54 lines
1.4 KiB
Ruby
54 lines
1.4 KiB
Ruby
#
|
|
# Cookbook Name:: kosmos-nginx
|
|
# Recipe:: default
|
|
#
|
|
# Copyright 2015, Kosmos
|
|
#
|
|
# All rights reserved - Do Not Redistribute
|
|
#
|
|
node.override['nginx']['default_site_enabled'] = false
|
|
node.override['nginx']['server_tokens'] = 'off'
|
|
node.override['nginx']['log_formats']['json'] = <<-EOF
|
|
'{"ip":"$remote_addr",'
|
|
'"time":"$time_local",'
|
|
'"host":"$host",'
|
|
'"method":"$request_method",'
|
|
'"uri":"$uri",'
|
|
'"status":$status,'
|
|
'"size":$body_bytes_sent,'
|
|
'"referer":"$http_referer",'
|
|
'"upstream_addr":"$upstream_addr",'
|
|
'"upstream_response_time":"$upstream_response_time",'
|
|
'"ua":"$http_user_agent"}'
|
|
EOF
|
|
|
|
node.override['nginx']['repo_source'] = 'nginx' # Install from official repo
|
|
node.override['nginx']['upstream_repository'] = "http://nginx.org/packages/mainline/#{node['platform']}"
|
|
include_recipe 'nginx'
|
|
|
|
# Generate Strong Diffie-Hellman Group (increases security)
|
|
# https://weakdh.org/sysadmin.html
|
|
openssl_dhparam "/etc/ssl/private/dhparams.pem" do
|
|
key_length 2048
|
|
mode 0600
|
|
owner 'www-data'
|
|
end
|
|
|
|
cookbook_file "#{node['nginx']['dir']}/conf.d/tls_config.conf" do
|
|
source 'nginx_tls_config.conf'
|
|
owner 'root'
|
|
group 'root'
|
|
mode '0644'
|
|
notifies :restart, 'service[nginx]'
|
|
end
|
|
|
|
unless node.chef_environment == "development"
|
|
include_recipe 'kosmos-base::firewall'
|
|
|
|
firewall_rule 'http/https' do
|
|
port [80, 443]
|
|
protocol :tcp
|
|
command :allow
|
|
end
|
|
end
|