Skip to content

Deployment

Verified repository artifacts

The repository supplies:

  • deploy/qgis-publish-service.service
  • deploy/qgis-publish-service.env
  • qcarta-tiles/deploy/qcarta-tiles.service

It does not supply Docker/Compose files, Apache/Nginx configuration, TLS certificates/automation, load-balancer manifests, database provisioning, backups, CI, packages, or a release pipeline. References to Apache in comments describe an expected host environment, not a complete verifiable configuration.

Main systemd service

The supplied unit:

  • runs www-data:www-data;
  • uses /opt/qgis-publish-service as its working directory;
  • starts /opt/qgis-publish-service/qgis-publish-service;
  • optionally reads /etc/qgis-publish-service.env;
  • restarts on failure after five seconds;
  • enables NoNewPrivileges, PrivateTmp, ProtectSystem=strict, and ProtectHome;
  • permits writes to /var/data/projects and /var/lib/qgis-publish-service;
  • sends stdout/stderr to journald.

The unit comment names a nonexistent deploy/systemd/... source path; the actual sample is deploy/qgis-publish-service.env.

Before installation:

  1. Build/copy the binary, UI, Python script, and shared UI.
  2. Create and permission all configured storage roots.
  3. Copy the env sample, replace every credential-like value, and rotate tracked sample credentials.
  4. Add every non-default writable path to ReadWritePaths, notably versions, runtime datasets, thumbnails, qcarta cache, and PG_SERVICE_FILE as applicable.
  5. Ensure QGIS Server can read the same projects and libpq service file.
sudo install -m 0644 deploy/qgis-publish-service.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now qgis-publish-service
sudo journalctl -u qgis-publish-service -f

qcarta systemd service

The supplied unit runs /usr/local/bin/qcarta-tiles as www-data, from /var/www/data/qcarta-tiles, restarts always, conflicts with mapproxy.service, and writes to journald. It hardcodes environment settings and contains a credential-like purge token that must be rotated.

Important limitations:

  • it has no EnvironmentFile;
  • it lacks ProtectSystem, explicit writable-path restrictions, and cache-directory creation;
  • it orders after qgis-server.service, whose unit name may differ;
  • it mentions two variables not read by current source;
  • PrivateTmp=true isolates temporary files but qcarta primarily uses its configured cache path.

Prefer a local override or revised unit with a protected environment file instead of editing secrets into the unit.

Generic reverse-proxy guidance

The following is integration guidance, not repository-provided Apache/Nginx support:

  • Terminate TLS at a maintained reverse proxy.
  • Proxy the exact BASE_PATH to the main LISTEN address without accidentally duplicating or stripping the prefix.
  • Keep qcarta and direct QGIS/OSRM/GeoVault backends on private/loopback addresses.
  • Preserve query strings exactly for WMS filters.
  • Set X-Forwarded-Proto: https at a trusted boundary and discard client-supplied forwarded headers.
  • Configure upload limits above the application's 512 MiB ceiling only when such uploads are intended.
  • Set timeouts above legitimate QGIS/import durations but below infrastructure failure thresholds.
  • Restrict admin/import/seed endpoints and add rate limits.
  • Route /login and the Central session cookie consistently with the surrounding federation platform.

No Apache directive, Nginx stanza, or path rewrite can be claimed correct without the target site's topology and tests.

TLS

Neither Go binary configures TLS. Use an external TLS terminator, modern protocol/cipher policy, automated renewal, HSTS after validation, and secure upstream networking where traffic leaves the host. HTTPS behavior has not been repository-tested end to end.

Multi-instance considerations

The source assumes local mutable files and in-process coordination:

  • qcarta jobs/metrics and singleflight are process-local;
  • project snapshots use next-number scanning without a distributed lock;
  • pg_service.conf writes coordinate only through atomic rename, not cross-host locking;
  • project and thumbnail files require shared storage for multiple instances;
  • startup schema and resource reconciliation can run concurrently.

A multi-instance deployment is not verified. Use a single writer unless shared storage, locking, job ownership, and database race behavior are designed and tested.

Operations

Useful checks:

systemctl status qgis-publish-service qcarta-tiles
journalctl -u qgis-publish-service -u qcarta-tiles --since today
curl -i http://127.0.0.1:8080/qgis-publish-service/api/discovery
curl -i http://127.0.0.1:8011/api/health
curl -i http://127.0.0.1:8011/api/metrics

Adjust the base path and ports. qcarta health does not prove QGIS can render; test a capabilities/tile request. The main discovery endpoint does not prove database or upstream health.

Back up the stores listed in Database, monitor disk growth and failed imports, and restrict journals because request/filter details may be logged.

Releases

Git has no tags and no release automation is present. Build artifacts should record commit SHA and dirty state; the main binary logs embedded Go VCS metadata when available. Establish a tagged, reproducible build/sign/publish process before treating 1.0.0 as a deployable repository release.