS -z" - exec_start "/usr/sbin/squid -N $SQUID_ARGS" + type "forking" + limit_nofile 98304 + exec_start_pre "/usr/sbin/squid -N -z" + exec_start "/usr/sbin/squid -Y" exec_reload "/usr/sbin/squid -k reconfigure" exec_stop "/usr/sbin/squid -k shutdown" + private_tmp true + private_devices true + protect_system "full" + protect_home true restart "on-failure" timeout_sec 0 end @@ -57,11 +102,21 @@ end service "squid" do action [:enable, :start] subscribes :restart, "systemd_service[squid]" + subscribes :restart, "directory[#{cache_dir}]" subscribes :reload, "template[/etc/squid/squid.conf]" - subscribes :restart, "template[/etc/default/squid]" subscribes :reload, "template[/etc/resolv.conf]" end +log "squid-restart" do + message "Restarting squid due to counter wraparound" + notifies :restart, "service[squid]" + only_if do + IO.popen(["squidclient", "--host=127.0.0.1", "--port=80", "mgr:counters"]) do |io| + io.each.grep(/^[a-z][a-z_.]+ = -[0-9]+$/).count.positive? + end + end +end + munin_plugin "squid_cache" munin_plugin "squid_delay_pools" munin_plugin "squid_delay_pools_noreferer"