From df86974a21bf452883bcb2f73cfcaee8d142a081 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Sun, 15 Nov 2020 15:12:58 +0000 Subject: [PATCH 1/1] Treat fastly addresses as trusted sources of remote IP addresses --- cookbooks/tile/recipes/default.rb | 8 +++++++- cookbooks/tile/templates/default/apache.erb | 3 +++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/cookbooks/tile/recipes/default.rb b/cookbooks/tile/recipes/default.rb index 7363e410c..241b73a8e 100644 --- a/cookbooks/tile/recipes/default.rb +++ b/cookbooks/tile/recipes/default.rb @@ -46,7 +46,13 @@ ssl_certificate node[:fqdn] do notifies :reload, "service[apache2]" end +remote_file "#{Chef::Config[:file_cache_path]}/fastly-ip-list.json" do + source "https://api.fastly.com/public-ip-list" + compile_time true +end + tilecaches = search(:node, "roles:tilecache").sort_by { |n| n[:hostname] } +fastlyips = JSON.parse(IO.read("#{Chef::Config[:file_cache_path]}/fastly-ip-list.json")) apache_site "default" do action [:disable] @@ -54,7 +60,7 @@ end apache_site "tile.openstreetmap.org" do template "apache.erb" - variables :caches => tilecaches + variables :caches => tilecaches, :fastly => fastlyips["addresses"] end template "/etc/logrotate.d/apache2" do diff --git a/cookbooks/tile/templates/default/apache.erb b/cookbooks/tile/templates/default/apache.erb index 0e461b8d6..e6f8ade1c 100644 --- a/cookbooks/tile/templates/default/apache.erb +++ b/cookbooks/tile/templates/default/apache.erb @@ -25,6 +25,9 @@ <% cache.ipaddresses(:role => :external).sort.each do |address| -%> RemoteIPTrustedProxy <%= address %> <% end -%> +<% end -%> +<% @fastly.sort.each do |address| -%> + RemoteIPTrustedProxy <%= address %> <% end -%> # Setup logging -- 2.39.5