82 lines
2.1 KiB
Ruby
82 lines
2.1 KiB
Ruby
#
|
|
# Cookbook Name:: kosmos-nginx
|
|
# Recipe:: default
|
|
#
|
|
|
|
node.override['nginx']['default_site_enabled'] = false
|
|
node.override['nginx']['server_tokens'] = 'off'
|
|
node.override['nginx']['log_formats']['json'] = <<-EOF
|
|
'{"ip":"$remote_addr",'
|
|
'"time":"$time_local",'
|
|
'"host":"$host",'
|
|
'"method":"$request_method",'
|
|
'"uri":"$uri",'
|
|
'"status":$status,'
|
|
'"size":$body_bytes_sent,'
|
|
'"referer":"$http_referer",'
|
|
'"upstream_addr":"$upstream_addr",'
|
|
'"upstream_response_time":"$upstream_response_time",'
|
|
'"ua":"$http_user_agent"}'
|
|
EOF
|
|
|
|
node.override['nginx']['repo_source'] = 'nginx' # Install from official repo
|
|
node.override['nginx']['upstream_repository'] = "http://nginx.org/packages/mainline/#{node['platform']}"
|
|
include_recipe 'nginx'
|
|
|
|
# Override the nginx package resource to set a specific version, allowing
|
|
# to upgrade it
|
|
edit_resource!(:package, 'nginx') do
|
|
version "1.19.1-1~#{node['lsb']['codename']}"
|
|
notifies :reload, 'ohai[reload_nginx]', :immediately
|
|
end
|
|
|
|
# Generate Strong Diffie-Hellman Group (increases security)
|
|
# https://weakdh.org/sysadmin.html
|
|
openssl_dhparam "/etc/ssl/private/dhparams.pem" do
|
|
key_length 2048
|
|
mode 0600
|
|
owner 'www-data'
|
|
end
|
|
|
|
cookbook_file "#{node['nginx']['dir']}/conf.d/tls_config.conf" do
|
|
source 'nginx_tls_config.conf'
|
|
owner 'root'
|
|
group 'root'
|
|
mode '0644'
|
|
notifies :restart, 'service[nginx]'
|
|
end
|
|
|
|
directory node["nginx"]["user_home"] do
|
|
owner node["nginx"]["user"]
|
|
group node["nginx"]["group"]
|
|
action :create
|
|
recursive true
|
|
end
|
|
|
|
# Maintenance page, to be copied or served when putting things in maintenance
|
|
# mode
|
|
cookbook_file "#{node["nginx"]["user_home"]}/maintenance.html" do
|
|
source "maintenance.html"
|
|
owner node['nginx']['user']
|
|
group node['nginx']['group']
|
|
mode "0640"
|
|
end
|
|
|
|
unless node.chef_environment == "development"
|
|
include_recipe "kosmos-nginx::firewall"
|
|
end
|
|
|
|
ruby_block "nginx configuration" do
|
|
block do
|
|
file = Chef::Util::FileEdit.new("/etc/nginx/nginx.conf")
|
|
file.insert_line_if_no_match(/stream {/, <<-EOF
|
|
stream {
|
|
include /etc/nginx/streams-enabled/*;
|
|
}
|
|
EOF
|
|
)
|
|
file.write_file
|
|
end
|
|
notifies :reload, 'ohai[reload_nginx]', :immediately
|
|
end
|