summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--files/etc/apt/listchanges.conf2
-rw-r--r--files/etc/nginx/sites-available/webmap23
-rw-r--r--files/etc/nginx/snippets/ssl.conf7
-rw-r--r--files/etc/systemd/system/webmap-import@.service4
-rw-r--r--files/etc/systemd/system/webmap-raster@.service40
-rw-r--r--group_vars/all.yml16
-rw-r--r--tasks/ssh.yml2
-rw-r--r--tasks/webmap.yml46
-rw-r--r--templates/etc/apt/sources.list.d/debian.sources.j22
-rw-r--r--templates/etc/systemd/system/webmap-update@.timer.d/override.conf.j23
m---------webmap-tools0
11 files changed, 119 insertions, 26 deletions
diff --git a/files/etc/apt/listchanges.conf b/files/etc/apt/listchanges.conf
index 96910a0..713cbbd 100644
--- a/files/etc/apt/listchanges.conf
+++ b/files/etc/apt/listchanges.conf
@@ -6,4 +6,4 @@ email_format=text
confirm=false
headers=false
reverse=false
-save_seen=/var/lib/apt/listchanges.db
+save_seen=/var/lib/apt/listchanges
diff --git a/files/etc/nginx/sites-available/webmap b/files/etc/nginx/sites-available/webmap
index d5e005a..e43af57 100644
--- a/files/etc/nginx/sites-available/webmap
+++ b/files/etc/nginx/sites-available/webmap
@@ -65,8 +65,10 @@ server {
location ^~ /assets/ {
expires 7d;
- brotli_static on;
try_files $uri =404;
+ location ~ "\.(?:css|js|svg)$" {
+ brotli_static on;
+ }
}
location ^~ /tiles/ {
expires 30m;
@@ -75,6 +77,15 @@ server {
# service an empty payload to save bandwidth
error_page 404 /_.txt;
}
+ location ^~ /raster/ {
+ expires 30m;
+ try_files $uri =404;
+ # service an empty payload to save bandwidth
+ error_page 404 /_.txt;
+ location ~ "\.json$" {
+ brotli_static on;
+ }
+ }
location = /q {
expires epoch;
limit_except POST { deny all; }
@@ -90,14 +101,8 @@ server {
gzip on;
gzip_types application/json text/plain;
include uwsgi_params;
- uwsgi_buffering off;
uwsgi_pass unix:/run/webmap-cgi.socket;
}
- location = /tiles/metadata.json {
- expires epoch;
- brotli_static on;
- try_files $uri =404;
- }
location = /_.txt {
# cache 404 responses for 30m like for valid tiles
@@ -113,8 +118,10 @@ server {
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always;
- add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self' data: https://minkarta.lantmateriet.se/map/; script-src 'self'; style-src 'self'; frame-ancestors 'self'; form-action 'none'; base-uri 'self'";
+ add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self' data: https://minkarta.lantmateriet.se/map/; script-src 'self'; style-src 'self'; frame-ancestors 'self'; form-action 'none'; worker-src blob:; base-uri 'self'";
+ expires 1h;
+ brotli_static on;
try_files $uri $uri/ =404;
}
}
diff --git a/files/etc/nginx/snippets/ssl.conf b/files/etc/nginx/snippets/ssl.conf
index 0bce30a..b86f5e3 100644
--- a/files/etc/nginx/snippets/ssl.conf
+++ b/files/etc/nginx/snippets/ssl.conf
@@ -7,10 +7,3 @@ ssl_dhparam /etc/ssl/dhparams.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
-
-ssl_stapling on;
-ssl_stapling_verify on;
-
-ssl_trusted_certificate /usr/share/lacme/ca-certificates.crt;
-
-resolver 127.0.0.53;
diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/webmap-import@.service
index 964c37d..e2a6eb4 100644
--- a/files/etc/systemd/system/webmap-import@.service
+++ b/files/etc/systemd/system/webmap-import@.service
@@ -11,6 +11,9 @@ Group=_webmap
Nice=15
IOSchedulingClass=idle
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
Type=oneshot
ExecStart=/usr/local/bin/webmap-import \
--cachedir=%C/webmap \
@@ -18,6 +21,7 @@ ExecStart=/usr/local/bin/webmap-import \
--lockdir-sources=%t/lock/webmap/cache \
--mvtdir=/var/www/webmap/tiles/%I \
--mvt-compress \
+ --metadata-compress \
-- %I
# Hardening
diff --git a/files/etc/systemd/system/webmap-raster@.service b/files/etc/systemd/system/webmap-raster@.service
new file mode 100644
index 0000000..42a97cf
--- /dev/null
+++ b/files/etc/systemd/system/webmap-raster@.service
@@ -0,0 +1,40 @@
+[Unit]
+Description=Webmap updater service (export ‘%I’ to COG)
+After=webmap-update@%i.target
+After=webmap-download@%i.service
+Upholds=webmap-update@%i.target
+
+[Service]
+User=_webmap
+Group=_webmap
+
+Nice=15
+IOSchedulingClass=idle
+
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
+Type=oneshot
+ExecStart=/usr/local/bin/webmap-import \
+ --cachedir=%C/webmap \
+ --lockfile=%t/lock/webmap/lock \
+ --lockdir-sources=%t/lock/webmap/cache \
+ --rasterdir=/var/www/webmap/raster/%I \
+ --metadata-compress \
+ -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX
+ReadWritePaths=%t/lock/webmap
+ReadWritePaths=/var/www/webmap/raster
+PrivateTmp=yes
+
+[Install]
+WantedBy=webmap-update@%i.target
diff --git a/group_vars/all.yml b/group_vars/all.yml
index e90c73e..10dfd93 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -2,19 +2,29 @@
# The list of layer groups to process, see
# webmap-tools/config.yml:layer-groups.
webmap_layer_groups:
+ - adm
- mrr
- - nvr
- - sks
+ - skydd
+ - avverk
- ren
- vbk
- ri
- svk
- misc
+ - nv
+
+webmap_raster:
+ - kskog
webmap_layer_groups_nodownload:
+ - adm
- misc
+# adjust calendar events for individual units
+webmap_layer_groups_update_calendar:
+ mrr: "*-*-* 05:00:00" # updated daily at 04:33 CEST
+
# PostgreSQL's version number and cluster name
postgresql:
- version: 15
+ version: 17
cluster: main
diff --git a/tasks/ssh.yml b/tasks/ssh.yml
index 341a96d..e568036 100644
--- a/tasks/ssh.yml
+++ b/tasks/ssh.yml
@@ -16,5 +16,5 @@
notify:
- Restart OpenSSH
-- name: Start Openssh
+- name: Start OpenSSH
service: name=ssh enabled=true state=started
diff --git a/tasks/webmap.yml b/tasks/webmap.yml
index d694387..2db575d 100644
--- a/tasks/webmap.yml
+++ b/tasks/webmap.yml
@@ -51,6 +51,7 @@
- common_gdal.py
- import_source.py
- export_mvt.py
+ - export_raster.py
- rename_exchange.py
- name: Copy webmap-update@.target
@@ -69,9 +70,25 @@
notify:
- systemctl daemon-reload
+- name: Create directory /etc/systemd/system/webmap-update@*.timer.d
+ file: path=/etc/systemd/system/webmap-update@{{ item }}.timer.d
+ state=directory
+ owner=root group=root
+ mode=0755
+ with_items: "{{ webmap_layer_groups_update_calendar.keys() | list }}"
+
+- name: Copy /etc/systemd/system/webmap-update@*.timer.d/override.conf
+ template: src=etc/systemd/system/webmap-update@.timer.d/override.conf.j2
+ dest=/etc/systemd/system/webmap-update@{{ item }}.timer.d/override.conf
+ owner=root group=root
+ mode=0644
+ with_items: "{{ webmap_layer_groups_update_calendar.keys() | list }}"
+ notify:
+ - systemctl daemon-reload
+
- name: Enable webmap-update.timer
service: name=webmap-update@{{ item }}.timer state=started enabled=true
- with_items: "{{ webmap_layer_groups }}"
+ with_items: "{{ webmap_layer_groups | union(webmap_raster) }}"
- meta: flush_handlers
@@ -131,7 +148,7 @@
- name: Enable webmap-download@.service
service: name=webmap-download@{{ item }}.service enabled=true
- with_items: "{{ webmap_layer_groups | difference(webmap_layer_groups_nodownload) }}"
+ with_items: "{{ webmap_layer_groups | union(webmap_raster) | difference(webmap_layer_groups_nodownload) }}"
- name: Disable some webmap-download@.service
service: name=webmap-download@{{ item }}.service enabled=false
@@ -330,11 +347,23 @@
service: name=webmap-import@{{ item }}.service enabled=true
with_items: "{{ webmap_layer_groups }}"
+- name: Copy webmap-raster@.service
+ copy: src=etc/systemd/system/webmap-raster@.service
+ dest=/etc/systemd/system/webmap-raster@.service
+ owner=root group=root
+ mode=0644
+ notify:
+ - systemctl daemon-reload
+
+- name: Enable webmap-raster@.service
+ service: name=webmap-raster@{{ item }}.service enabled=true
+ with_items: "{{ webmap_raster }}"
+
- name: Build administrative-codes.json*
become: false
- local_action:
- module: community.general.make
+ delegate_to: localhost
+ community.general.make:
chdir: ./webmap-tools/administrative-codes
target: all
@@ -362,6 +391,12 @@
owner=_webmap group=root
mode=0755
+- name: Create directory /var/www/webmap/raster
+ file: path=/var/www/webmap/raster
+ state=directory
+ owner=_webmap group=root
+ mode=0755
+
- name: Copy /etc/tmpfiles.d/webmap.conf
copy: src=etc/tmpfiles.d/webmap.conf
@@ -380,8 +415,7 @@
packages:
- uwsgi-core
- uwsgi-plugin-python3
- # TODO[trixie]: install python3-psycopg-c instead
- - python3-psycopg
+ - python3-psycopg-c
- name: Copy webmap-cgi.socket
copy: src=etc/systemd/system/webmap-cgi.socket
diff --git a/templates/etc/apt/sources.list.d/debian.sources.j2 b/templates/etc/apt/sources.list.d/debian.sources.j2
index 980daaf..3894b72 100644
--- a/templates/etc/apt/sources.list.d/debian.sources.j2
+++ b/templates/etc/apt/sources.list.d/debian.sources.j2
@@ -2,8 +2,10 @@ Types: deb
URIs: https://deb.debian.org/debian
Suites: {{ ansible_lsb.codename }} {{ ansible_lsb.codename }}-updates
Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp
Types: deb
URIs: https://deb.debian.org/debian-security
Suites: {{ ansible_lsb.codename }}-security
Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp
diff --git a/templates/etc/systemd/system/webmap-update@.timer.d/override.conf.j2 b/templates/etc/systemd/system/webmap-update@.timer.d/override.conf.j2
new file mode 100644
index 0000000..795ee20
--- /dev/null
+++ b/templates/etc/systemd/system/webmap-update@.timer.d/override.conf.j2
@@ -0,0 +1,3 @@
+[Timer]
+OnCalendar=
+OnCalendar={{ webmap_layer_groups_update_calendar[item] }}
diff --git a/webmap-tools b/webmap-tools
-Subproject b9b9eef91e5c33e6938b64e4e60f066c36201de
+Subproject f7785f929a4402a98a2d0bd428ba00968be8cf0
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-14 04:37:49 +0000