iem-web-services

Code servicing IEM API requests. Requires python 3.11+. Utilizes database schema found with akrherz/iem-database.

Production with Podman + systemd

This repository includes a systemd unit template for running the published GHCR image with Podman:

• config/systemd/iem-web-services-podman.service
• config/systemd/iemws.env.example

Host prerequisites

1. Podman installed (/usr/bin/podman).
2. Host paths available:
   • /mesonet/data (mounted read-only into container at same path)
   • /mnt/mesonet2 (mounted read-only for symlink targets under /mesonet/data)
   • /opt/bufkit (mounted read-only into container at same path)
   • host syslog socket (default /dev/log) if telemetry is emitted via syslog
3. Configure publish binding in iemws.env:
   • local proxy on same host: PUBLISH_HOST=127.0.0.1
   • proxy on remote host: PUBLISH_HOST=0.0.0.0 or a specific interface IP

Install

1. Create runtime env file:

sudo mkdir -p /etc/iem-web-services
sudo cp config/systemd/iemws.env.example /etc/iem-web-services/iemws.env
sudo $EDITOR /etc/iem-web-services/iemws.env

Use per-database host variables in iemws.env for sharded deployments (for example IEMWS_DBHOST_MESOSITE, IEMWS_DBHOST_IEM, IEMWS_DBHOST_POSTGIS).

1. Create a Podman secret from your shard-aware PostgreSQL passfile:

install -m 600 /path/to/pgpass /tmp/iemws.pgpass
sudo podman secret create iemws-pgpass /tmp/iemws.pgpass
rm -f /tmp/iemws.pgpass

Set PGPASS_SECRET in iemws.env if you use a different secret name.

Set PUBLISH_HOST and PUBLISH_PORT in iemws.env to control where Podman publishes the API port.

Telemetry emitted via pyiem.webutil.write_telemetry() should usually go to the host rsyslog socket, not directly to the centralized collector. This keeps relay policy, buffering, and forwarding centralized on the host. The systemd unit bind mounts SYSLOG_SOCKET to /dev/log inside the container.

1. Install and enable the service:

sudo cp config/systemd/iem-web-services-podman.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now iem-web-services-podman.service

1. Verify:

sudo systemctl status iem-web-services-podman.service
sudo journalctl -u iem-web-services-podman.service -f
curl -sS http://127.0.0.1:8000/api/1/servertime.json

Update/roll forward

The unit pulls ghcr.io/akrherz/iem-web-services:latest on each restart.

sudo systemctl restart iem-web-services-podman.service