diff options
17 files changed, 434 insertions, 432 deletions
diff --git a/files/etc/systemd/system/webmap-download@.service b/files/etc/systemd/system/geodata-download@.service index d7a49dc..2a8c940 100644 --- a/files/etc/systemd/system/webmap-download@.service +++ b/files/etc/systemd/system/geodata-download@.service @@ -1,22 +1,22 @@ [Unit] -Description=Webmap updater service (download ‘%I’) +Description=Geodata updater service (download ‘%I’) # Chaining logic from https://serverfault.com/questions/1079993/why-does-my-systemd-timer-only-trigger-once-when-the-unit-is-a-target#answer-1128671 # XXX Looks like Upholds= prevents running a single unit, as it causes -# webmap-update@%i.target to start upon `systemctl start webmap-download@foo.service` -After=network-online.target webmap-update@%i.target -Upholds=webmap-update@%i.target +# geodata-update@%i.target to start upon `systemctl start geodata-download@foo.service` +After=network-online.target geodata-update@%i.target +Upholds=geodata-update@%i.target [Service] -User=_webmap-download -Group=_webmap +User=_geodata-download +Group=_geodata Nice=15 IOSchedulingClass=idle Type=oneshot -ExecStart=/usr/local/bin/webmap-download \ - --cachedir=%C/webmap \ - --lockdir=%t/lock/webmap/cache \ +ExecStart=/usr/local/bin/geodata-download \ + --cachedir=%C/geodata \ + --lockdir=%t/lock/geodata/cache \ --no-exit-code \ --quiet \ -- %I @@ -30,8 +30,8 @@ ProtectControlGroups=yes ProtectKernelModules=yes ProtectKernelTunables=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -ReadWritePaths=%C/webmap -ReadWritePaths=%t/lock/webmap/cache +ReadWritePaths=%C/geodata +ReadWritePaths=%t/lock/geodata/cache [Install] -WantedBy=webmap-update@%i.target +WantedBy=geodata-update@%i.target diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/geodata-import@.service index e2a6eb4..7d652ea 100644 --- a/files/etc/systemd/system/webmap-import@.service +++ b/files/etc/systemd/system/geodata-import@.service @@ -1,12 +1,12 @@ [Unit] -Description=Webmap updater service (import ‘%I’ to PostGIS) -After=postgresql.service webmap-update@%i.target -After=webmap-download@%i.service -Upholds=webmap-update@%i.target +Description=Geodata updater service (import ‘%I’ to PostGIS) +After=postgresql.service geodata-update@%i.target +After=geodata-download@%i.service +Upholds=geodata-update@%i.target [Service] -User=_webmap -Group=_webmap +User=_geodata +Group=_geodata Nice=15 IOSchedulingClass=idle @@ -15,10 +15,10 @@ IOSchedulingClass=idle Environment=TMPDIR=/var/tmp Type=oneshot -ExecStart=/usr/local/bin/webmap-import \ - --cachedir=%C/webmap \ - --lockfile=%t/lock/webmap/lock \ - --lockdir-sources=%t/lock/webmap/cache \ +ExecStart=/usr/local/bin/geodata-import \ + --cachedir=%C/geodata \ + --lockfile=%t/lock/geodata/lock \ + --lockdir-sources=%t/lock/geodata/cache \ --mvtdir=/var/www/webmap/tiles/%I \ --mvt-compress \ --metadata-compress \ @@ -33,9 +33,9 @@ ProtectControlGroups=yes ProtectKernelModules=yes ProtectKernelTunables=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -ReadWritePaths=%t/lock/webmap +ReadWritePaths=%t/lock/geodata ReadWritePaths=/var/www/webmap/tiles PrivateTmp=yes [Install] -WantedBy=webmap-update@%i.target +WantedBy=geodata-update@%i.target diff --git a/files/etc/systemd/system/webmap-raster@.service b/files/etc/systemd/system/geodata-raster@.service index 42a97cf..aed7930 100644 --- a/files/etc/systemd/system/webmap-raster@.service +++ b/files/etc/systemd/system/geodata-raster@.service @@ -1,12 +1,12 @@ [Unit] -Description=Webmap updater service (export ‘%I’ to COG) -After=webmap-update@%i.target -After=webmap-download@%i.service -Upholds=webmap-update@%i.target +Description=Geodata updater service (export ‘%I’ to COG) +After=geodata-update@%i.target +After=geodata-download@%i.service +Upholds=geodata-update@%i.target [Service] -User=_webmap -Group=_webmap +User=_geodata +Group=_geodata Nice=15 IOSchedulingClass=idle @@ -15,10 +15,10 @@ IOSchedulingClass=idle Environment=TMPDIR=/var/tmp Type=oneshot -ExecStart=/usr/local/bin/webmap-import \ - --cachedir=%C/webmap \ - --lockfile=%t/lock/webmap/lock \ - --lockdir-sources=%t/lock/webmap/cache \ +ExecStart=/usr/local/bin/geodata-import \ + --cachedir=%C/geodata \ + --lockfile=%t/lock/geodata/lock \ + --lockdir-sources=%t/lock/geodata/cache \ --rasterdir=/var/www/webmap/raster/%I \ --metadata-compress \ -- %I @@ -32,9 +32,9 @@ ProtectControlGroups=yes ProtectKernelModules=yes ProtectKernelTunables=yes RestrictAddressFamilies=AF_UNIX -ReadWritePaths=%t/lock/webmap +ReadWritePaths=%t/lock/geodata ReadWritePaths=/var/www/webmap/raster PrivateTmp=yes [Install] -WantedBy=webmap-update@%i.target +WantedBy=geodata-update@%i.target diff --git a/files/etc/systemd/system/geodata-update@.target b/files/etc/systemd/system/geodata-update@.target new file mode 100644 index 0000000..e7cdecb --- /dev/null +++ b/files/etc/systemd/system/geodata-update@.target @@ -0,0 +1,3 @@ +[Unit] +Description=Geodata updater (target unit ‘%I’) +StopWhenUnneeded=true diff --git a/files/etc/systemd/system/webmap-update@.timer b/files/etc/systemd/system/geodata-update@.timer index 74fb848..90fd865 100644 --- a/files/etc/systemd/system/webmap-update@.timer +++ b/files/etc/systemd/system/geodata-update@.timer @@ -1,11 +1,11 @@ [Unit] -Description=Webmap updater (timer unit) +Description=Geodata updater (timer unit) [Timer] OnCalendar=*-*-* 01:00:00 AccuracySec=1s RandomizedDelaySec=3599 -Unit=webmap-update@%i.target +Unit=geodata-update@%i.target [Install] WantedBy=timers.target diff --git a/files/etc/systemd/system/webmap-update@.target b/files/etc/systemd/system/webmap-update@.target deleted file mode 100644 index 840de96..0000000 --- a/files/etc/systemd/system/webmap-update@.target +++ /dev/null @@ -1,3 +0,0 @@ -[Unit] -Description=Webmap updater (target unit ‘%I’) -StopWhenUnneeded=true diff --git a/files/etc/tmpfiles.d/geodata.conf b/files/etc/tmpfiles.d/geodata.conf new file mode 100644 index 0000000..a299e0f --- /dev/null +++ b/files/etc/tmpfiles.d/geodata.conf @@ -0,0 +1,8 @@ +d %t/lock/geodata 00755 root root + +# for `geodata-download --lockdir` *and* `geodata-import --lockdir-sources` +# (hence the set-group-ID bit and g+w) +d %t/lock/geodata/cache 02775 _geodata-download _geodata + +# for `geodata-import --lockfile` +f %t/lock/geodata/lock 00644 _geodata _geodata diff --git a/files/etc/tmpfiles.d/webmap.conf b/files/etc/tmpfiles.d/webmap.conf deleted file mode 100644 index 786e6dd..0000000 --- a/files/etc/tmpfiles.d/webmap.conf +++ /dev/null @@ -1,8 +0,0 @@ -d %t/lock/webmap 00755 root root - -# for `webmap-download --lockdir` *and* `webmap-import --lockdir-sources` -# (hence the set-group-ID bit and g+w) -d %t/lock/webmap/cache 02775 _webmap-download _webmap - -# for `webmap-import --lockfile` -f %t/lock/webmap/lock 00644 _webmap _webmap diff --git a/group_vars/all.yml b/group_vars/all.yml index 4caa775..3531f04 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml @@ -1,7 +1,7 @@ --- # The list of layer groups to process, see # webmap-tools/config.yml:layer-groups. -webmap_layer_groups: +geodata_layer_groups: - adm - mrr - skydd @@ -13,15 +13,15 @@ webmap_layer_groups: - misc - nv -webmap_raster: +geodata_raster: - kskog -webmap_layer_groups_nodownload: +geodata_layer_groups_nodownload: - adm - misc # adjust calendar events for individual units -webmap_layer_groups_update_calendar: +geodata_layer_groups_update_calendar: mrr: "*-*-* 05:00:00" # updated daily at 04:33 CEST # PostgreSQL's version number and cluster name @@ -22,6 +22,10 @@ tags: - mail - postfix + - import_tasks: ./tasks/geodata.yml + tags: geodata + - import_tasks: ./tasks/postgis.yml + tags: postgis - import_tasks: ./tasks/webmap.yml tags: webmap - import_tasks: ./tasks/httpd.yml diff --git a/tasks/geodata.yml b/tasks/geodata.yml new file mode 100644 index 0000000..fcf3471 --- /dev/null +++ b/tasks/geodata.yml @@ -0,0 +1,211 @@ +- name: Install gdal-bin + apt: pkg=gdal-bin install-recommends=true + +- name: Install unzip + apt: pkg=unzip + +- name: Install python dependencies + apt: pkg={{ packages }} + vars: + packages: + - python3 + - python3-brotli + - python3-gdal + - python3-requests + - python3-systemd + - python3-tqdm + - python3-urllib3 + - python3-xdg + - python3-yaml + +- name: Create directory /etc/geodata + file: path=/etc/geodata + state=directory + owner=root group=root + mode=0755 + +- name: Copy /etc/geodata/config.yml + copy: src=webmap-tools/config.yml + dest=/etc/geodata/config.yml + owner=root group=root + mode=0644 + +- name: Create directory /usr/local/share/geodata + file: path=/usr/local/share/geodata + state=directory + owner=root group=root + mode=0755 + +- name: Copy /usr/local/share/geodata/*.py modules + copy: src=webmap-tools/{{ item }} + dest=/usr/local/share/geodata/{{ item }} + owner=root group=root + mode=0644 + with_items: + # TODO these should be compiled + - common.py + - common_gdal.py + - import_source.py + - export_mvt.py + - export_raster.py + - rename_exchange.py + +- name: Copy geodata-update@.target + copy: src=etc/systemd/system/geodata-update@.target + dest=/etc/systemd/system/geodata-update@.target + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Copy geodata-update@.timer + copy: src=etc/systemd/system/geodata-update@.timer + dest=/etc/systemd/system/geodata-update@.timer + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Create directory /etc/systemd/system/geodata-update@*.timer.d + file: path=/etc/systemd/system/geodata-update@{{ item }}.timer.d + state=directory + owner=root group=root + mode=0755 + with_items: "{{ geodata_layer_groups_update_calendar.keys() | list }}" + +- name: Copy /etc/systemd/system/geodata-update@*.timer.d/override.conf + template: src=etc/systemd/system/geodata-update@.timer.d/override.conf.j2 + dest=/etc/systemd/system/geodata-update@{{ item }}.timer.d/override.conf + owner=root group=root + mode=0644 + with_items: "{{ geodata_layer_groups_update_calendar.keys() | list }}" + notify: + - systemctl daemon-reload + +- name: Enable geodata-update.timer + service: name=geodata-update@{{ item }}.timer state=started enabled=true + with_items: "{{ geodata_layer_groups | union(geodata_raster) }}" + +- meta: flush_handlers + + +- name: Create system group '_geodata' + group: name=_geodata system=true + state=present + +- name: Create system user '_geodata-download' + user: name=_geodata-download system=true + group=_geodata + createhome=false + home=/nonexistent + shell=/usr/sbin/nologin + comment="geodata update (download)" + password="!" + state=present + +- name: Copy /usr/local/share/geodata/download.py + copy: src=webmap-tools/geodata-download + dest=/usr/local/share/geodata/download.py + owner=root group=root + mode=0755 + +- name: Create /usr/local/bin/geodata-download + file: src=../share/geodata/download.py + dest=/usr/local/bin/geodata-download + owner=root group=root + state=link force=yes + +- name: Create directory /var/cache/geodata + file: path=/var/cache/geodata + state=directory + owner=_geodata-download group=root + mode=0755 + +- name: Create directory /var/cache/geodata/custom + file: path=/var/cache/geodata/custom + state=directory + owner=root group=root + mode=0755 + +- name: Copy custom layers into /var/cache/geodata/custom + copy: src=webmap-tools/layers/custom/ + dest=/var/cache/geodata/custom/ + owner=root group=root + mode=0644 + directory_mode=0755 + +- name: Copy geodata-download@.service + copy: src=etc/systemd/system/geodata-download@.service + dest=/etc/systemd/system/geodata-download@.service + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Enable geodata-download@.service + service: name=geodata-download@{{ item }}.service enabled=true + with_items: "{{ geodata_layer_groups | union(geodata_raster) | difference(geodata_layer_groups_nodownload) }}" + +- name: Disable some geodata-download@.service + service: name=geodata-download@{{ item }}.service enabled=false + with_items: "{{ geodata_layer_groups_nodownload }}" + +- meta: flush_handlers + + +- name: Copy /etc/tmpfiles.d/geodata.conf + copy: src=etc/tmpfiles.d/geodata.conf + dest=/etc/tmpfiles.d/geodata.conf + owner=root group=root + mode=0644 + notify: + - systemd-tmpfiles --create + +- meta: flush_handlers + + +- name: Create system user '_geodata' + user: name=_geodata system=true + group=_geodata + createhome=false + home=/nonexistent + shell=/usr/sbin/nologin + comment="geodata update (extract/import)" + password="!" + state=present + +- name: Copy /usr/local/share/geodata/import.py + copy: src=webmap-tools/geodata-import + dest=/usr/local/share/geodata/import.py + owner=root group=root + mode=0755 + +- name: Create /usr/local/bin/geodata-import + file: src=../share/geodata/import.py + dest=/usr/local/bin/geodata-import + owner=root group=root + state=link force=yes + +- name: Copy geodata-import@.service + copy: src=etc/systemd/system/geodata-import@.service + dest=/etc/systemd/system/geodata-import@.service + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Enable geodata-import@.service + service: name=geodata-import@{{ item }}.service enabled=true + with_items: "{{ geodata_layer_groups }}" + +- name: Copy geodata-raster@.service + copy: src=etc/systemd/system/geodata-raster@.service + dest=/etc/systemd/system/geodata-raster@.service + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Enable geodata-raster@.service + service: name=geodata-raster@{{ item }}.service enabled=true + with_items: "{{ geodata_raster }}" diff --git a/tasks/postgis.yml b/tasks/postgis.yml new file mode 100644 index 0000000..3e156a9 --- /dev/null +++ b/tasks/postgis.yml @@ -0,0 +1,158 @@ +- name: Install PostgreSQL and PostGIS + apt: pkg={{ packages }} + vars: + packages: + - postgresql + - postgresql-postgis + - postgis + # for ansible + - python3-psycopg + +- name: Generate sv_SE.UTF-8 locales + locale_gen: name=sv_SE.UTF-8 state=present + # PostgreSQL needs to be restarted to see the new locale + notify: Restart PostgreSQL + +- name: Configure PostgreSQL + copy: src=etc/postgresql/postgresql.conf + dest=/etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/conf.d/local.conf + owner=postgres group=postgres + mode=0644 + notify: Restart PostgreSQL + +- name: Start PostgreSQL + service: name=postgresql@{{ postgresql.version }}-{{ postgresql.cluster }}.service state=started + +- meta: flush_handlers + +# Usage: \sudo -u postgres psql </usr/local/share/geodata/schema.sql +- name: Copy /usr/local/share/geodata/schema.sql + copy: src=webmap-tools/schema.sql + dest=/usr/local/share/geodata/schema.sql + owner=root group=root + mode=0644 + +- name: Create PostgreSQL database + become: true + # XXX: this creates /var/lib/postgresql/.ansible/tmp + become_user: postgres + community.postgresql.postgresql_db: + name: geodata + comment: Backend PostGIS database for KlimatanalysNorr tooling + encoding: UTF-8 + lc_collate: sv_SE.UTF-8 + lc_ctype: sv_SE.UTF-8 + locale_provider: icu + icu_locale: sv-SE-x-icu + template: template0 + owner: postgres + +- name: Create 'geodata' and 'guest' PostgreSQL users (roles) + become: true + become_user: postgres + community.postgresql.postgresql_user: + login_db: geodata + name: "{{ item }}" + with_items: + - geodata + - guest + +- name: Add a rule for 'geodata' user in pg_hba.conf + ansible.builtin.lineinfile: + path: /etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/pg_hba.conf + regexp: '^local\s+geodata\s' + line: 'local geodata all peer map=pgmap_geodata' + # must come before 'local all all peer', cf. + # https://dba.stackexchange.com/questions/177142/postgresql-cannot-peer-authenticate-using-usermap-provided-user-name-dbuser + insertbefore: '^local\s+all\s+all\s' + create: false + notify: Reload PostgreSQL + +- name: Add a mapping rule for 'geodata' user in pg_ident.conf + ansible.builtin.lineinfile: + path: /etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/pg_ident.conf + regexp: '^pgmap_geodata\s.*\sgeodata\s*$' + line: 'pgmap_geodata _geodata geodata' + create: false + notify: Reload PostgreSQL + +- name: Add a mapping rule for 'guest' user in pg_ident.conf + ansible.builtin.lineinfile: + path: /etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/pg_ident.conf + regexp: '^pgmap_geodata\s.*\sguest\s*$' + line: 'pgmap_geodata /^_?[a-zA-Z][a-zA-Z0-9_\-]*[a-zA-Z0-9]$ guest' + create: false + notify: Reload PostgreSQL + +- name: Create PostgreSQL schemas + become: true + become_user: postgres + community.postgresql.postgresql_schema: + login_db: geodata + name: "{{ item.name }}" + owner: postgres + comment: "{{ item.comment }}" + with_items: "{{ postgis_schemas }}" + +- name: Install 'postgis' PostgreSQL extension to the geodata database + become: true + become_user: postgres + community.postgresql.postgresql_ext: + name: postgis + login_db: geodata + comment: Geographic objects support for PostgreSQL + +- name: GRANT CONNECT ON DATABASE geodata TO geodata, guest + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: geodata + privs: CONNECT + type: database + role: geodata,guest + +- name: GRANT USAGE ON SCHEMA * TO geodata, guest + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: geodata + privs: USAGE + type: schema + objs: "{{ (['public'] + (postgis_schemas | map(attribute='name'))) | join(',') }}" + role: geodata,guest + +# tooling should TRUNCATE existing output layers instead +- name: REVOKE CREATE ON SCHEMA * FROM geodata + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: geodata + privs: CREATE + type: schema + objs: "{{ (['public'] + (postgis_schemas | map(attribute='name'))) | join(',') }}" + role: geodata + state: absent + +- name: GRANT SELECT ON TABLES IN SCHEMA * TO guest + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: geodata + privs: SELECT + type: table + obj: ALL_IN_SCHEMA + schema: "{{ item }}" + role: guest + with_items: "{{ ['public'] + (postgis_schemas | map(attribute='name')) }}" + +- name: GRANT USAGE, SELECT ON SEQUENCES IN SCHEMA * TO guest + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: geodata + privs: USAGE,SELECT + type: sequence + obj: ALL_IN_SCHEMA + schema: "{{ item }}" + role: guest + with_items: "{{ ['public'] + (postgis_schemas | map(attribute='name')) }}" diff --git a/tasks/webmap.yml b/tasks/webmap.yml index 1ff8ea3..682e785 100644 --- a/tasks/webmap.yml +++ b/tasks/webmap.yml @@ -1,367 +1,5 @@ -- name: Install gdal-bin - apt: pkg=gdal-bin install-recommends=true - -- name: Install unzip and brotli - apt: pkg={{ packages }} - vars: - packages: - - unzip - - brotli - -- name: Install python dependencies - apt: pkg={{ packages }} - vars: - packages: - - python3 - - python3-brotli - - python3-gdal - - python3-requests - - python3-systemd - - python3-tqdm - - python3-urllib3 - - python3-xdg - - python3-yaml - -- name: Create directory /etc/webmap - file: path=/etc/webmap - state=directory - owner=root group=root - mode=0755 - -- name: Copy /etc/webmap/config.yml - copy: src=webmap-tools/config.yml - dest=/etc/webmap/config.yml - owner=root group=root - mode=0644 - -- name: Create directory /usr/local/share/webmap - file: path=/usr/local/share/webmap - state=directory - owner=root group=root - mode=0755 - -- name: Copy /usr/local/share/webmap/*.py modules - copy: src=webmap-tools/{{ item }} - dest=/usr/local/share/webmap/{{ item }} - owner=root group=root - mode=0644 - with_items: - # TODO these should be compiled - - common.py - - common_gdal.py - - import_source.py - - export_mvt.py - - export_raster.py - - rename_exchange.py - -- name: Copy webmap-update@.target - copy: src=etc/systemd/system/webmap-update@.target - dest=/etc/systemd/system/webmap-update@.target - owner=root group=root - mode=0644 - notify: - - systemctl daemon-reload - -- name: Copy webmap-update@.timer - copy: src=etc/systemd/system/webmap-update@.timer - dest=/etc/systemd/system/webmap-update@.timer - owner=root group=root - mode=0644 - notify: - - systemctl daemon-reload - -- name: Create directory /etc/systemd/system/webmap-update@*.timer.d - file: path=/etc/systemd/system/webmap-update@{{ item }}.timer.d - state=directory - owner=root group=root - mode=0755 - with_items: "{{ webmap_layer_groups_update_calendar.keys() | list }}" - -- name: Copy /etc/systemd/system/webmap-update@*.timer.d/override.conf - template: src=etc/systemd/system/webmap-update@.timer.d/override.conf.j2 - dest=/etc/systemd/system/webmap-update@{{ item }}.timer.d/override.conf - owner=root group=root - mode=0644 - with_items: "{{ webmap_layer_groups_update_calendar.keys() | list }}" - notify: - - systemctl daemon-reload - -- name: Enable webmap-update.timer - service: name=webmap-update@{{ item }}.timer state=started enabled=true - with_items: "{{ webmap_layer_groups | union(webmap_raster) }}" - -- meta: flush_handlers - - -- name: Create system group '_webmap' - group: name=_webmap system=true - state=present - -- name: Create system user '_webmap-download' - user: name=_webmap-download system=true - group=_webmap - createhome=false - home=/nonexistent - shell=/usr/sbin/nologin - comment="Webmap update (download)" - password="!" - state=present - -- name: Copy /usr/local/share/webmap/download.py - copy: src=webmap-tools/webmap-download - dest=/usr/local/share/webmap/download.py - owner=root group=root - mode=0755 - -- name: Create /usr/local/bin/webmap-download - file: src=../share/webmap/download.py - dest=/usr/local/bin/webmap-download - owner=root group=root - state=link force=yes - -- name: Create directory /var/cache/webmap - file: path=/var/cache/webmap - state=directory - owner=_webmap-download group=root - mode=0755 - -- name: Create directory /var/cache/webmap/custom - file: path=/var/cache/webmap/custom - state=directory - owner=root group=root - mode=0755 - -- name: Copy custom layers into /var/cache/webmap/custom - copy: src=webmap-tools/layers/custom/ - dest=/var/cache/webmap/custom/ - owner=root group=root - mode=0644 - directory_mode=0755 - -- name: Copy webmap-download@.service - copy: src=etc/systemd/system/webmap-download@.service - dest=/etc/systemd/system/webmap-download@.service - owner=root group=root - mode=0644 - notify: - - systemctl daemon-reload - -- name: Enable webmap-download@.service - service: name=webmap-download@{{ item }}.service enabled=true - with_items: "{{ webmap_layer_groups | union(webmap_raster) | difference(webmap_layer_groups_nodownload) }}" - -- name: Disable some webmap-download@.service - service: name=webmap-download@{{ item }}.service enabled=false - with_items: "{{ webmap_layer_groups_nodownload }}" - -- meta: flush_handlers - - -- name: Create system user '_webmap' - user: name=_webmap system=true - group=_webmap - createhome=false - home=/nonexistent - shell=/usr/sbin/nologin - comment="Webmap update (extract/import)" - password="!" - state=present - -- name: Install PostgreSQL and PostGIS - apt: pkg={{ packages }} - vars: - packages: - - postgresql - - postgresql-postgis - - postgis - # for ansible - - python3-psycopg - -- name: Generate sv_SE.UTF-8 locales - locale_gen: name=sv_SE.UTF-8 state=present - # PostgreSQL needs to be restarted to see the new locale - notify: Restart PostgreSQL - -- name: Configure PostgreSQL - copy: src=etc/postgresql/postgresql.conf - dest=/etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/conf.d/local.conf - owner=postgres group=postgres - mode=0644 - notify: Restart PostgreSQL - -- name: Start PostgreSQL - service: name=postgresql@{{ postgresql.version }}-{{ postgresql.cluster }}.service state=started - -- meta: flush_handlers - -# Usage: \sudo -u postgres psql </usr/local/share/webmap/schema.sql -- name: Copy /usr/local/share/webmap/schema.sql - copy: src=webmap-tools/schema.sql - dest=/usr/local/share/webmap/schema.sql - owner=root group=root - mode=0644 - -- name: Create PostgreSQL database - become: true - # XXX: this creates /var/lib/postgresql/.ansible/tmp - become_user: postgres - community.postgresql.postgresql_db: - name: webmap - comment: Backend PostGIS database for KlimatanalysNorr tooling - encoding: UTF-8 - lc_collate: sv_SE.UTF-8 - lc_ctype: sv_SE.UTF-8 - locale_provider: icu - icu_locale: sv-SE-x-icu - template: template0 - owner: postgres - -- name: Create 'webmap_import' and 'webmap_guest' PostgreSQL users (roles) - become: true - become_user: postgres - community.postgresql.postgresql_user: - login_db: webmap - name: "{{ item }}" - with_items: - - webmap_import - - webmap_guest - -- name: Add a rule for 'webmap_import' user in pg_hba.conf - ansible.builtin.lineinfile: - path: /etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/pg_hba.conf - regexp: '^local\s+webmap\s' - line: 'local webmap all peer map=pgmap_webmap' - # must come before 'local all all peer', cf. - # https://dba.stackexchange.com/questions/177142/postgresql-cannot-peer-authenticate-using-usermap-provided-user-name-dbuser - insertbefore: '^local\s+all\s+all\s' - create: false - notify: Reload PostgreSQL - -- name: Add a mapping rule for 'webmap_import' user in pg_ident.conf - ansible.builtin.lineinfile: - path: /etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/pg_ident.conf - regexp: '^pgmap_webmap\s.*\swebmap_import\s*$' - line: 'pgmap_webmap _webmap webmap_import' - create: false - notify: Reload PostgreSQL - -- name: Add a mapping rule for 'webmap_guest' user in pg_ident.conf - ansible.builtin.lineinfile: - path: /etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/pg_ident.conf - regexp: '^pgmap_webmap\s.*\swebmap_guest\s*$' - line: 'pgmap_webmap /^_?[a-zA-Z][a-zA-Z0-9_\-]*[a-zA-Z0-9]$ webmap_guest' - create: false - notify: Reload PostgreSQL - -- name: Create PostgreSQL schemas - become: true - become_user: postgres - community.postgresql.postgresql_schema: - login_db: webmap - name: "{{ item.name }}" - owner: postgres - comment: "{{ item.comment }}" - with_items: "{{ postgis_schemas }}" - -- name: Install 'postgis' PostgreSQL extension to the webmap database - become: true - become_user: postgres - community.postgresql.postgresql_ext: - name: postgis - login_db: webmap - comment: Geographic objects support for PostgreSQL - -- name: GRANT CONNECT ON DATABASE webmap TO webmap_import, webmap_guest - become: true - become_user: postgres - community.postgresql.postgresql_privs: - login_db: webmap - privs: CONNECT - type: database - role: webmap_import,webmap_guest - -- name: GRANT USAGE ON SCHEMA * TO webmap_import, webmap_guest - become: true - become_user: postgres - community.postgresql.postgresql_privs: - login_db: webmap - privs: USAGE - type: schema - objs: "{{ (['public'] + (postgis_schemas | map(attribute='name'))) | join(',') }}" - role: webmap_import,webmap_guest - -# tooling should TRUNCATE existing output layers instead -- name: REVOKE CREATE ON SCHEMA * FROM webmap_import - become: true - become_user: postgres - community.postgresql.postgresql_privs: - login_db: webmap - privs: CREATE - type: schema - objs: "{{ (['public'] + (postgis_schemas | map(attribute='name'))) | join(',') }}" - role: webmap_import - state: absent - -- name: GRANT SELECT ON TABLES IN SCHEMA * TO webmap_guest - become: true - become_user: postgres - community.postgresql.postgresql_privs: - login_db: webmap - privs: SELECT - type: table - obj: ALL_IN_SCHEMA - schema: "{{ item }}" - role: webmap_guest - with_items: "{{ ['public'] + (postgis_schemas | map(attribute='name')) }}" - -- name: GRANT USAGE, SELECT ON SEQUENCES IN SCHEMA * TO webmap_guest - become: true - become_user: postgres - community.postgresql.postgresql_privs: - login_db: webmap - privs: USAGE,SELECT - type: sequence - obj: ALL_IN_SCHEMA - schema: "{{ item }}" - role: webmap_guest - with_items: "{{ ['public'] + (postgis_schemas | map(attribute='name')) }}" - -- name: Copy /usr/local/share/webmap/import.py - copy: src=webmap-tools/webmap-import - dest=/usr/local/share/webmap/import.py - owner=root group=root - mode=0755 - -- name: Create /usr/local/bin/webmap-import - file: src=../share/webmap/import.py - dest=/usr/local/bin/webmap-import - owner=root group=root - state=link force=yes - -- name: Copy webmap-import@.service - copy: src=etc/systemd/system/webmap-import@.service - dest=/etc/systemd/system/webmap-import@.service - owner=root group=root - mode=0644 - notify: - - systemctl daemon-reload - -- name: Enable webmap-import@.service - service: name=webmap-import@{{ item }}.service enabled=true - with_items: "{{ webmap_layer_groups }}" - -- name: Copy webmap-raster@.service - copy: src=etc/systemd/system/webmap-raster@.service - dest=/etc/systemd/system/webmap-raster@.service - owner=root group=root - mode=0644 - notify: - - systemctl daemon-reload - -- name: Enable webmap-raster@.service - service: name=webmap-raster@{{ item }}.service enabled=true - with_items: "{{ webmap_raster }}" - +- name: Install brotli + apt: pkg=brotli - name: Build administrative-codes.json* become: false @@ -391,24 +29,15 @@ - name: Create directory /var/www/webmap/tiles file: path=/var/www/webmap/tiles state=directory - owner=_webmap group=root + owner=_geodata group=root mode=0755 - name: Create directory /var/www/webmap/raster file: path=/var/www/webmap/raster state=directory - owner=_webmap group=root + owner=_geodata group=root mode=0755 - -- name: Copy /etc/tmpfiles.d/webmap.conf - copy: src=etc/tmpfiles.d/webmap.conf - dest=/etc/tmpfiles.d/webmap.conf - owner=root group=root - mode=0644 - notify: - - systemd-tmpfiles --create - - meta: flush_handlers diff --git a/templates/etc/systemd/system/geodata-update@.timer.d/override.conf.j2 b/templates/etc/systemd/system/geodata-update@.timer.d/override.conf.j2 new file mode 100644 index 0000000..103fbde --- /dev/null +++ b/templates/etc/systemd/system/geodata-update@.timer.d/override.conf.j2 @@ -0,0 +1,3 @@ +[Timer] +OnCalendar= +OnCalendar={{ geodata_layer_groups_update_calendar[item] }} diff --git a/templates/etc/systemd/system/webmap-cgi.service b/templates/etc/systemd/system/webmap-cgi.service index 809d104..9c9ffe9 100644 --- a/templates/etc/systemd/system/webmap-cgi.service +++ b/templates/etc/systemd/system/webmap-cgi.service @@ -17,7 +17,7 @@ ExecStart=/usr/bin/uwsgi -M -p2 \ --harakiri 60 \ --lazy-apps \ --plugins python3 \ - --pythonpath /usr/local/share/webmap \ + --pythonpath /usr/local/share/geodata \ --wsgi-file /usr/local/libexec/webmap-cgi Nice=10 RestartSec=15s diff --git a/templates/etc/systemd/system/webmap-update@.timer.d/override.conf.j2 b/templates/etc/systemd/system/webmap-update@.timer.d/override.conf.j2 deleted file mode 100644 index 795ee20..0000000 --- a/templates/etc/systemd/system/webmap-update@.timer.d/override.conf.j2 +++ /dev/null @@ -1,3 +0,0 @@ -[Timer] -OnCalendar= -OnCalendar={{ webmap_layer_groups_update_calendar[item] }} diff --git a/webmap-tools b/webmap-tools -Subproject dac98568efd76dea7e7149c55a841218ea73378 +Subproject ca91a579770c89d25aefae220079bf336fa88dc |