8 files changed, 97 insertions, 65 deletions
diff --git a/files/etc/nginx/sites-available/webmap b/files/etc/nginx/sites-available/webmap
index 6921c2c..efb062a 100644
--- a/files/etc/nginx/sites-available/webmap
+++ b/files/etc/nginx/sites-available/webmap
@@ -54,7 +54,14 @@ server {
     add_header X-XSS-Protection "1; mode=block";
     add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always;
     add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; form-action 'none'; base-uri 'self'";
-    #add_header Access-Control-Allow-Origin "*" always;
+    #add_header Access-Control-Allow-Origin $http_origin always;
+
+    include mime.types;
+    types {
+        # application/protobuf and application/vnd.google.protobuf might be valid types too, cf.
+        # https://stackoverflow.com/questions/30505408/what-is-the-correct-protobuf-content-type
+        application/x-protobuf pbf;
+    }
 
     location ^~ /assets/ {
         expires 7d;
@@ -62,11 +69,29 @@ server {
         try_files $uri =404;
     }
     location ^~ /tiles/ {
-        expires 8h;
+        expires 30m;
         brotli_static on;
         try_files $uri =404;
+        # service an empty payload to save bandwidth
         error_page 404 /_.txt;
     }
+    location = /q {
+        expires epoch;
+        limit_except POST { deny all; }
+        #if ($request_method = OPTIONS) {
+        #    add_header Strict-Transport-Security "max-age=31557600; includeSubDomains";
+        #    add_header Access-Control-Allow-Origin $http_origin;
+        #    add_header Access-Control-Allow-Methods "POST, GET, OPTIONS";
+        #    add_header Access-Control-Allow-Headers "Accept, Content-Type";
+        #    add_header Access-Control-Max-Age 28800;
+        #    return 204;
+        #}
+        client_max_body_size 64k;
+        gzip on;
+        gzip_types application/json text/plain;
+        include uwsgi_params;
+        uwsgi_pass unix:/run/webmap-cgi.socket;
+    }
     location = /tiles/metadata.json {
         expires epoch;
         brotli_static on;
@@ -74,10 +99,10 @@ server {
     }
 
     location = /_.txt {
-        # cache 404 responses for 8h like for valid tiles
+        # cache 404 responses for 30m like for valid tiles
         add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always;
-        add_header Cache-Control "public; max-age=28800" always;
-        #add_header Access-Control-Allow-Origin "*" always;
+        add_header Cache-Control "public; max-age=1800" always;
+        #add_header Access-Control-Allow-Origin $http_origin always;
         internal;
     }
 
diff --git a/files/etc/postgresql/postgresql.conf b/files/etc/postgresql/postgresql.conf
new file mode 100644
index 0000000..038438a
--- /dev/null
+++ b/files/etc/postgresql/postgresql.conf
@@ -0,0 +1,4 @@
+shared_buffers = 768MB
+temp_buffers = 128MB
+work_mem = 16MB
+effective_cache_size = 1536MB
diff --git a/files/etc/systemd/system/webmap-cgi.service b/files/etc/systemd/system/webmap-cgi.service
new file mode 100644
index 0000000..88f22e5
--- /dev/null
+++ b/files/etc/systemd/system/webmap-cgi.service
@@ -0,0 +1,36 @@
+[Unit]
+Description=Webmap CGI (Common Gateway Interface)
+After=syslog.target network.target postgresql.service
+
+[Service]
+DynamicUser=yes
+User=_webmap-cgi
+# Note: the "WARNING: you have enabled harakiri without post buffering" can
+# be ignored because body requests are in fact buffered on the nginx side
+ExecStart=/usr/bin/uwsgi -M -p2 \
+    --single-interpreter --die-on-term \
+    --close-on-exec --close-on-exec2 \
+    --max-requests 1000 \
+    --max-worker-lifetime 86400 \
+    --max-worker-lifetime-delta 11 \
+    --harakiri 60 \
+    --lazy-apps \
+    --plugins python3 \
+    --pythonpath /usr/local/share/webmap \
+    --wsgi-file /usr/libexec/webmap-cgi
+Nice=10
+RestartSec=15s
+Restart=always
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX
+
+[Install]
+WantedBy=multi-user.target
diff --git a/files/etc/systemd/system/webmap-cgi.socket b/files/etc/systemd/system/webmap-cgi.socket
new file mode 100644
index 0000000..2828985
--- /dev/null
+++ b/files/etc/systemd/system/webmap-cgi.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Webmap CGI (Common Gateway Interface) activation socket
+After=syslog.target network.target
+
+[Socket]
+ListenStream=%t/webmap-cgi.socket
+SocketUser=www-data
+SocketMode=0666
+
+[Install]
+WantedBy=sockets.target
diff --git a/files/etc/systemd/system/webmap-download@.service b/files/etc/systemd/system/webmap-download@.service
index e6b7f44..d7a49dc 100644
--- a/files/etc/systemd/system/webmap-download@.service
+++ b/files/etc/systemd/system/webmap-download@.service
@@ -15,8 +15,8 @@ IOSchedulingClass=idle
 
 Type=oneshot
 ExecStart=/usr/local/bin/webmap-download \
-    --cachedir=/var/cache/webmap \
-    --lockdir=%t/lock/webmap/download \
+    --cachedir=%C/webmap \
+    --lockdir=%t/lock/webmap/cache \
     --no-exit-code \
     --quiet \
     -- %I
@@ -30,8 +30,8 @@ ProtectControlGroups=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-ReadWritePaths=/var/cache/webmap
-ReadWritePaths=%t/lock/webmap/download
+ReadWritePaths=%C/webmap
+ReadWritePaths=%t/lock/webmap/cache
 
 [Install]
 WantedBy=webmap-update@%i.target
diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/webmap-import@.service
index 30300a5..964c37d 100644
--- a/files/etc/systemd/system/webmap-import@.service
+++ b/files/etc/systemd/system/webmap-import@.service
@@ -4,14 +4,8 @@ After=postgresql.service webmap-update@%i.target
 After=webmap-download@%i.service
 Upholds=webmap-update@%i.target
 
-# XXX webmap-download write cached files atomatically but there is no
-# guarantee that GDAL/OGR opens them atomically.  It'd therefore make
-# sense to use the following Conflict= directive, however systemd skips
-# webmap-download@%i.service in that case.
-#Conflicts=webmap-download@%i.service
-
 [Service]
-User=_webmap-import
+User=_webmap
 Group=_webmap
 
 Nice=15
@@ -19,8 +13,11 @@ IOSchedulingClass=idle
 
 Type=oneshot
 ExecStart=/usr/local/bin/webmap-import \
-    --cachedir=/var/cache/webmap \
+    --cachedir=%C/webmap \
     --lockfile=%t/lock/webmap/lock \
+    --lockdir-sources=%t/lock/webmap/cache \
+    --mvtdir=/var/www/webmap/tiles/%I \
+    --mvt-compress \
     -- %I
 
 # Hardening
@@ -33,6 +30,7 @@ ProtectKernelModules=yes
 ProtectKernelTunables=yes
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 ReadWritePaths=%t/lock/webmap
+ReadWritePaths=/var/www/webmap/tiles
 PrivateTmp=yes
 
 [Install]
diff --git a/files/etc/systemd/system/webmap-publish@.service b/files/etc/systemd/system/webmap-publish@.service
deleted file mode 100644
index 9d138da..0000000
--- a/files/etc/systemd/system/webmap-publish@.service
+++ /dev/null
@@ -1,39 +0,0 @@
-[Unit]
-Description=Webmap updater service (publish ‘%I’ as MVT)
-#After=postgresql.service webmap-update@%i.target
-#After=webmap-download@%i.service
-#After=webmap-import@%i.service
-#Upholds=webmap-update@%i.target
-
-[Service]
-User=_webmap-publish
-Group=_webmap
-
-Nice=15
-IOSchedulingClass=idle
-
-Type=oneshot
-ExecStart=/usr/local/bin/webmap-publish \
-    --lockfile=%t/lock/webmap/lock \
-    --destdir=/var/www/webmap/tiles/%I \
-    --webroot=/var/www/webmap \
-    --metadata=/var/www/webmap/tiles/metadata.json \
-    --metadata-lockfile=%t/lock/webmap/tiles.lock \
-    --compress \
-    -- %I
-
-# Hardening
-NoNewPrivileges=yes
-ProtectHome=yes
-ProtectSystem=strict
-PrivateDevices=yes
-ProtectControlGroups=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-ReadWritePaths=/var/www/webmap/tiles
-ReadWritePaths=%t/lock/webmap
-PrivateTmp=yes
-
-#[Install]
-#WantedBy=webmap-update@%i.target
diff --git a/files/etc/tmpfiles.d/webmap.conf b/files/etc/tmpfiles.d/webmap.conf
index 620cd24..786e6dd 100644
--- a/files/etc/tmpfiles.d/webmap.conf
+++ b/files/etc/tmpfiles.d/webmap.conf
@@ -1,11 +1,8 @@
-d %t/lock/webmap            0755 root root
+d %t/lock/webmap            00755 root root
 
-# for webmap-download's --lockdir
-d %t/lock/webmap/download   0755 _webmap-download _webmap
+# for `webmap-download --lockdir` *and* `webmap-import --lockdir-sources`
+# (hence the set-group-ID bit and g+w)
+d %t/lock/webmap/cache      02775 _webmap-download _webmap
 
-# for webmap-import's *and* webmap-publish's --lockfile (hence the
-# ownership and g+w)
-f %t/lock/webmap/lock       0664 root _webmap
-
-# for webmap-publish's --metadata-lockfile
-f %t/lock/webmap/tiles.lock 0644 _webmap-publish _webmap
+# for `webmap-import --lockfile`
+f %t/lock/webmap/lock       00644 _webmap _webmap