X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/cb9f25913c9199b6daa6a9985ac109e4fd35dbf8..f1fd88c6c91dc9119d630bd48eb02c90ebb41e09:/cookbooks/tilecache/templates/default/nginx_tile.conf.erb?ds=sidebyside

diff --git a/cookbooks/tilecache/templates/default/nginx_tile.conf.erb b/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
index 4c99dfb0e..7e6ff1062 100644
--- a/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
+++ b/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
@@ -7,10 +7,12 @@ upstream tile_cache_backend {
   # Balancer: round-robin
 <% @caches.each do |cache| -%>
 <% if cache[:hostname] != node[:hostname] -%>
+<% if node[:tilecache][:tile_siblings].include? cache[:fqdn] -%>
 <% cache.ipaddresses(:family => :inet, :role => :external).sort.each do |address| -%>
   server <%= address %> backup; # Server <%= cache[:hostname] %>
 <% end -%>
 <% end -%>
+<% end -%>
 <% end -%>
 
   keepalive 256;
@@ -44,8 +46,10 @@ map $http_user_agent $approved_scraper {
 
 map $http_user_agent $denied_scraper {
   default                0; # Not denied
+  ''                     1; # No User-Agent Set
   '~^Python\-urllib\/'   1; # Library Default
   '~^python\-requests\/' 1; # Library Default
+  '~^node\-fetch\/'      1; # Library Default
   '~^R$'                 1; # Library Default
   '~^Java\/'             1; # Library Default
   '~^tiles$'             1; # Library Default
@@ -82,7 +86,7 @@ map $http_user_agent $limit_http_pragma {
 }
 
 server {
-    listen       443 ssl fastopen=2048 http2 default_server;
+    listen       443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
     server_name  localhost;
 
     proxy_buffers 8 64k;
@@ -90,13 +94,79 @@ server {
     ssl_certificate      /etc/ssl/certs/tile.openstreetmap.org.pem;
     ssl_certificate_key  /etc/ssl/private/tile.openstreetmap.org.key;
 
+    # Immediately 404 layers we do not support
+<% for i in 20..99 do %>
+    location /<%= i %>/ {
+      set $limit_rate 512;
+      return 404;
+    }
+<% end %>
+
+    # Immediately 404 silly tile requests
+    location = /0/0/-1.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /1/0/-1.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /1/-1/0.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /1/-1/1.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /1/-1/-1.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /1/-1/2.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /1/1/-1.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /1/2/-1.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /2/0/-1.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /2/-1/0.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /2/-1/1.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /2/1/-1.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /2/-1/2.png {
+      set $limit_rate 512;
+      return 404;
+    }
+    location = /2/-1/3.png {
+      set $limit_rate 512;
+      return 404;
+    }
+
     location / {
       proxy_pass http://tile_cache_backend;
       proxy_set_header X-Forwarded-For $remote_addr;
       proxy_http_version 1.1;
       proxy_set_header Connection '';
 
-      proxy_connect_timeout 10s;
+      proxy_connect_timeout 5s;
 
       # Preserve host header.
       proxy_set_header Host $host;