X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/9fd05da5f2fa4c8149cde8bb56dd9cb35d2f6784..19f8f66503a29673ef20dc47d9daa7b228e81c80:/cookbooks/imagery/resources/site.rb?ds=sidebyside diff --git a/cookbooks/imagery/resources/site.rb b/cookbooks/imagery/resources/site.rb index f81e95ad8..83926229a 100644 --- a/cookbooks/imagery/resources/site.rb +++ b/cookbooks/imagery/resources/site.rb @@ -27,6 +27,7 @@ property :site, String, :name_property => true property :title, String, :required => [:create] property :aliases, [String, Array], :default => [] property :bbox, Array, :required => [:create] +property :uses_tiler, [true, false], :default => false action :create do directory "/srv/#{new_resource.site}" do @@ -86,7 +87,7 @@ action :create do end layers = Dir.glob("/srv/imagery/layers/#{new_resource.site}/*.yml").collect do |path| - YAML.safe_load(::File.read(path), [Symbol]) + YAML.safe_load(::File.read(path), :permitted_classes => [Symbol]) end declare_resource :template, "/srv/#{new_resource.site}/imagery.js" do @@ -102,25 +103,18 @@ action :create do systemd_service "mapserv-fcgi-#{new_resource.site}" do description "Map server for #{new_resource.site} layer" - environment "MS_MAP_PATTERN" => "^/srv/imagery/mapserver/", - "MS_DEBUGLEVEL" => "0", + environment "MS_DEBUGLEVEL" => "0", "MS_ERRORFILE" => "stderr", "GDAL_CACHEMAX" => "512" limit_nofile 16384 - memory_high "1G" - memory_max "2G" user "imagery" group "imagery" - exec_start "/usr/bin/multiwatch -f 12 --signal=TERM -- /usr/lib/cgi-bin/mapserv" + exec_start "/usr/bin/multiwatch -f 8 --signal=TERM -- /usr/lib/cgi-bin/mapserv" standard_input "socket" - private_tmp true - private_devices true - private_network true - protect_system "full" - protect_home true - no_new_privileges true - # Terminate service after 5mins. Service is socket activated - runtime_max_sec 300 + sandbox true + restrict_address_families "AF_UNIX" + timeout_stop_sec 60 + not_if { new_resource.uses_tiler } end systemd_socket "mapserv-fcgi-#{new_resource.site}" do @@ -128,6 +122,7 @@ action :create do socket_user "imagery" socket_group "imagery" listen_stream "/run/mapserver-fastcgi/layer-#{new_resource.site}.socket" + not_if { new_resource.uses_tiler } end # Ensure service is stopped because otherwise the socket cannot reload @@ -136,11 +131,35 @@ action :create do action :nothing subscribes :stop, "systemd_service[mapserv-fcgi-#{new_resource.site}]" subscribes :stop, "systemd_socket[mapserv-fcgi-#{new_resource.site}]" + not_if { new_resource.uses_tiler } end systemd_unit "mapserv-fcgi-#{new_resource.site}.socket" do action [:enable, :start] subscribes :restart, "systemd_socket[mapserv-fcgi-#{new_resource.site}]" + not_if { new_resource.uses_tiler } + end + + # mapserver leaks memory, so restart it regularly. It is activated automatically by socket + systemd_service "mapserv-fcgi-#{new_resource.site}-stop" do + type "simple" + user "root" + exec_start "/bin/systemctl --quiet stop mapserv-fcgi-#{new_resource.site}.service" + sandbox true + restrict_address_families "AF_UNIX" + not_if { new_resource.uses_tiler } + end + + systemd_timer "mapserv-fcgi-#{new_resource.site}-stop" do + on_boot_sec "10m" + on_unit_inactive_sec "1h" + randomized_delay_sec "30m" + not_if { new_resource.uses_tiler } + end + + service "mapserv-fcgi-#{new_resource.site}-stop.timer" do + action [:enable, :start] + not_if { new_resource.uses_tiler } end ssl_certificate new_resource.site do @@ -158,10 +177,12 @@ action :delete do service "mapserv-fcgi-#{new_resource.site}" do provider Chef::Provider::Service::Systemd action [:stop, :disable] + not_if { new_resource.uses_tiler } end systemd_service "mapserv-fcgi-#{new_resource.site}" do action :delete + not_if { new_resource.uses_tiler } end nginx_site new_resource.site do