thermograph/infra/deploy/geoip-refresh.timer

[Unit]
Description=Monthly refresh of the Thermograph IP-geolocation database

[Timer]
# Both candidate databases publish monthly. Weekly rather than monthly on
# purpose: the script exits 0 without touching anything when the file is already
# current, so the extra runs cost one HEAD request, and they mean a missed or
# failed monthly run self-heals within a week instead of leaving the data a
# month stale. (MaxMind additionally *requires* deleting a superseded copy
# within 30 days, which a strictly-monthly timer would sit right on the edge of.)
OnCalendar=Mon 04:17 UTC
# Don't have every host in the fleet hit the mirror at the same second.
RandomizedDelaySec=2h
# Catch up after a reboot that spanned the scheduled time.
Persistent=true

[Install]
WantedBy=timers.target
Approximate-location fallback from the client IP (feature-flagged off) A visitor who declines browser geolocation currently has no location at all — the copy sends them to the map picker. This adds an opt-in fallback that suggests a coarse city from the request's own IP, presented as a guess with a one-tap correction, so the dead end has a way out. backend/data/geoip.py does the lookup against a local MMDB file (DB-IP IP to City Lite or GeoLite2 City — same format, either works, attribution derived from the file's metadata). Off unless THERMOGRAPH_GEOIP is truthy AND the database exists AND maxminddb imports; every degraded case — private/reserved/ CGNAT/IPv6-ULA addresses, unparseable input, no record, a country-centroid record with no city, a record wider than the accuracy limit, a corrupt file — returns None, which the route answers as 204 and the client treats exactly as today. The IP is read in memory and dropped. GET /api/v2/geoip runs no RunAudit, records no metric dimension, and is excluded from the access log (its own "geoip" traffic category) so no stored, joinable (IP, location) pair is ever written. The response is no-store/Vary:* and takes no parameters. Client-side rather than server-rendered on purpose: the homepage's HTML and weak ETag must stay byte-identical for every visitor, or any cache added in front of it can serve one visitor's city to another. The suggestion is fetched only after a declined/unavailable prompt, and only when nothing is remembered. A guess is never persisted — no localStorage write, no URL hash — and the hero and results headings say "roughly near"/"near … approximate" rather than letting the reverse-geocoded cell name a neighbourhood the lookup never knew. The /privacy page's "never looks up your location from your IP address" paragraph now follows the same flag out of the same env file, so the published statement and the behaviour flip together. Database lifecycle is a host-side systemd timer (infra/deploy/geoip-refresh.*) that verifies a download opens and answers before swapping it in atomically, bind-mounted read-only; geoip.py re-opens on mtime change, so a refresh needs no restart. GEOIP-APPROX-LOCATION.md carries the database comparison, the SSR-vs-client argument, the privacy analysis, and the open decisions. 2026-07-23 23:22:37 +00:00			`[Unit]`
			`Description=Monthly refresh of the Thermograph IP-geolocation database`

			`[Timer]`
			`# Both candidate databases publish monthly. Weekly rather than monthly on`
			`# purpose: the script exits 0 without touching anything when the file is already`
			`# current, so the extra runs cost one HEAD request, and they mean a missed or`
			`# failed monthly run self-heals within a week instead of leaving the data a`
			`# month stale. (MaxMind additionally requires deleting a superseded copy`
			`# within 30 days, which a strictly-monthly timer would sit right on the edge of.)`
			`OnCalendar=Mon 04:17 UTC`
			`# Don't have every host in the fleet hit the mirror at the same second.`
			`RandomizedDelaySec=2h`
			`# Catch up after a reboot that spanned the scheduled time.`
			`Persistent=true`

			`[Install]`
			`WantedBy=timers.target`