2 files changed, 44 insertions, 0 deletions
diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/webmap-import@.service
index 964c37d..e2a6eb4 100644
--- a/files/etc/systemd/system/webmap-import@.service
+++ b/files/etc/systemd/system/webmap-import@.service
@@ -11,6 +11,9 @@ Group=_webmap
 Nice=15
 IOSchedulingClass=idle
 
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
 Type=oneshot
 ExecStart=/usr/local/bin/webmap-import \
     --cachedir=%C/webmap \
@@ -18,6 +21,7 @@ ExecStart=/usr/local/bin/webmap-import \
     --lockdir-sources=%t/lock/webmap/cache \
     --mvtdir=/var/www/webmap/tiles/%I \
     --mvt-compress \
+    --metadata-compress \
     -- %I
 
 # Hardening
diff --git a/files/etc/systemd/system/webmap-raster@.service b/files/etc/systemd/system/webmap-raster@.service
new file mode 100644
index 0000000..42a97cf
--- /dev/null
+++ b/files/etc/systemd/system/webmap-raster@.service
@@ -0,0 +1,40 @@
+[Unit]
+Description=Webmap updater service (export ‘%I’ to COG)
+After=webmap-update@%i.target
+After=webmap-download@%i.service
+Upholds=webmap-update@%i.target
+
+[Service]
+User=_webmap
+Group=_webmap
+
+Nice=15
+IOSchedulingClass=idle
+
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
+Type=oneshot
+ExecStart=/usr/local/bin/webmap-import \
+    --cachedir=%C/webmap \
+    --lockfile=%t/lock/webmap/lock \
+    --lockdir-sources=%t/lock/webmap/cache \
+    --rasterdir=/var/www/webmap/raster/%I \
+    --metadata-compress \
+    -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX
+ReadWritePaths=%t/lock/webmap
+ReadWritePaths=/var/www/webmap/raster
+PrivateTmp=yes
+
+[Install]
+WantedBy=webmap-update@%i.target