X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/d5112ae724a15255983df81f9fda474c05925deb..9f7bd649654a83e58e87f4d3605f7097abeb42fb:/cookbooks/tilecache/recipes/default.rb?ds=sidebyside diff --git a/cookbooks/tilecache/recipes/default.rb b/cookbooks/tilecache/recipes/default.rb index c275edb66..16a8af1be 100644 --- a/cookbooks/tilecache/recipes/default.rb +++ b/cookbooks/tilecache/recipes/default.rb @@ -1,14 +1,14 @@ # -# Cookbook Name:: tilecache +# Cookbook:: tilecache # Recipe:: default # -# Copyright 2011, OpenStreetMap Foundation +# Copyright:: 2011, OpenStreetMap Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # -# http://www.apache.org/licenses/LICENSE-2.0 +# https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, @@ -19,16 +19,21 @@ require "ipaddr" -include_recipe "ssl" -include_recipe "squid" +include_recipe "fail2ban" +include_recipe "munin" include_recipe "nginx" +include_recipe "squid" +include_recipe "ssl" package "apache2" do action :remove end -package "xz-utils" -package "openssl" +package %w[ + curl + xz-utils + openssl +] # oathtool for QoS token package "oathtool" @@ -49,6 +54,7 @@ tilecaches.each do |cache| dest_ports "3128" source_ports "1024:" end + firewall_rule "accept-squid-icp" do action :accept family "inet" @@ -58,6 +64,7 @@ tilecaches.each do |cache| dest_ports "3130" source_ports "3130" end + firewall_rule "accept-squid-icp-reply" do action :accept family "inet" @@ -67,6 +74,26 @@ tilecaches.each do |cache| dest_ports "3130" source_ports "3130" end + + firewall_rule "accept-squid-htcp" do + action :accept + family "inet" + source "net:#{address}" + dest "fw" + proto "udp" + dest_ports "4827" + source_ports "4827" + end + + firewall_rule "accept-squid-htcp-reply" do + action :accept + family "inet" + source "fw" + dest "net:#{address}" + proto "udp" + dest_ports "4827" + source_ports "4827" + end end end @@ -75,6 +102,8 @@ squid_fragment "tilecache" do variables :caches => tilecaches, :renders => tilerenders end +package "rsync" + template "/etc/logrotate.d/squid" do source "logrotate.squid.erb" owner "root" @@ -86,10 +115,6 @@ nginx_site "default" do action [:delete] end -resolvers = node[:networking][:nameservers].map do |resolver| - IPAddr.new(resolver).ipv6? ? "[#{resolver}]" : resolver -end - template "/usr/local/bin/nginx_generate_tilecache_qos_map" do source "nginx_generate_tilecache_qos_map.erb" owner "root" @@ -115,14 +140,17 @@ ssl_certificate "tile.openstreetmap.org" do domains ["tile.openstreetmap.org", "a.tile.openstreetmap.org", "b.tile.openstreetmap.org", - "c.tile.openstreetmap.org"] - fallback_certificate "tile.openstreetmap" + "c.tile.openstreetmap.org", + "tile.osm.org", + "a.tile.osm.org", + "b.tile.osm.org", + "c.tile.osm.org"] notifies :restart, "service[nginx]" end -nginx_site "tile-ssl" do - template "nginx_tile_ssl.conf.erb" - variables :resolvers => resolvers, :caches => tilecaches +nginx_site "tile" do + template "nginx_tile.conf.erb" + variables :caches => tilecaches end template "/etc/logrotate.d/nginx" do @@ -132,6 +160,10 @@ template "/etc/logrotate.d/nginx" do mode 0o644 end +fail2ban_jail "squid" do + maxretry 1000 +end + tilerenders.each do |render| munin_plugin "ping_#{render[:fqdn]}" do target "ping_" @@ -139,3 +171,45 @@ tilerenders.each do |render| conf_variables :host => render[:fqdn] end end + +template "/etc/cron.d/tilecache" do + source "cron.erb" + owner "root" + group "root" + mode 0o644 +end + +directory "/srv/tilecache" do + owner "root" + group "root" + mode 0o755 +end + +directory "/srv/tilecache/data" do + owner "www-data" + group "www-data" + mode 0o755 +end + +cookbook_file "/srv/tilecache/tilecache-curl-time.txt" do + source "tilecache-curl-time.txt" + owner "root" + group "root" + mode 0o755 +end + +template "/srv/tilecache/tilecache-curl-time" do + source "tilecache-curl-time.erb" + owner "root" + group "root" + mode 0o755 + variables :caches => tilecaches, :renders => tilerenders +end + +file "/srv/tilecache/tilecache-fastest-peers" do + action :delete +end + +ohai_plugin "tilecache" do + template "ohai.rb.erb" +end