10 files changed, 82 insertions, 17 deletions
diff --git a/files/etc/apt/listchanges.conf b/files/etc/apt/listchanges.conf
index 96910a0..713cbbd 100644
--- a/files/etc/apt/listchanges.conf
+++ b/files/etc/apt/listchanges.conf
@@ -6,4 +6,4 @@ email_format=text
 confirm=false
 headers=false
 reverse=false
-save_seen=/var/lib/apt/listchanges.db
+save_seen=/var/lib/apt/listchanges
diff --git a/files/etc/nginx/sites-available/webmap b/files/etc/nginx/sites-available/webmap
index 121dada..e43af57 100644
--- a/files/etc/nginx/sites-available/webmap
+++ b/files/etc/nginx/sites-available/webmap
@@ -66,7 +66,7 @@ server {
     location ^~ /assets/ {
         expires 7d;
         try_files $uri =404;
-        location ~ "\.(css|js|svg)$" {
+        location ~ "\.(?:css|js|svg)$" {
             brotli_static on;
         }
     }
@@ -82,6 +82,9 @@ server {
         try_files $uri =404;
         # service an empty payload to save bandwidth
         error_page 404 /_.txt;
+        location ~ "\.json$" {
+            brotli_static on;
+        }
     }
     location = /q {
         expires epoch;
diff --git a/files/etc/nginx/snippets/ssl.conf b/files/etc/nginx/snippets/ssl.conf
index 0bce30a..b86f5e3 100644
--- a/files/etc/nginx/snippets/ssl.conf
+++ b/files/etc/nginx/snippets/ssl.conf
@@ -7,10 +7,3 @@ ssl_dhparam /etc/ssl/dhparams.pem;
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
 ssl_prefer_server_ciphers off;
-
-ssl_stapling on;
-ssl_stapling_verify on;
-
-ssl_trusted_certificate /usr/share/lacme/ca-certificates.crt;
-
-resolver 127.0.0.53;
diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/webmap-import@.service
index 964c37d..e2a6eb4 100644
--- a/files/etc/systemd/system/webmap-import@.service
+++ b/files/etc/systemd/system/webmap-import@.service
@@ -11,6 +11,9 @@ Group=_webmap
 Nice=15
 IOSchedulingClass=idle
 
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
 Type=oneshot
 ExecStart=/usr/local/bin/webmap-import \
     --cachedir=%C/webmap \
@@ -18,6 +21,7 @@ ExecStart=/usr/local/bin/webmap-import \
     --lockdir-sources=%t/lock/webmap/cache \
     --mvtdir=/var/www/webmap/tiles/%I \
     --mvt-compress \
+    --metadata-compress \
     -- %I
 
 # Hardening
diff --git a/files/etc/systemd/system/webmap-raster@.service b/files/etc/systemd/system/webmap-raster@.service
new file mode 100644
index 0000000..42a97cf
--- /dev/null
+++ b/files/etc/systemd/system/webmap-raster@.service
@@ -0,0 +1,40 @@
+[Unit]
+Description=Webmap updater service (export ‘%I’ to COG)
+After=webmap-update@%i.target
+After=webmap-download@%i.service
+Upholds=webmap-update@%i.target
+
+[Service]
+User=_webmap
+Group=_webmap
+
+Nice=15
+IOSchedulingClass=idle
+
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
+Type=oneshot
+ExecStart=/usr/local/bin/webmap-import \
+    --cachedir=%C/webmap \
+    --lockfile=%t/lock/webmap/lock \
+    --lockdir-sources=%t/lock/webmap/cache \
+    --rasterdir=/var/www/webmap/raster/%I \
+    --metadata-compress \
+    -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX
+ReadWritePaths=%t/lock/webmap
+ReadWritePaths=/var/www/webmap/raster
+PrivateTmp=yes
+
+[Install]
+WantedBy=webmap-update@%i.target
diff --git a/group_vars/all.yml b/group_vars/all.yml
index 29ad0b9..10dfd93 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -2,6 +2,7 @@
 # The list of layer groups to process, see
 # webmap-tools/config.yml:layer-groups.
 webmap_layer_groups:
+  - adm
   - mrr
   - skydd
   - avverk
@@ -12,7 +13,11 @@ webmap_layer_groups:
   - misc
   - nv
 
+webmap_raster:
+  - kskog
+
 webmap_layer_groups_nodownload:
+  - adm
   - misc
 
 # adjust calendar events for individual units
@@ -21,5 +26,5 @@ webmap_layer_groups_update_calendar:
 
 # PostgreSQL's version number and cluster name
 postgresql:
-  version: 15
+  version: 17
   cluster: main
diff --git a/tasks/ssh.yml b/tasks/ssh.yml
index 341a96d..e568036 100644
--- a/tasks/ssh.yml
+++ b/tasks/ssh.yml
@@ -16,5 +16,5 @@
   notify:
     - Restart OpenSSH
 
-- name: Start Openssh
+- name: Start OpenSSH
   service: name=ssh enabled=true state=started
diff --git a/tasks/webmap.yml b/tasks/webmap.yml
index de320d4..2db575d 100644
--- a/tasks/webmap.yml
+++ b/tasks/webmap.yml
@@ -51,6 +51,7 @@
     - common_gdal.py
     - import_source.py
     - export_mvt.py
+    - export_raster.py
     - rename_exchange.py
 
 - name: Copy webmap-update@.target
@@ -87,7 +88,7 @@
 
 - name: Enable webmap-update.timer
   service: name=webmap-update@{{ item }}.timer state=started enabled=true
-  with_items: "{{ webmap_layer_groups }}"
+  with_items: "{{ webmap_layer_groups | union(webmap_raster) }}"
 
 - meta: flush_handlers
 
@@ -147,7 +148,7 @@
 
 - name: Enable webmap-download@.service
   service: name=webmap-download@{{ item }}.service enabled=true
-  with_items: "{{ webmap_layer_groups | difference(webmap_layer_groups_nodownload) }}"
+  with_items: "{{ webmap_layer_groups | union(webmap_raster) | difference(webmap_layer_groups_nodownload) }}"
 
 - name: Disable some webmap-download@.service
   service: name=webmap-download@{{ item }}.service enabled=false
@@ -346,11 +347,23 @@
   service: name=webmap-import@{{ item }}.service enabled=true
   with_items: "{{ webmap_layer_groups }}"
 
+- name: Copy webmap-raster@.service
+  copy: src=etc/systemd/system/webmap-raster@.service
+        dest=/etc/systemd/system/webmap-raster@.service
+        owner=root group=root
+        mode=0644
+  notify:
+    - systemctl daemon-reload
+
+- name: Enable webmap-raster@.service
+  service: name=webmap-raster@{{ item }}.service enabled=true
+  with_items: "{{ webmap_raster }}"
+
 
 - name: Build administrative-codes.json*
   become: false
-  local_action:
-    module: community.general.make
+  delegate_to: localhost
+  community.general.make:
     chdir: ./webmap-tools/administrative-codes
     target: all
 
@@ -378,6 +391,12 @@
         owner=_webmap group=root
         mode=0755
 
+- name: Create directory /var/www/webmap/raster
+  file: path=/var/www/webmap/raster
+        state=directory
+        owner=_webmap group=root
+        mode=0755
+
 
 - name: Copy /etc/tmpfiles.d/webmap.conf
   copy: src=etc/tmpfiles.d/webmap.conf
@@ -396,8 +415,7 @@
     packages:
     - uwsgi-core
     - uwsgi-plugin-python3
-    # TODO[trixie]: install python3-psycopg-c instead
-    - python3-psycopg
+    - python3-psycopg-c
 
 - name: Copy webmap-cgi.socket
   copy: src=etc/systemd/system/webmap-cgi.socket
diff --git a/templates/etc/apt/sources.list.d/debian.sources.j2 b/templates/etc/apt/sources.list.d/debian.sources.j2
index 980daaf..3894b72 100644
--- a/templates/etc/apt/sources.list.d/debian.sources.j2
+++ b/templates/etc/apt/sources.list.d/debian.sources.j2
@@ -2,8 +2,10 @@ Types: deb
 URIs: https://deb.debian.org/debian
 Suites: {{ ansible_lsb.codename }} {{ ansible_lsb.codename }}-updates
 Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp
 
 Types: deb
 URIs: https://deb.debian.org/debian-security
 Suites: {{ ansible_lsb.codename }}-security
 Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp
diff --git a/webmap-tools b/webmap-tools
-Subproject 4263125c9bc8f23cf5ef6f3257b575537e3cad7
+Subproject f7785f929a4402a98a2d0bd428ba00968be8cf0