thermograph/infra/deploy/geoip-refresh.service

[Unit]
Description=Refresh the Thermograph IP-geolocation database
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
# GEOIP_URL / GEOIP_BASE / THERMOGRAPH_GEOIP_HOST_DIR can be overridden here if
# the deployment switches databases. The leading `-` keeps a missing file
# non-fatal, matching thermograph.service.
EnvironmentFile=-/etc/thermograph.env
ExecStart=/opt/thermograph/infra/deploy/geoip-refresh.sh
# Downloading ~125 MB and verifying it needs no privilege beyond writing the
# destination directory, and nothing else on the box.
ProtectSystem=strict
ReadWritePaths=/var/lib/thermograph/geoip
PrivateTmp=yes
NoNewPrivileges=yes
Approximate-location fallback from the client IP (feature-flagged off) A visitor who declines browser geolocation currently has no location at all — the copy sends them to the map picker. This adds an opt-in fallback that suggests a coarse city from the request's own IP, presented as a guess with a one-tap correction, so the dead end has a way out. backend/data/geoip.py does the lookup against a local MMDB file (DB-IP IP to City Lite or GeoLite2 City — same format, either works, attribution derived from the file's metadata). Off unless THERMOGRAPH_GEOIP is truthy AND the database exists AND maxminddb imports; every degraded case — private/reserved/ CGNAT/IPv6-ULA addresses, unparseable input, no record, a country-centroid record with no city, a record wider than the accuracy limit, a corrupt file — returns None, which the route answers as 204 and the client treats exactly as today. The IP is read in memory and dropped. GET /api/v2/geoip runs no RunAudit, records no metric dimension, and is excluded from the access log (its own "geoip" traffic category) so no stored, joinable (IP, location) pair is ever written. The response is no-store/Vary:* and takes no parameters. Client-side rather than server-rendered on purpose: the homepage's HTML and weak ETag must stay byte-identical for every visitor, or any cache added in front of it can serve one visitor's city to another. The suggestion is fetched only after a declined/unavailable prompt, and only when nothing is remembered. A guess is never persisted — no localStorage write, no URL hash — and the hero and results headings say "roughly near"/"near … approximate" rather than letting the reverse-geocoded cell name a neighbourhood the lookup never knew. The /privacy page's "never looks up your location from your IP address" paragraph now follows the same flag out of the same env file, so the published statement and the behaviour flip together. Database lifecycle is a host-side systemd timer (infra/deploy/geoip-refresh.*) that verifies a download opens and answers before swapping it in atomically, bind-mounted read-only; geoip.py re-opens on mtime change, so a refresh needs no restart. GEOIP-APPROX-LOCATION.md carries the database comparison, the SSR-vs-client argument, the privacy analysis, and the open decisions. 2026-07-23 23:22:37 +00:00			`[Unit]`
			`Description=Refresh the Thermograph IP-geolocation database`
			`After=network-online.target`
			`Wants=network-online.target`

			`[Service]`
			`Type=oneshot`
			`# GEOIP_URL / GEOIP_BASE / THERMOGRAPH_GEOIP_HOST_DIR can be overridden here if`
			# the deployment switches databases. The leading `-` keeps a missing file
			`# non-fatal, matching thermograph.service.`
			`EnvironmentFile=-/etc/thermograph.env`
			`ExecStart=/opt/thermograph/infra/deploy/geoip-refresh.sh`
			`# Downloading ~125 MB and verifying it needs no privilege beyond writing the`
			`# destination directory, and nothing else on the box.`
			`ProtectSystem=strict`
			`ReadWritePaths=/var/lib/thermograph/geoip`
			`PrivateTmp=yes`
			`NoNewPrivileges=yes`