Open Street Map Tile Server using mod_tile authentication

Question

I am creating a cluster of tile servers for a client application, due to bandwidth costs we would like to add some sort of authentication to the mod_tiles module in apache. I would prefer a app token using either oauth, but would be fine if I had to use basic auth or something like that.

Answer 1

I had a similar issue and I solved it with the apache basic authentication.

First thing I've done is disabled mod_tile over insecure connection. This is necessary because basic authentication has no encryption and asking users' login/password over insecure connection is a generally bad idea.

Then, my virtual host file (in my case it's /etc/apache2/sites-available/000-default-le-ssl.conf) looks like this:

<IfModule mod_ssl.c>
<VirtualHost *:443>
        DocumentRoot /var/www/html
        ServerName example.com
        ServerAdmin admin@example.com

        # Standard dir connfiguration
        <Directory /var/www/html>
                Options +FollowSymLinks
                AllowOverride All
                Order allow,deny
                Allow from all
        </Directory>

        # Set BasicAuth on location
        <Location />
                AuthType Basic
                AuthName "Authentication Required"
                AuthUserFile /usr/local/.tileauth
                Require valid-user
        </Location>

        # Enable tile server
        LoadTileConfigFile /usr/local/etc/renderd.conf
        ModTileRenderdSocketName /var/run/renderd/renderd.sock
        ModTileRequestTimeout 0
        ModTileMissingRequestTimeout 30

        # Specify certificate and key using letsencrypt
        SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

So, the thing that sets basic authentication is inside <Location> block. The password file is generated like this:

$ htpasswd -c /usr/local/.tileauth tile_server_user

Additionally to that, I would also recommend to use fail2ban to monitor basic authentication attempts, because apache itself has no brute-force attack protection. Hope this helps!