make varnish role more general and add in config for a new varnish on kojipkgs
This commit is contained in:
Kevin Fenzi
parent
59638042a7
commit
eb787777b0
8 changed files with 144 additions and 8 deletions
|
|
@ -15,6 +15,8 @@ tcp_ports: [80, 443, 8080]
|
|||
|
||||
fas_client_groups: sysadmin-releng,sysadmin-noc
|
||||
|
||||
varnish_group: kojipkgs
|
||||
|
||||
# For the MOTD
|
||||
csi_security_category: Moderate
|
||||
csi_primary_contact: Fedora admins - admin@fedoraproject.org
|
||||
|
|
|
|||
|
|
@ -88,6 +88,8 @@ fas_client_groups: sysadmin-noc,fi-apprentice,sysadmin-web,sysadmin-veteran
|
|||
|
||||
collectd_apache: true
|
||||
|
||||
varnish_group: proxies
|
||||
|
||||
# For the MOTD
|
||||
csi_security_category: Moderate
|
||||
csi_primary_contact: Fedora Admins - admin@fedoraproject.org
|
||||
|
|
|
|||
|
|
@ -76,6 +76,7 @@ custom_rules: [
|
|||
fas_client_groups: sysadmin-noc,fi-apprentice,sysadmin-web,sysadmin-veteran
|
||||
|
||||
collectd_apache: true
|
||||
varnish_group: proxies
|
||||
|
||||
# For the MOTD
|
||||
csi_security_category: Moderate
|
||||
|
|
|
|||
32
roles/varnish/files/varnish.f25
Normal file
32
roles/varnish/files/varnish.f25
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# Varnish environment configuration description. This was derived from
|
||||
# the old style sysconfig/defaults settings
|
||||
|
||||
# Set this to 1 to make systemd reload try to switch VCL without restart.
|
||||
RELOAD_VCL=1
|
||||
|
||||
# Main configuration file. You probably want to change it.
|
||||
VARNISH_VCL_CONF=/etc/varnish/default.vcl
|
||||
|
||||
# Default address and port to bind to. Blank address means all IPv4
|
||||
# and IPv6 interfaces, otherwise specify a host name, an IPv4 dotted
|
||||
# quad, or an IPv6 address in brackets.
|
||||
# VARNISH_LISTEN_ADDRESS=192.168.1.5
|
||||
VARNISH_LISTEN_PORT=6081
|
||||
|
||||
# Admin interface listen address and port
|
||||
VARNISH_ADMIN_LISTEN_ADDRESS=127.0.0.1
|
||||
VARNISH_ADMIN_LISTEN_PORT=6082
|
||||
|
||||
# Shared secret file for admin interface
|
||||
VARNISH_SECRET_FILE=/etc/varnish/secret
|
||||
|
||||
# Backend storage specification, see Storage Types in the varnishd(5)
|
||||
# man page for details.
|
||||
VARNISH_STORAGE="malloc,256M"
|
||||
|
||||
# User and group for the varnishd worker processes
|
||||
VARNISH_USER=varnish
|
||||
VARNISH_GROUP=varnish
|
||||
|
||||
# Other options, see the man page varnishd(1)
|
||||
#DAEMON_OPTS="-p thread_pool_min=5 -p thread_pool_max=500 -p thread_pool_timeout=300"
|
||||
|
|
@ -15,19 +15,24 @@
|
|||
- varnish
|
||||
- selinux
|
||||
|
||||
- name: install varnish /etc/sysconfig/varnish
|
||||
copy: src={{ item.file }} dest={{ item.dest }}
|
||||
owner=root group=root
|
||||
with_items:
|
||||
- { file: varnish, dest: /etc/sysconfig/varnish }
|
||||
- name: install varnish /etc/sysconfig/varnish file (el7
|
||||
copy: src=varnish.el7 dest=/etc/sysconfig/varnish owner=root group=root
|
||||
notify:
|
||||
- restart varnish
|
||||
tags:
|
||||
- varnish
|
||||
when: ansible_distribution_major_version|int == 7
|
||||
|
||||
- name: install /etc/varnish/default.vcl
|
||||
template: src=proxy.vcl.j2 dest=/etc/varnish/default.vcl
|
||||
owner=root group=root
|
||||
- name: install varnish /etc/sysconfig/varnish file (fedora)
|
||||
copy: src=varnish.f25 dest=/etc/varnish/varnish.params owner=root group=root
|
||||
notify:
|
||||
- restart varnish
|
||||
tags:
|
||||
- varnish
|
||||
when: ansible_distribution_major_version|int > 24
|
||||
|
||||
- name: install /etc/varnish/default.vcl (proxies)
|
||||
template: src={{ varnish_group }}.vcl.j2 dest=/etc/varnish/default.vcl owner=root group=root
|
||||
notify:
|
||||
- restart varnish
|
||||
tags:
|
||||
|
|
|
|||
94
roles/varnish/templates/kojipkgs.vcl.j2
Normal file
94
roles/varnish/templates/kojipkgs.vcl.j2
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
vcl 5.0;
|
||||
|
||||
import directors;
|
||||
|
||||
#
|
||||
# These nets/machines are allowed /repo access
|
||||
#
|
||||
acl repoallowed {
|
||||
"10.5.125.0"/24;
|
||||
"10.5.127.0"/24;
|
||||
"10.5.129.0"/24;
|
||||
"10.5.126.14"/32;
|
||||
"10.5.126.223"/32;
|
||||
"10.5.126.224"/32;
|
||||
"10.5.126.225"/32;
|
||||
"10.5.126.226"/32;
|
||||
}
|
||||
|
||||
acl pdc {
|
||||
"10.5.126.134"/32;
|
||||
}
|
||||
|
||||
acl proxies {
|
||||
"10.5.126.51"/32;
|
||||
"10.5.126.52"/32;
|
||||
}
|
||||
|
||||
acl purge {
|
||||
"127.0.0.1"/32;
|
||||
}
|
||||
|
||||
backend local-apache {
|
||||
.host = "127.0.0.1";
|
||||
.port = "8080";
|
||||
.probe = {
|
||||
.url = "/";
|
||||
.interval = 5s;
|
||||
.timeout = 1s;
|
||||
.window = 5;
|
||||
.threshold = 3; }
|
||||
}
|
||||
|
||||
sub vcl_synth {
|
||||
set resp.http.Content-Type = "text/html; charset=utf-8";
|
||||
set resp.http.Retry-After = "5";
|
||||
synthetic( {"<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>"} + resp.status + " " + resp.reason + {"</title>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Error "} + resp.status + " " + resp.reason + {"</h1>
|
||||
<p>"} + resp.reason + {"</p>
|
||||
<h3>Guru Meditation:</h3>
|
||||
<p>XID: "} + req.xid + {"</p>
|
||||
<hr>
|
||||
<p>Varnish cache server on {{ inventory_hostname }}</p>
|
||||
</body>
|
||||
</html>
|
||||
"} );
|
||||
return (deliver);
|
||||
}
|
||||
|
||||
sub vcl_recv {
|
||||
if (req.method == "PURGE") {
|
||||
if (!client.ip ~ purge) {
|
||||
return (synth(405, "Not allowed"));
|
||||
}
|
||||
return(purge);
|
||||
}
|
||||
|
||||
if (req.url ~ "^/repo/") {
|
||||
if (client.ip ~ repoallowed) {
|
||||
set req.backend_hint = apache-local;
|
||||
unset req.http.cookie;
|
||||
set req.http.clear-cookies = "yes";
|
||||
}
|
||||
else {
|
||||
return(synth(403, "Access denied."));
|
||||
}
|
||||
}
|
||||
if (req.url ~ "^/mash/") {
|
||||
set req.backend_hint = apache-local;
|
||||
return (pipe);
|
||||
}
|
||||
if (req.url ~ "^/compose/") {
|
||||
set req.backend_hint = apache-local;
|
||||
return (pipe);
|
||||
}
|
||||
#
|
||||
# deny the open264 rpms and such
|
||||
# if (req.url ~ openh264)
|
||||
#
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue