X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/a48d3c6dbc350bfb430691dbc128ff06ad8f979a..2cd6e46b17e386dd4c48b4d78d6ca360c998c640:/cookbooks/tile/templates/default/apache.erb diff --git a/cookbooks/tile/templates/default/apache.erb b/cookbooks/tile/templates/default/apache.erb index 182b590e5..f7cba541b 100644 --- a/cookbooks/tile/templates/default/apache.erb +++ b/cookbooks/tile/templates/default/apache.erb @@ -20,11 +20,9 @@ ScriptAlias /cgi-bin/ /srv/tile.openstreetmap.org/cgi-bin/ # Get the real remote IP for requests via a trusted proxy - RemoteIPHeader X-Forwarded-For -<% @caches.each do |cache| -%> -<% cache.ipaddresses(:role => :external).sort.each do |address| -%> + RemoteIPHeader Fastly-Client-IP +<% @fastly.sort.each do |address| -%> RemoteIPTrustedProxy <%= address %> -<% end -%> <% end -%> # Setup logging @@ -49,18 +47,29 @@ # Enable the rewrite engine RewriteEngine on + # Enforce rate limits + RewriteMap ipmap txt:/srv/tile.openstreetmap.org/conf/ip.map + RewriteCond ${ipmap:%{REMOTE_ADDR}} ^.+$ + RewriteRule ^.*$ /${ipmap:%{REMOTE_ADDR}} [PT] + # Rewrite tile requests to the default style RewriteRule ^/(\d+)/(\d+)/(\d+)\.png$ /default/$1/$2/$3.png [PT,T=image/png,L] RewriteRule ^/(\d+)/(\d+)/(\d+)\.png/status/?$ /default/$1/$2/$3.png/status [PT,T=text/plain,L] RewriteRule ^/(\d+)/(\d+)/(\d+)\.png/dirty/?$ /default/$1/$2/$3.png/dirty [PT,T=text/plain,L] # Historical Files redirect - RedirectPermanent /processed_p.tar.bz2 https://planet.openstreetmap.org/historical-shapefiles/processed_p.tar.bz2 - RedirectPermanent /shoreline_300.tar.bz2 https://planet.openstreetmap.org/historical-shapefiles/shoreline_300.tar.bz2 - RedirectPermanent /world_boundaries-spherical.tgz https://planet.openstreetmap.org/historical-shapefiles/world_boundaries-spherical.tgz + RedirectPermanent /processed_p.tar.bz2 https://planet.openstreetmap.org/historical-shapefiles/ + RedirectPermanent /shoreline_300.tar.bz2 https://planet.openstreetmap.org/historical-shapefiles/ + RedirectPermanent /world_boundaries-spherical.tgz https://planet.openstreetmap.org/historical-shapefiles/ # Redirect ACME certificate challenges RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/ + + # Internal endpoint for blocked users + + Header always set Cache-Control private + Redirect 429 + @@ -70,14 +79,6 @@ ServerAlias render.openstreetmap.org ServerAdmin webmaster@openstreetmap.org - # Get the real remote IP for requests via a trusted proxy - RemoteIPHeader X-Forwarded-For -<% @caches.each do |cache| -%> -<% cache.ipaddresses(:role => :external).sort.each do |address| -%> - RemoteIPTrustedProxy <%= address %> -<% end -%> -<% end -%> - # Setup logging LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined_with_remoteip CustomLog /var/log/apache2/access.log combined_with_remoteip