From afc6ef7874e73bc70ef594aca9af58e2d3ce5466 Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Thu, 4 Aug 2022 19:45:44 +0100
Subject: [PATCH] Block requests for tiles unless they come from a CDN node

---
 cookbooks/tile/recipes/default.rb           | 13 ++++++++++++-
 cookbooks/tile/templates/default/apache.erb | 19 +++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/cookbooks/tile/recipes/default.rb b/cookbooks/tile/recipes/default.rb
index 4de4200bc..e8bef858c 100644
--- a/cookbooks/tile/recipes/default.rb
+++ b/cookbooks/tile/recipes/default.rb
@@ -29,6 +29,7 @@ include_recipe "ruby"
 include_recipe "tools"
 
 blocks = data_bag_item("tile", "blocks")
+admins = data_bag_item("apache", "admins")
 web_passwords = data_bag_item("web", "passwords")
 
 apache_module "alias"
@@ -59,6 +60,14 @@ end
 
 fastlyips = JSON.parse(IO.read("#{Chef::Config[:file_cache_path]}/fastly-ip-list.json"))
 
+remote_file "#{Chef::Config[:file_cache_path]}/statuscake-locations.json" do
+  source "https://app.statuscake.com/Workfloor/Locations.php?format=json"
+  compile_time true
+  ignore_failure true
+end
+
+statuscakelocations = JSON.parse(IO.read("#{Chef::Config[:file_cache_path]}/statuscake-locations.json"))
+
 apache_site "default" do
   action :disable
 end
@@ -69,7 +78,9 @@ end
 
 apache_site "tile.openstreetmap.org" do
   template "apache.erb"
-  variables :fastly => fastlyips["addresses"]
+  variables :fastly => fastlyips["addresses"] + fastlyips["ipv6_addresses"],
+            :statuscake => statuscakelocations.flat_map { |_, v| [v["ip"], v["ipv6"]] },
+            :admins => admins["hosts"]
 end
 
 template "/etc/logrotate.d/apache2" do
diff --git a/cookbooks/tile/templates/default/apache.erb b/cookbooks/tile/templates/default/apache.erb
index f7cba541b..696bb6e3b 100644
--- a/cookbooks/tile/templates/default/apache.erb
+++ b/cookbooks/tile/templates/default/apache.erb
@@ -65,6 +65,25 @@
   # Redirect ACME certificate challenges
   RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
 
+  # Restrict tile access to CDN nodes and admins
+  <LocationMatch ^/default/\d+/\d+/\d+\.png$>
+    Require expr "%{CONN_REMOTE_ADDR} != %{REMOTE_ADDR}"
+<% @fastly.sort.each do |address| -%>
+    Require ip <%= address %>
+<% end -%>
+<% @statuscake.sort.reject { |address| address.empty? }.each do |address| -%>
+    Require ip <%= address %>
+<% end -%>
+<% @admins.sort.each do |address| -%>
+    Require ip <%= address %>
+<% end -%>
+    Require ip 130.117.76.0/27
+    Require ip 2001:978:2:2C::/64
+    Require ip 184.104.226.96/27
+    Require ip 2001:470:1:b3b::/64
+    Require ip 193.60.236.0/24
+  </LocationMatch>
+
   # Internal endpoint for blocked users
   <Location /blocked>
     Header always set Cache-Control private
-- 
2.39.5