feat!: rewrite as MapProxy 6 image, v2.0.0 (supersedes mc-mapproxy)

[razbroc]

What & why

Folds the mc-mapproxy rewrite into this repo as a new major version (2.0.0), so the MapProxy service lives in a single repo instead of two. docker-mapproxy is the survivor (the name every consumer already pins); mc-mapproxy will be archived after this releases.

This replaces the kartoza-derived MapProxy 1.13 packaging with the MapColonies rewrite (Python 3.11 multi-stage, MapProxy 6.0.1, full OpenTelemetry, inline CORS, nginx/OPA-only auth), frozen at mc master 8a3b3be, as a single squash feat!. mc's granular history is preserved in the (to-be-archived) mc-mapproxy repo.

Reconciliations on top of the verbatim mc tree

• Version identity decoupled. New SERVICE_VERSION arg (=2.0.0) drives the image / SERVICE_VERSION / OCI image.version; the packaged MapProxy engine version (6.0.1) moves to a separate io.mapcolonies.mapproxy.version label. (mc had wired image identity to MAPPROXY_VERSION.)
• Dead AUTH_* config removed from the mapproxy configmap — the in-app JWT authFilter is gone and nginx/OPA owns authorization; mc left the env keys injected-but-ignored.
• release-please state reset to 1.9.2 (manifest + Chart.yaml) so this breaking change bumps to 2.0.0, not into mc's 6.x line.
• IMAGE_SOURCE and the readme build example repointed to docker-mapproxy.

Verification

• Image build (BuildKit): clean; both patch files (redis.py, s3.py) applied and import+abstractmethod-verified at build.
• Runtime smoke: container serves GET / (200, healthcheck passes), /demo/, WMTS GetCapabilities (valid XML), WMS GetCapabilities; CORS preflight returns Access-Control-Allow-Origin: *, Allow-Methods: GET,OPTIONS, Max-Age: 86400 (app-owned CORS).
• Labels: image.version=2.0.0, io.mapcolonies.mapproxy.version=6.0.1, source/title=docker-mapproxy.
• Helm: helm lint clean; helm template renders no AUTH_* keys, CORS present, chart at 1.9.2 baseline (release-please bumps to 2.0.0 on merge).

Release note

BREAKING CHANGE: docker-mapproxy is now the MapProxy 6 rewrite. MapProxy 1.13, the in-app authFilter, start.sh/uwsgi.ini/log.ini, and the requirements.txt dependency set are removed. On merge, release-please should cut 2.0.0.

Follow-ups (not in this PR)

• Merge → confirm release-please cuts 2.0.0 → CI publishes docker-mapproxy:v2.0.0 to ACR.
• Archive mc-mapproxy (close its open PRs, add a readme pointer) once v2.0.0 is released.
• Repoint consumers (helm-charts/raster/artifacts.json v1.9.2 → v2.0.0) and retire the manual ACR override.
• CI should pass --build-arg SERVICE_VERSION=<release tag> so the image version tracks the tag automatically (the Dockerfile default keeps local builds correct in the meantime).

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR modernizes the MapProxy Docker image and Helm deployment by migrating to a new OpenTelemetry-instrumented WSGI app, updating the build/runtime container setup, and restructuring nginx chart integration while removing legacy demo assets and scripts.

Changes:

• Replaced the legacy app.py + start.sh/uwsgi.ini setup with a new src/app.py that adds traces/metrics/log correlation, plus a new entrypoint.sh.
• Refactored Helm nginx integration (new upstream/http/location config fragments, chart dependency bump) and expanded runtime configuration (telemetry toggles, redis/s3 settings, uwsgi tuning).
• Removed legacy web demo UI, sample data/configuration, and old container artifacts (old requirements, uwsgi config, demo html/js/css, compose).

Reviewed changes

Copilot reviewed 67 out of 92 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
web/js/leaflet.zoomdisplay.js	Removed legacy demo asset.
web/js/leaflet.wmslegend.js	Removed legacy demo asset.
web/js/leaflet-overview.js	Removed legacy demo asset.
web/js/bootstrap.min.js	Removed legacy demo asset.
web/js/Control.OSMGeocoder.js	Removed legacy demo asset.
web/index.html	Removed legacy demo page.
web/css/leaflet.zoomdisplay.css	Removed legacy demo asset.
web/css/leaflet.wmslegend.css	Removed legacy demo asset.
web/css/leaflet.css	Removed legacy demo asset.
web/css/leaflet-overview.css	Removed legacy demo asset.
web/css/custom.css	Removed legacy demo asset.
web/css/bootstrap-theme.min.css	Removed legacy demo asset.
web/css/bootstrap-theme.css	Removed legacy demo asset.
web/css/Control.OSMGeocoder.css	Removed legacy demo asset.
uwsgi.ini	Removed legacy uWSGI configuration.
start.sh	Removed legacy container entry script.
src/app.py	Added new MapProxy WSGI app with OTel instrumentation and optional CORS middleware.
sites-enabled/nginx.conf	Removed legacy nginx config used by old demo layout.
requirements.txt	Removed pinned requirements (replaced with Dockerfile pip installs).
readme.md	Added new container/OTel documentation (replacing old README).
log.ini	Removed legacy default logging config from repo root.
helm/values.yaml	Updated Helm values: nginx chart bump, new telemetry/redis/s3/uwsgi settings.
helm/templates/nginx/nginx-configmap.yaml	Added new nginx config fragments and removed old default/nginx.conf entries.
helm/templates/mapproxy/mapproxy-container.yaml	Added envs for redis health check, aws retry tuning, uwsgi tuning; adjusted probe delay.
helm/templates/mapproxy/mapproxy-configmap.yaml	Added telemetry toggles, cors methods, s3 username, redis ssl cert reqs.
helm/templates/mapproxy-bundle.yaml	Minor templating/whitespace adjustments.
helm/templates/mapproxinator/mapproxinator-configmap.yaml	Removed config-management merge wiring; adjusted templating blocks.
helm/templates/intital-container/initial-container-configmap.yaml	Removed config-management env injection.
helm/templates/_tplValues.tpl	Removed config-management merge helper templates.
helm/templates/_helpers.tpl	Adjusted include whitespace handling for selector labels.
helm/config/nginx.mapproxy.conf	Added header to prevent nginx-level CORS duplication.
helm/config/nginx.conf	Removed custom nginx.conf (likely relying on common/nginx chart defaults).
helm/config/mapproxy-location.conf	Added new nginx location-level uwsgi config fragment.
helm/config/mapproxy-http.conf	Added http-context upstreams and optional uwsgi_cache_path.
helm/config/mapProxyUwsgi.ini	Updated uwsgi.ini: callable, lazy-app, harakiri, max-requests, stats/http-socket.
helm/config/log_format.conf	Renamed log_format and updated OTel trace/span variables.
helm/config/default.conf	Refactored default server config into fragments; adjusted routes/locations.
helm/Chart.yaml	Bumped nginx dependency and updated repositories.
helm/Chart.lock	Added lockfile for chart dependencies.
entrypoint.sh	Added new runtime entrypoint (creates dirs, runs uwsgi via ini).
docker-compose.yml	Removed legacy compose setup.
data/transport_airport.svg	Removed legacy demo data.
data/ne_10m_airports.prj	Removed legacy demo data.
data/ne_10m_airports.VERSION.txt	Removed legacy demo data.
data/ne_10m_airports.README.html	Removed legacy demo data.
data/NorthArrow_06.svg	Removed legacy demo data.
configuration/seed.yml	Removed legacy example seeding config.
configuration/mapproxy.yaml	Removed legacy example MapProxy config.
config/patch/spec.py	Removed legacy MapProxy spec patch file.
config/patch/s3.py	Added patched MapProxy S3 cache implementation (pool sizing + URL logic).
config/patch/redis.py	Updated patched MapProxy Redis cache (timeouts, retry behavior, TLS params).
build.sh	Removed legacy build script.
authFilter.py	Removed legacy in-app auth filter (moved to nginx/OPA per Helm values).
app.py	Removed legacy WSGI app wrapper.
README.md	Removed old repository README.
Dockerfile	Rebuilt as multi-stage Python 3.11 image + OTel instrumentation and patches.
CHANGELOG.md	Removed old changelog file.
71-apt-cacher-ng	Removed local apt-cacher-ng config artifact.
.licrc	Removed license tool config.
.gitignore	Removed repo ignore rules (potentially unintended).
.github/workflows/release-please.yml	Added workflow_dispatch and bumped release-please action version.
.github/workflows/pull_request.yaml	Restructured workflow/jobs and bumped action versions.
.github/workflows/build_and_push.yaml	Minor YAML tweaks.
.github/dependabot.yml	Removed old Dependabot config.
.github/dependabot.yaml	Added new Dependabot config (npm + actions).
.github/PULL_REQUEST_TEMPLATE.md	Added PR template.
.gitattributes	Removed eol normalization config.
.dockerignore	Updated dockerignore rules.

Comments suppressed due to low confidence (7)

readme.md:1

• The README documents OTEL_EXPORTER_OTLP_ENDPOINT and TELEMETRY_TRACING_SAMPLING_RATIO_DENOM, but src/app.py reads TELEMETRY_TRACING_ENDPOINT and TELEMETRY_TRACING_SAMPLING_RATIO_DENOMINATOR. This mismatch will cause users to set env vars that the app ignores. Either update the docs to the actual env var names, or update src/app.py to also honor the standard OTEL_EXPORTER_OTLP_ENDPOINT and the documented sampling var alias.
  readme.md:1
• The README documents OTEL_EXPORTER_OTLP_ENDPOINT and TELEMETRY_TRACING_SAMPLING_RATIO_DENOM, but src/app.py reads TELEMETRY_TRACING_ENDPOINT and TELEMETRY_TRACING_SAMPLING_RATIO_DENOMINATOR. This mismatch will cause users to set env vars that the app ignores. Either update the docs to the actual env var names, or update src/app.py to also honor the standard OTEL_EXPORTER_OTLP_ENDPOINT and the documented sampling var alias.
  readme.md:1
• The README documents OTEL_EXPORTER_OTLP_ENDPOINT and TELEMETRY_TRACING_SAMPLING_RATIO_DENOM, but src/app.py reads TELEMETRY_TRACING_ENDPOINT and TELEMETRY_TRACING_SAMPLING_RATIO_DENOMINATOR. This mismatch will cause users to set env vars that the app ignores. Either update the docs to the actual env var names, or update src/app.py to also honor the standard OTEL_EXPORTER_OTLP_ENDPOINT and the documented sampling var alias.
  entrypoint.sh:1
• The entrypoint hard-requires /mapproxy/uwsgi.ini, but the Dockerfile does not provide a default uwsgi.ini in the image. Running the container without Helm-mounted config will fail immediately. To fix: either (1) copy a default uwsgi.ini into the image at build time, or (2) update entrypoint.sh and documentation to use a baked-in default path (and optionally allow override via env).
  src/app.py:1
• The sampling comment states a default of 1/10 (10%), but the actual default value is TELEMETRY_TRACING_SAMPLING_RATIO_DENOMINATOR=1000 (i.e., 0.1%) as defined earlier in the file and in the Dockerfile. Update the comment to match the real default so operators don’t misconfigure sampling based on incorrect expectations.
  src/app.py:1
• The collector probe runs at import time and can block worker startup for up to 5 seconds (per worker) when the OTLP endpoint is down/unreachable. In high replica/process counts this can significantly slow rollouts and restarts. Consider making the probe timeout configurable (via env), reducing the default, and/or only probing when tracing is enabled (TELEMETRY_TRACING_ENABLED=true) to avoid startup delays when telemetry is intentionally off.
  helm/config/mapProxyUwsgi.ini:1
• The inline comment for lazy-app is inverted: uWSGI's lazy-app causes the app to be loaded in each worker after fork (instead of loading in the master and forking afterward). Updating the comment would prevent confusion when tuning OTel/threading behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.