5 files changed, 60 insertions, 16 deletions
diff --git a/files/etc/apt/listchanges.conf b/files/etc/apt/listchanges.conf
index 96910a0..713cbbd 100644
--- a/files/etc/apt/listchanges.conf
+++ b/files/etc/apt/listchanges.conf
@@ -6,4 +6,4 @@ email_format=text
 confirm=false
 headers=false
 reverse=false
-save_seen=/var/lib/apt/listchanges.db
+save_seen=/var/lib/apt/listchanges
diff --git a/files/etc/nginx/sites-available/webmap b/files/etc/nginx/sites-available/webmap
index d5e005a..e43af57 100644
--- a/files/etc/nginx/sites-available/webmap
+++ b/files/etc/nginx/sites-available/webmap
@@ -65,8 +65,10 @@ server {
 
     location ^~ /assets/ {
         expires 7d;
-        brotli_static on;
         try_files $uri =404;
+        location ~ "\.(?:css|js|svg)$" {
+            brotli_static on;
+        }
     }
     location ^~ /tiles/ {
         expires 30m;
@@ -75,6 +77,15 @@ server {
         # service an empty payload to save bandwidth
         error_page 404 /_.txt;
     }
+    location ^~ /raster/ {
+        expires 30m;
+        try_files $uri =404;
+        # service an empty payload to save bandwidth
+        error_page 404 /_.txt;
+        location ~ "\.json$" {
+            brotli_static on;
+        }
+    }
     location = /q {
         expires epoch;
         limit_except POST { deny all; }
@@ -90,14 +101,8 @@ server {
         gzip on;
         gzip_types application/json text/plain;
         include uwsgi_params;
-        uwsgi_buffering off;
         uwsgi_pass unix:/run/webmap-cgi.socket;
     }
-    location = /tiles/metadata.json {
-        expires epoch;
-        brotli_static on;
-        try_files $uri =404;
-    }
 
     location = /_.txt {
         # cache 404 responses for 30m like for valid tiles
@@ -113,8 +118,10 @@ server {
         add_header X-Content-Type-Options "nosniff";
         add_header X-XSS-Protection "1; mode=block";
         add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always;
-        add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self' data: https://minkarta.lantmateriet.se/map/; script-src 'self'; style-src 'self'; frame-ancestors 'self'; form-action 'none'; base-uri 'self'";
+        add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self' data: https://minkarta.lantmateriet.se/map/; script-src 'self'; style-src 'self'; frame-ancestors 'self'; form-action 'none'; worker-src blob:; base-uri 'self'";
 
+        expires 1h;
+        brotli_static on;
         try_files $uri $uri/ =404;
     }
 }
diff --git a/files/etc/nginx/snippets/ssl.conf b/files/etc/nginx/snippets/ssl.conf
index 0bce30a..b86f5e3 100644
--- a/files/etc/nginx/snippets/ssl.conf
+++ b/files/etc/nginx/snippets/ssl.conf
@@ -7,10 +7,3 @@ ssl_dhparam /etc/ssl/dhparams.pem;
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
 ssl_prefer_server_ciphers off;
-
-ssl_stapling on;
-ssl_stapling_verify on;
-
-ssl_trusted_certificate /usr/share/lacme/ca-certificates.crt;
-
-resolver 127.0.0.53;
diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/webmap-import@.service
index 964c37d..e2a6eb4 100644
--- a/files/etc/systemd/system/webmap-import@.service
+++ b/files/etc/systemd/system/webmap-import@.service
@@ -11,6 +11,9 @@ Group=_webmap
 Nice=15
 IOSchedulingClass=idle
 
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
 Type=oneshot
 ExecStart=/usr/local/bin/webmap-import \
     --cachedir=%C/webmap \
@@ -18,6 +21,7 @@ ExecStart=/usr/local/bin/webmap-import \
     --lockdir-sources=%t/lock/webmap/cache \
     --mvtdir=/var/www/webmap/tiles/%I \
     --mvt-compress \
+    --metadata-compress \
     -- %I
 
 # Hardening
diff --git a/files/etc/systemd/system/webmap-raster@.service b/files/etc/systemd/system/webmap-raster@.service
new file mode 100644
index 0000000..42a97cf
--- /dev/null
+++ b/files/etc/systemd/system/webmap-raster@.service
@@ -0,0 +1,40 @@
+[Unit]
+Description=Webmap updater service (export ‘%I’ to COG)
+After=webmap-update@%i.target
+After=webmap-download@%i.service
+Upholds=webmap-update@%i.target
+
+[Service]
+User=_webmap
+Group=_webmap
+
+Nice=15
+IOSchedulingClass=idle
+
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
+Type=oneshot
+ExecStart=/usr/local/bin/webmap-import \
+    --cachedir=%C/webmap \
+    --lockfile=%t/lock/webmap/lock \
+    --lockdir-sources=%t/lock/webmap/cache \
+    --rasterdir=/var/www/webmap/raster/%I \
+    --metadata-compress \
+    -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX
+ReadWritePaths=%t/lock/webmap
+ReadWritePaths=/var/www/webmap/raster
+PrivateTmp=yes
+
+[Install]
+WantedBy=webmap-update@%i.target