X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/a6a40aaf96f0620bf8f4a6e9f01b44ff25d8307b..7108c794e6ce1a3ea78f3ac6ff8fd7ea3bdc62a3:/cookbooks/tile/templates/default/apache.erb diff --git a/cookbooks/tile/templates/default/apache.erb b/cookbooks/tile/templates/default/apache.erb index e43d62e51..f7cba541b 100644 --- a/cookbooks/tile/templates/default/apache.erb +++ b/cookbooks/tile/templates/default/apache.erb @@ -20,7 +20,7 @@ ScriptAlias /cgi-bin/ /srv/tile.openstreetmap.org/cgi-bin/ # Get the real remote IP for requests via a trusted proxy - RemoteIPHeader X-Forwarded-For + RemoteIPHeader Fastly-Client-IP <% @fastly.sort.each do |address| -%> RemoteIPTrustedProxy <%= address %> <% end -%> @@ -47,6 +47,11 @@ # Enable the rewrite engine RewriteEngine on + # Enforce rate limits + RewriteMap ipmap txt:/srv/tile.openstreetmap.org/conf/ip.map + RewriteCond ${ipmap:%{REMOTE_ADDR}} ^.+$ + RewriteRule ^.*$ /${ipmap:%{REMOTE_ADDR}} [PT] + # Rewrite tile requests to the default style RewriteRule ^/(\d+)/(\d+)/(\d+)\.png$ /default/$1/$2/$3.png [PT,T=image/png,L] RewriteRule ^/(\d+)/(\d+)/(\d+)\.png/status/?$ /default/$1/$2/$3.png/status [PT,T=text/plain,L] @@ -59,6 +64,12 @@ # Redirect ACME certificate challenges RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/ + + # Internal endpoint for blocked users + + Header always set Cache-Control private + Redirect 429 +