Various fixes that prevented production deployment
This commit is contained in:
Christoph Haas
parent
591845a25d
commit
459e86e25a
8 changed files with 134 additions and 279 deletions
|
|
@ -1,38 +1,41 @@
|
|||
---
|
||||
- hosts: all
|
||||
|
||||
vars:
|
||||
ruby_version: 2.4.1
|
||||
|
||||
handlers:
|
||||
- name: restart nginx
|
||||
service: name=nginx state=restarted
|
||||
|
||||
tasks:
|
||||
- name: Install packages
|
||||
apt: name="{{item}}" state=installed
|
||||
apt: name="{{item}}" state=present
|
||||
with_items:
|
||||
- htop
|
||||
- python-psycopg2
|
||||
- ruby
|
||||
#- passenger
|
||||
#- nginx-full
|
||||
- sudo
|
||||
- nginx-extras
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
#- build-essential
|
||||
#- ruby-dev
|
||||
- libssl-dev
|
||||
- libreadline-dev
|
||||
- zlib1g-dev
|
||||
- libbz2-dev
|
||||
- libpq-dev
|
||||
#- libcurl4-gnutls-dev
|
||||
#- ruby-bundler
|
||||
#- nodejs
|
||||
- git
|
||||
- imagemagick
|
||||
|
||||
- name: Remove conflicting packages
|
||||
apt: name=python-openssl state=absent
|
||||
|
||||
- name: Enable Jessie backports repository
|
||||
apt_repository: repo="deb http://ftp.debian.org/debian jessie-backports main"
|
||||
- name: Set up american locales to avoid warnings about missing locales
|
||||
locale_gen: name=en_US.UTF-8 state=present
|
||||
- name: Install PostgreSQL
|
||||
apt: name=postgresql state=installed
|
||||
apt: name=postgresql state=present
|
||||
- name: Create PostgreSQL user
|
||||
become: yes
|
||||
become_user: postgres
|
||||
|
|
@ -43,24 +46,6 @@
|
|||
postgresql_db: name=debshots owner=debshots encoding=UTF-8 template=template0
|
||||
- name: Create application user
|
||||
user: name=debshots groups=adm home=/opt/debshots shell=/bin/bash
|
||||
#- name: Install Passenger Gem
|
||||
# gem: name=passenger state=present
|
||||
#- name: Install Passenger and Nginx
|
||||
# shell: passenger-install-nginx-module --auto
|
||||
#- name: Validate installation
|
||||
# shell: passenger-config validate-install --auto
|
||||
- apt_key: keyserver=keyserver.ubuntu.com id=561F9B9CAC40B2F7
|
||||
- apt_repository: repo="deb https://oss-binaries.phusionpassenger.com/apt/passenger jessie main"
|
||||
- apt: name="{{item}}" state=installed
|
||||
with_items:
|
||||
- nginx-extras
|
||||
- passenger
|
||||
- name: Enable Passenger in main nginx.conf
|
||||
lineinfile:
|
||||
dest: /etc/nginx/nginx.conf
|
||||
regexp: '# include /etc/nginx/passenger\.conf'
|
||||
line: 'include /etc/nginx/passenger.conf;'
|
||||
backrefs: yes
|
||||
|
||||
# Install newer Ruby version using rbenv
|
||||
- name: Get rbenv
|
||||
|
|
@ -80,17 +65,35 @@
|
|||
src: files/debshots-bash-profile
|
||||
dest: /opt/debshots/.profile
|
||||
owner: debshots
|
||||
|
||||
- name: Build Ruby version
|
||||
shell: sudo -iu debshots rbenv install -v {{ruby_version}} creates=/opt/debshots/.rbenv/versions/{{ruby_version}}
|
||||
shell: rbenv install -v {{ruby_version}} creates=/opt/debshots/.rbenv/versions/{{ruby_version}}
|
||||
become: yes
|
||||
become_user: debshots
|
||||
become_flags: "-i"
|
||||
|
||||
- name: Set Ruby version to version {{ruby_version}}
|
||||
shell: rbenv local {{ruby_version}}
|
||||
become: yes
|
||||
become_user: debshots
|
||||
become_flags: "-i"
|
||||
|
||||
- name: Install certbot to get certificates from Lets Encrypt
|
||||
apt: name=certbot default_release=jessie-backports
|
||||
|
||||
- name: Install Bundler
|
||||
gem: name=bundler
|
||||
shell: gem install bundler
|
||||
become: yes
|
||||
become_user: debshots
|
||||
become_flags: "-i"
|
||||
|
||||
- name: Install dependencies
|
||||
shell: sudo -iu debshots bundle
|
||||
shell: bundle install
|
||||
args:
|
||||
chdir: /opt/debshots
|
||||
become: yes
|
||||
become_user: debshots
|
||||
become_flags: "-i"
|
||||
|
||||
- name: Make sure that the public/ directory is readable by nginx
|
||||
file: path=/opt/debshots/public mode='go+rx'
|
||||
|
|
@ -105,4 +108,3 @@
|
|||
restart nginx
|
||||
|
||||
# - debug: msg="Please run: certbot certonly --webroot -w /opt/debshots/public -d screenshots.debian.net"
|
||||
|
||||
|
|
|
|||
|
|
@ -24,10 +24,6 @@ proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g
|
|||
|
||||
log_format proxy '[$time_local] Cache: $upstream_cache_status $upstream_addr $upstream_response_time $status $bytes_sent $remote_addr $request_uri "$http_referer" "$http_user_agent" $scheme';
|
||||
|
||||
# Performance
|
||||
passenger_max_pool_size 8;
|
||||
passenger_max_request_queue_size 200;
|
||||
|
||||
limit_req_zone $binary_remote_addr zone=one:20m rate=5r/s;
|
||||
|
||||
# Frontend caching and static asset delivery
|
||||
|
|
@ -37,7 +33,7 @@ server {
|
|||
ssl_certificate /etc/letsencrypt/live/screenshots.debian.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/screenshots.debian.net/privkey.pem;
|
||||
|
||||
root /opt/debshots/public;
|
||||
#root /opt/debshots/public;
|
||||
server_name _;
|
||||
access_log /var/log/nginx/cache-access.log proxy;
|
||||
|
||||
|
|
@ -62,7 +58,7 @@ server {
|
|||
location /json/ {
|
||||
try_files /maintenance.html @backend;
|
||||
proxy_cache my_cache;
|
||||
proxy_pass http://127.0.0.1:8888/;
|
||||
proxy_pass http://127.0.0.1:3000/;
|
||||
proxy_cache_lock on;
|
||||
proxy_cache_use_stale updating;
|
||||
add_header X-Coffee front-json;
|
||||
|
|
@ -74,12 +70,17 @@ server {
|
|||
|
||||
location @backend {
|
||||
proxy_cache my_cache;
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
proxy_set_header x_debian_sso_dn $ssl_client_s_dn;
|
||||
proxy_pass http://127.0.0.1:3000;
|
||||
|
||||
# Avoid cache stampede - rather update once and deliver stale content
|
||||
proxy_cache_lock on;
|
||||
proxy_cache_use_stale updating;
|
||||
add_header X-Coffee front-rails;
|
||||
|
||||
# Use sendfile mechanism to deliver files directly
|
||||
proxy_set_header X-Sendfile-Type X-Accel-Redirect;
|
||||
proxy_set_header X-Accel-Mapping /opt/debshots/public/=/__send_file_accel/;
|
||||
}
|
||||
|
||||
location /assets/ {
|
||||
|
|
@ -105,49 +106,46 @@ server {
|
|||
}
|
||||
|
||||
# Backend rails application
|
||||
server {
|
||||
listen 127.0.0.1:8888;
|
||||
# server {
|
||||
# listen 127.0.0.1:3000;
|
||||
|
||||
root /opt/debshots/public;
|
||||
# root /opt/debshots/public;
|
||||
|
||||
server_name _;
|
||||
access_log /var/log/nginx/rails-access.log;
|
||||
# server_name _;
|
||||
# access_log /var/log/nginx/rails-access.log;
|
||||
|
||||
passenger_enabled on;
|
||||
passenger_ruby /opt/debshots/.rbenv/versions/2.4.1/bin/ruby;
|
||||
# # Send thumbnails using X-Sendfile / X-Accel-Redirect
|
||||
# # The correct thumbnail is computed by the Rails application so it cannot be served directly.
|
||||
# location /thumbnail/ {
|
||||
# expires 1h;
|
||||
# proxy_cache_valid 404 15m;
|
||||
# add_header X-Coffee back-thumbnail;
|
||||
# limit_req zone=one burst=30;
|
||||
# }
|
||||
|
||||
# # Send public assets using X-Sendfile / X-Accel-Redirect (e.g. public/images/dummy/...)
|
||||
# location /public/ {
|
||||
# expires 1h;
|
||||
# add_header X-Coffee back-public;
|
||||
|
||||
# Send thumbnails using X-Sendfile / X-Accel-Redirect
|
||||
# The correct thumbnail is computed by the Rails application so it cannot be served directly.
|
||||
location /thumbnail/ {
|
||||
expires 1h;
|
||||
proxy_cache_valid 404 15m;
|
||||
add_header X-Coffee back-thumbnail;
|
||||
limit_req zone=one burst=30;
|
||||
}
|
||||
# # passenger_set_header X-Sendfile-Type X-Accel-Redirect;
|
||||
# # passenger_env_var HTTP_X_ACCEL_MAPPING /opt/debshots/public/=/__send_file_accel/;
|
||||
# # passenger_pass_header X-Accel-Redirect;
|
||||
# }
|
||||
|
||||
# Send public assets using X-Sendfile / X-Accel-Redirect (e.g. public/images/dummy/...)
|
||||
location /public/ {
|
||||
expires 1h;
|
||||
add_header X-Coffee back-public;
|
||||
# # Deliver static files directly from Nginx. See https://mattbrictson.com/accelerated-rails-downloads
|
||||
# location /__send_file_accel/ {
|
||||
# internal;
|
||||
# alias /opt/debshots/public/;
|
||||
# add_header X-Coffee back-accel;
|
||||
# expires 1d;
|
||||
# more_clear_headers 'Set-Cookie';
|
||||
# }
|
||||
|
||||
passenger_set_header X-Sendfile-Type X-Accel-Redirect;
|
||||
passenger_env_var HTTP_X_ACCEL_MAPPING /opt/debshots/public/=/__send_file_accel/;
|
||||
passenger_pass_header X-Accel-Redirect;
|
||||
}
|
||||
|
||||
location /__send_file_accel/ {
|
||||
internal;
|
||||
alias /opt/debshots/public/;
|
||||
add_header X-Coffee back-accel;
|
||||
expires 1d;
|
||||
more_clear_headers 'Set-Cookie';
|
||||
}
|
||||
|
||||
location /secretstatus {
|
||||
stub_status;
|
||||
access_log off;
|
||||
allow all;
|
||||
add_header X-Coffee back-status;
|
||||
}
|
||||
}
|
||||
# location /secretstatus {
|
||||
# stub_status;
|
||||
# access_log off;
|
||||
# allow all;
|
||||
# add_header X-Coffee back-status;
|
||||
# }
|
||||
# }
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue