From 8593050ae6de42adadb959f976693ea3a0f1278f Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Tue, 23 Jun 2020 19:22:29 +0100 Subject: [PATCH] Disable TLSv1.3 for upstream connections from squid on Ubuntu 20.04 --- cookbooks/tilecache/templates/default/squid.conf.erb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/cookbooks/tilecache/templates/default/squid.conf.erb b/cookbooks/tilecache/templates/default/squid.conf.erb index 55415a4ac..02b266a50 100644 --- a/cookbooks/tilecache/templates/default/squid.conf.erb +++ b/cookbooks/tilecache/templates/default/squid.conf.erb @@ -38,8 +38,10 @@ acl tile_caches src <%= address %> # Primary Parent <% if node[:squid][:version] < 4 -%> cache_peer <%= node[:tilecache][:tile_parent] %> parent 443 0 no-query originserver name=osmtileAccel login=PASS connect-timeout=120 no-digest weight=1000 ssl ssldomain=render.openstreetmap.org -<% else -%> +<% elif node[:lsb][:release].to_f < 20.04 -%> cache_peer <%= node[:tilecache][:tile_parent] %> parent 443 0 no-query originserver name=osmtileAccel login=PASS connect-timeout=120 no-digest weight=1000 tls tlsdomain=render.openstreetmap.org +<% else -%> +cache_peer <%= node[:tilecache][:tile_parent] %> parent 443 0 no-query originserver name=osmtileAccel login=PASS connect-timeout=120 no-digest weight=1000 tls tlsdomain=render.openstreetmap.org tls-options=NORMAL:-VERS-TLS1.3 <% end -%> cache_peer_access osmtileAccel allow osmtile_sites @@ -47,8 +49,10 @@ cache_peer_access osmtileAccel allow osmtile_sites <% @renders.each do |renders| -%> <% if node[:squid][:version] < 4 -%> cache_peer <%= renders[:hostname] %>.render.openstreetmap.org parent 443 0 no-query originserver name=osmtileAccelBackup<%= renders[:hostname] %> login=PASS connect-timeout=60 no-digest weight=10 ssl ssldomain=render.openstreetmap.org -<% else -%> +<% elif node[:lsb][:release].to_f < 20.04 -%> cache_peer <%= renders[:hostname] %>.render.openstreetmap.org parent 443 0 no-query originserver name=osmtileAccelBackup<%= renders[:hostname] %> login=PASS connect-timeout=60 no-digest weight=10 tls tlsdomain=render.openstreetmap.org +<% else -%> +cache_peer <%= renders[:hostname] %>.render.openstreetmap.org parent 443 0 no-query originserver name=osmtileAccelBackup<%= renders[:hostname] %> login=PASS connect-timeout=60 no-digest weight=10 tls tlsdomain=render.openstreetmap.org tls-options=NORMAL:-VERS-TLS1.3 <% end -%> cache_peer_access osmtileAccelBackup<%= renders[:hostname] %> allow osmtile_sites <% end -%> -- 2.39.5