From: Grant Slater <git@firefishy.com>
Date: Mon, 2 Jan 2017 20:25:57 +0000 (+0000)
Subject: tilecache: generate nginx QoS maps
X-Git-Url: https://git.openstreetmap.org./chef.git/commitdiff_plain/d79e2e45dbf37c1c3f5098479c9088ff28e57243

tilecache: generate nginx QoS maps
---

diff --git a/cookbooks/tilecache/templates/default/nginx_generate_tilecache_qos_map.erb b/cookbooks/tilecache/templates/default/nginx_generate_tilecache_qos_map.erb
new file mode 100755
index 000000000..c0ae1f0b6
--- /dev/null
+++ b/cookbooks/tilecache/templates/default/nginx_generate_tilecache_qos_map.erb
@@ -0,0 +1,42 @@
+#!/bin/bash
+# DO NOT EDIT - This file is being maintained by Chef
+
+set -e
+NUM_TOKENS=3 # current + 3
+VALID_TOKEN=3600 # in seconds
+QOS_TOKENS=($(/usr/bin/oathtool --totp --window=${NUM_TOKENS} --time-step-size=${VALID_TOKEN}s <%= tokens[:tilecache_oath_key] %>))
+
+# ${qos_tokens[3]/[-1] } = OSM.org exclusive / current
+# ${qos_tokens[2]/[-2] } = tile.openstreetmap.org default
+# ${qos_tokens[1]/[-3] } = stale ~ 1 hour
+# ${qos_tokens[0]} = expired
+
+# Test if number of tokens returned by oathtool is expected number
+if [ "${#QOS_TOKENS[@]}" -ne "$((${NUM_TOKENS}+1))" ]; then
+  >&2 echo "ERROR: Unexpected number of tokens"
+  exit 1
+fi
+
+QOS_TOKEN_OSM=${QOS_TOKENS[-1]} # Cookie set by openstreetmap.org
+QOS_TOKEN_DEFAULT=${QOS_TOKENS[-2]} # Cookie presented by tile.openstreetmap.org to browsers
+QOS_TOKEN_STALE=${QOS_TOKENS[-3]} # Cookie which has become stale and will be replaced
+
+if [ -z "$QOS_TOKEN_OSM" -o -z "$QOS_TOKEN_DEFAULT" -o -z "$QOS_TOKEN_STALE" ]; then
+  >&2 echo "ERROR: Unexpected blank token"
+  exit 2
+fi
+
+cat <<EOF >/etc/nginx/conf.d/tile_qos_rates.map
+default 4096; # Default Rate (No QoS cookie)
+"${QOS_TOKEN_STALE}" 16384; # Stale
+"${QOS_TOKEN_DEFAULT}" 24576; # Default
+"${QOS_TOKEN_OSM}" 32768; # Exclusive
+EOF
+
+cat <<EOF >/etc/nginx/conf.d/tile_qos_cookies.map
+default 'qos_token=${QOS_TOKEN_DEFAULT}; Secure; httponly; Max-Age=${VALID_TOKEN}; Domain=tile.openstreetmap.org; Path=/'; # Cookie Domain per RFC6265
+"${QOS_TOKEN_DEFAULT}" ''; # Do not Set-Cookie. # Default
+"${QOS_TOKEN_OSM}" ''; # Do not Set-Cookie. # Exclusive
+EOF
+
+/etc/init.d/nginx configtest && service nginx reload
diff --git a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb
index 6f3340a51..60d7d451f 100644
--- a/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb
+++ b/cookbooks/tilecache/templates/default/nginx_tile_ssl.conf.erb
@@ -1,3 +1,5 @@
+# DO NOT EDIT - This file is being maintained by Chef
+
 upstream tile_cache_backend {
     server 127.0.0.1;
     <% @caches.each do |cache| -%>
@@ -12,16 +14,14 @@ upstream tile_cache_backend {
     keepalive 32;
 }
 
-# Rates table based on cookie value
+# Rates table based on current cookie value
 map $cookie_qos_token $limit_rate_qos {
-  default 8192; # Default Rate
-  "test" 32768; # FIXME - Future TOTP Token
+  include /etc/nginx/conf.d/tile_qos_rates.map;
 }
 
+# Set-Cookie table based on current cookie value
 map $cookie_qos_token $cookie_qos_token_set {
-  # Cookie Domain per RFC 6265
-  default 'qos_token=test; Secure; httponly; Max-Age=3600; Domain=tile.openstreetmap.org; Path=/'; # FIXME - Future TOTP Token
-  "test" ''; # Do not Set-Cookie if current is valid
+  include /etc/nginx/conf.d/tile_qos_cookies.map;
 }
 
 map $http_user_agent $approved_scraper {