headwaymaps / headway

Self-hostable maps stack, powered by OpenStreetMap.
https://about.maps.earth
Apache License 2.0
2.55k stars 59 forks source link

Headway, helm & hardening #235

Closed srudin closed 12 months ago

srudin commented 1 year ago

I work for a large transportation company and we have a number of services that make use of maps. We have the requirement to be independent from public systems so we need to host our own map servers. Our use case is rather simple: We must import some data from geofabrik.de and make its tiles available in the intranet.

We have an installation for this already based on a number of custom built docker containers using some osm open source code (I'm saying "some" because this has been done years ago and the people involved have left and we don't really know the details). Now we must migrate the solution to k8 and we figured that using a newer solution that already provides a helm chart would be worth replacing the entire existing solution.

Because of this I have been working some time already getting osm-seed to run - but now it was suggested that maybe headway could fit better for our needs. The challenge is that we have a number of security guidelines that caused hardening policies on k8 such as requiring a security context other than root or making the containers readonly. As open source projects usually don't bother too much with such policies it is quite challenging to get them to run in our environment.

Having said all this I'd like to ask the following questions:

We have quite a budget for this and we are willing to spend time doing the adjustments which I think could be beneficial for your project. However we must be sure that headway is the right choice first.

michaelkirk commented 1 year ago

Hello and thanks for your interest!

We must import some data from geofabrik.de and make its tiles available in the intranet [...]  Would you agree that headway is a good choice for us and can fulfill our use case well?

If you need literally only the tiles, I'd recommend using a stand alone tile server. Headway includes a tile server (tileserver-gl-light), but it also has other components needed to build an interactive map application.

  1. web interface
  2. geocoding so you can search for a place by name/address
  3. routing and trip planning

If you don't need any of these things - I think headway (and probably osm-seed) are probably a lot of unnecessary complexity.

If you are looking for more than just tiles, and want an interactive web map, headway might be a good fit.

Is your helm chart ready to use?

I'm using k8s to host https://maps.earth, but I'm not using helm.

The k8s configs live here: https://github.com/headwaymaps/headway/tree/9fd1de2/k8s/configs

Those configs are generated by a horrendous system of bash scripts and templates.

I'm not particularly proud of that current system, but the output seems relatively easy to understand. I'm new to k8s and have never used helm. If introducing helm makes things easier for people, I'm open to it. But I'm also content to have a "worse" system like the current one, if it's substantially simpler.

Are you interested to have our adjustments regarding the security policies merged into the main repo? [...] Would you be willing to assist with answering questions when we run into problems like that?

I'm absolutely interested in incorporating security improvements and would be happy to help debug issues in achieving them. That said, I don't work for you :wink:, so I don't make any guarantees or SLA about when I'll respond. I likely won't always have the same priorities as you.

In general, I think the appropriate way to proceed would be to file a well documented issue and/or a pull request with the changes you want to see incorporated. There's also the vulnerability disclosure channel if you feel like you've encountered something rising to that level. With pull requests, I only ask that you attest you've tested the changes. In lieu of pull requests, well documented issues are also valuable.

srudin commented 12 months ago

After some deeper investigations I had to come up with a different solution:

So I created my own OSM tiles server according to the switch2osm documentation, then created my own Helm chart based on the company guidelines. I would have preferred to make more intensive use of open source solutions such as headway but I wasn't able to fit them into our restrictive guidelines.

I apologize for all the fuss in the first place...