12 files changed, 183 insertions, 39 deletions
diff --git a/files/etc/apt/listchanges.conf b/files/etc/apt/listchanges.conf
index 96910a0..713cbbd 100644
--- a/files/etc/apt/listchanges.conf
+++ b/files/etc/apt/listchanges.conf
@@ -6,4 +6,4 @@ email_format=text
 confirm=false
 headers=false
 reverse=false
-save_seen=/var/lib/apt/listchanges.db
+save_seen=/var/lib/apt/listchanges
diff --git a/files/etc/nginx/sites-available/webmap b/files/etc/nginx/sites-available/webmap
index d16ab60..bbc25c8 100644
--- a/files/etc/nginx/sites-available/webmap
+++ b/files/etc/nginx/sites-available/webmap
@@ -33,8 +33,9 @@ server {
 }
 
 server {
-    listen      443 ssl http2 default_server;
-    listen [::]:443 ssl http2 default_server;
+    listen      443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    http2 on;
 
     server_name karta.klimatanalysnorr.se;
 
@@ -45,36 +46,83 @@ server {
     ssl_certificate_key /etc/nginx/ssl/webmap.rsa.key;
     include snippets/ssl.conf;
 
-    add_header Referrer-Policy "no-referrer";
-    add_header X-Frame-Options "SAMEORIGIN";
+    root /var/www/webmap;
+    index index.html;
+
+    add_header Referrer-Policy "same-origin";
+    add_header X-Frame-Options "DENY";
     add_header X-Content-Type-Options "nosniff";
     add_header X-XSS-Protection "1; mode=block";
     add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always;
-    add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self' data: https://minkarta.lantmateriet.se/map/; script-src 'self'; style-src 'self'; frame-ancestors 'self'; form-action 'none'; base-uri 'self'";
-
-    root /var/www/webmap;
-    index index.html;
+    add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; form-action 'none'; base-uri 'self'";
+    #add_header Access-Control-Allow-Origin $http_origin always;
+
+    include mime.types;
+    types {
+        # application/protobuf and application/vnd.google.protobuf might be valid types too, cf.
+        # https://stackoverflow.com/questions/30505408/what-is-the-correct-protobuf-content-type
+        application/x-protobuf pbf;
+    }
 
     location ^~ /assets/ {
         expires 7d;
-        gzip_static on;
         try_files $uri =404;
+        location ~ "\.(?:css|js|svg)$" {
+            brotli_static on;
+        }
     }
     location ^~ /tiles/ {
-        expires 1d;
-        gzip_static on;
+        expires 30m;
+        brotli_static on;
         try_files $uri =404;
+        # service an empty payload to save bandwidth
         error_page 404 /_.txt;
     }
+    location ^~ /raster/ {
+        expires 30m;
+        try_files $uri =404;
+        # service an empty payload to save bandwidth
+        error_page 404 /_.txt;
+        location ~ "\.json$" {
+            brotli_static on;
+        }
+    }
+    location = /q {
+        expires epoch;
+        limit_except POST { deny all; }
+        #if ($request_method = OPTIONS) {
+        #    add_header Strict-Transport-Security "max-age=31557600; includeSubDomains";
+        #    add_header Access-Control-Allow-Origin $http_origin;
+        #    add_header Access-Control-Allow-Methods "POST, GET, OPTIONS";
+        #    add_header Access-Control-Allow-Headers "Accept, Content-Type";
+        #    add_header Access-Control-Max-Age 28800;
+        #    return 204;
+        #}
+        client_max_body_size 64k;
+        gzip on;
+        gzip_types application/json text/plain;
+        include uwsgi_params;
+        uwsgi_pass unix:/run/webmap-cgi.socket;
+    }
 
     location = /_.txt {
-        # cache 404 responses
+        # cache 404 responses for 30m like for valid tiles
         add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always;
-        add_header Cache-Control "public; max-age=86400" always;
+        add_header Cache-Control "public; max-age=1800" always;
+        #add_header Access-Control-Allow-Origin $http_origin always;
         internal;
     }
 
     location / {
+        add_header Referrer-Policy "same-origin";
+        add_header X-Frame-Options "SAMEORIGIN";
+        add_header X-Content-Type-Options "nosniff";
+        add_header X-XSS-Protection "1; mode=block";
+        add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always;
+        add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self' data: https://minkarta.lantmateriet.se/map/; script-src 'self'; style-src 'self'; frame-ancestors 'self'; form-action 'none'; worker-src blob:; base-uri 'self'";
+
+        expires 1h;
+        brotli_static on;
         try_files $uri $uri/ =404;
     }
 }
diff --git a/files/etc/nginx/snippets/ssl.conf b/files/etc/nginx/snippets/ssl.conf
index 0bce30a..b86f5e3 100644
--- a/files/etc/nginx/snippets/ssl.conf
+++ b/files/etc/nginx/snippets/ssl.conf
@@ -7,10 +7,3 @@ ssl_dhparam /etc/ssl/dhparams.pem;
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
 ssl_prefer_server_ciphers off;
-
-ssl_stapling on;
-ssl_stapling_verify on;
-
-ssl_trusted_certificate /usr/share/lacme/ca-certificates.crt;
-
-resolver 127.0.0.53;
diff --git a/files/etc/postgresql/postgresql.conf b/files/etc/postgresql/postgresql.conf
new file mode 100644
index 0000000..038438a
--- /dev/null
+++ b/files/etc/postgresql/postgresql.conf
@@ -0,0 +1,4 @@
+shared_buffers = 768MB
+temp_buffers = 128MB
+work_mem = 16MB
+effective_cache_size = 1536MB
diff --git a/files/etc/systemd/system/webmap-download@.service b/files/etc/systemd/system/geodata-download@.service
index a928a13..2a8c940 100644
--- a/files/etc/systemd/system/webmap-download@.service
+++ b/files/etc/systemd/system/geodata-download@.service
@@ -1,22 +1,22 @@
 [Unit]
-Description=Webmap updater service (download %I)
+Description=Geodata updater service (download ‘%I’)
 # Chaining logic from https://serverfault.com/questions/1079993/why-does-my-systemd-timer-only-trigger-once-when-the-unit-is-a-target#answer-1128671
 # XXX Looks like Upholds= prevents running a single unit, as it causes
-# webmap-update@%i.target to start upon `systemctl start webmap-download@foo.service`
-After=network-online.target webmap-update@%i.target
-Upholds=webmap-update@%i.target
+# geodata-update@%i.target to start upon `systemctl start geodata-download@foo.service`
+After=network-online.target geodata-update@%i.target
+Upholds=geodata-update@%i.target
 
 [Service]
-User=_webmap-download
-Group=nogroup
+User=_geodata-download
+Group=_geodata
 
 Nice=15
 IOSchedulingClass=idle
 
 Type=oneshot
-ExecStart=/usr/local/bin/webmap-download \
-    --cachedir=/var/cache/webmap \
-    --lockdir=%t/webmap-download \
+ExecStart=/usr/local/bin/geodata-download \
+    --cachedir=%C/geodata \
+    --lockdir=%t/lock/geodata/cache \
     --no-exit-code \
     --quiet \
     -- %I
@@ -30,9 +30,8 @@ ProtectControlGroups=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-ReadWritePaths=/var/cache/webmap
-RuntimeDirectory=webmap-download
-RuntimeDirectoryPreserve=yes
+ReadWritePaths=%C/geodata
+ReadWritePaths=%t/lock/geodata/cache
 
 [Install]
-WantedBy=webmap-update@%i.target
+WantedBy=geodata-update@%i.target
diff --git a/files/etc/systemd/system/geodata-import@.service b/files/etc/systemd/system/geodata-import@.service
new file mode 100644
index 0000000..7d652ea
--- /dev/null
+++ b/files/etc/systemd/system/geodata-import@.service
@@ -0,0 +1,41 @@
+[Unit]
+Description=Geodata updater service (import ‘%I’ to PostGIS)
+After=postgresql.service geodata-update@%i.target
+After=geodata-download@%i.service
+Upholds=geodata-update@%i.target
+
+[Service]
+User=_geodata
+Group=_geodata
+
+Nice=15
+IOSchedulingClass=idle
+
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
+Type=oneshot
+ExecStart=/usr/local/bin/geodata-import \
+    --cachedir=%C/geodata \
+    --lockfile=%t/lock/geodata/lock \
+    --lockdir-sources=%t/lock/geodata/cache \
+    --mvtdir=/var/www/webmap/tiles/%I \
+    --mvt-compress \
+    --metadata-compress \
+    -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=%t/lock/geodata
+ReadWritePaths=/var/www/webmap/tiles
+PrivateTmp=yes
+
+[Install]
+WantedBy=geodata-update@%i.target
diff --git a/files/etc/systemd/system/geodata-raster@.service b/files/etc/systemd/system/geodata-raster@.service
new file mode 100644
index 0000000..aed7930
--- /dev/null
+++ b/files/etc/systemd/system/geodata-raster@.service
@@ -0,0 +1,40 @@
+[Unit]
+Description=Geodata updater service (export ‘%I’ to COG)
+After=geodata-update@%i.target
+After=geodata-download@%i.service
+Upholds=geodata-update@%i.target
+
+[Service]
+User=_geodata
+Group=_geodata
+
+Nice=15
+IOSchedulingClass=idle
+
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
+Type=oneshot
+ExecStart=/usr/local/bin/geodata-import \
+    --cachedir=%C/geodata \
+    --lockfile=%t/lock/geodata/lock \
+    --lockdir-sources=%t/lock/geodata/cache \
+    --rasterdir=/var/www/webmap/raster/%I \
+    --metadata-compress \
+    -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX
+ReadWritePaths=%t/lock/geodata
+ReadWritePaths=/var/www/webmap/raster
+PrivateTmp=yes
+
+[Install]
+WantedBy=geodata-update@%i.target
diff --git a/files/etc/systemd/system/geodata-update@.target b/files/etc/systemd/system/geodata-update@.target
new file mode 100644
index 0000000..e7cdecb
--- /dev/null
+++ b/files/etc/systemd/system/geodata-update@.target
@@ -0,0 +1,3 @@
+[Unit]
+Description=Geodata updater (target unit ‘%I’)
+StopWhenUnneeded=true
diff --git a/files/etc/systemd/system/webmap-update@.timer b/files/etc/systemd/system/geodata-update@.timer
index 74fb848..90fd865 100644
--- a/files/etc/systemd/system/webmap-update@.timer
+++ b/files/etc/systemd/system/geodata-update@.timer
@@ -1,11 +1,11 @@
 [Unit]
-Description=Webmap updater (timer unit)
+Description=Geodata updater (timer unit)
 
 [Timer]
 OnCalendar=*-*-* 01:00:00
 AccuracySec=1s
 RandomizedDelaySec=3599
-Unit=webmap-update@%i.target
+Unit=geodata-update@%i.target
 
 [Install]
 WantedBy=timers.target
diff --git a/files/etc/systemd/system/webmap-cgi.socket b/files/etc/systemd/system/webmap-cgi.socket
new file mode 100644
index 0000000..2828985
--- /dev/null
+++ b/files/etc/systemd/system/webmap-cgi.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Webmap CGI (Common Gateway Interface) activation socket
+After=syslog.target network.target
+
+[Socket]
+ListenStream=%t/webmap-cgi.socket
+SocketUser=www-data
+SocketMode=0666
+
+[Install]
+WantedBy=sockets.target
diff --git a/files/etc/systemd/system/webmap-update@.target b/files/etc/systemd/system/webmap-update@.target
deleted file mode 100644
index 3d9fb7f..0000000
--- a/files/etc/systemd/system/webmap-update@.target
+++ /dev/null
@@ -1,3 +0,0 @@
-[Unit]
-Description=Webmap updater (target unit %I)
-StopWhenUnneeded=true
diff --git a/files/etc/tmpfiles.d/geodata.conf b/files/etc/tmpfiles.d/geodata.conf
new file mode 100644
index 0000000..a299e0f
--- /dev/null
+++ b/files/etc/tmpfiles.d/geodata.conf
@@ -0,0 +1,8 @@
+d %t/lock/geodata           00755 root root
+
+# for `geodata-download --lockdir` *and* `geodata-import --lockdir-sources`
+# (hence the set-group-ID bit and g+w)
+d %t/lock/geodata/cache     02775 _geodata-download _geodata
+
+# for `geodata-import --lockfile`
+f %t/lock/geodata/lock      00644 _geodata _geodata