X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/926b39e016afc77a6b8ea32c37273c7a6fca5467..98ecb8199d04234e3db39ec751aa7b342fcc93c1:/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb?ds=inline diff --git a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb index 60059837b..7f01c3fc8 100644 --- a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb +++ b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb @@ -1,5 +1,19 @@ +upstream tile_cache_backend { + server 127.0.0.1; + <% @caches.each do |cache| -%> + <% if cache[:hostname] != node[:hostname] -%> + #Server <%= cache[:hostname] %> + <% cache.ipaddresses(:family => :inet, :role => :external).sort.each do |address| -%> + server <%= address %> backup; + <% end -%> + <% end -%> + <% end -%> + + keepalive 32; +} + server { - listen 443 ssl spdy; + listen 443 ssl default_server; server_name localhost; proxy_buffers 8 64k; @@ -7,13 +21,19 @@ server { ssl_certificate /etc/ssl/certs/<%= @certificate %>.pem; ssl_certificate_key /etc/ssl/private/<%= @certificate %>.key; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2 SSLv3; - ssl_ciphers aRSA+HIGH:+kEDH:+kRSA:!kSRP:!kPSK:+3DES:!MD5; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers <%= node[:ssl][:ciphers] -%>; ssl_prefer_server_ciphers on; - ssl_session_cache shared:SSL:30m; - ssl_session_timeout 15m; + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 30m; ssl_stapling on; + ssl_dhparam /etc/ssl/certs/dhparam.pem; resolver <%= @resolvers.join(" ") %>; - location / { proxy_pass http://127.0.0.1; proxy_set_header X-Forwarded-For $remote_addr; } + location / { + proxy_pass http://tile_cache_backend; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_http_version 1.1; + proxy_set_header Connection ""; + } }