nginx: No longer enable OCSP stapling

apache: No longer enable OCSP stapling

Configure maptiler key for web site

Fix timeout syntax

elasticsearch: Extend timeout avoid timeout

web: use zstd for apache log compression

imagery: Bump leaflet versions

imagery: Add Namibian historic 250k series

Send export errors in plain text

Merge remote-tracking branch 'github/pull/783'

Replace cgi by urllib

Avoid accessing form data for OPTIONS requests

Allow the TOTP token to be sent in the render URL

Enable enhanced statistics for dev cgimap

Allow some rails headers in CORS preflight

Don't set Access-Control-Allow-Origin if CGI has done so

Handle CORS preflight requests to the render export script

planet: switch to zstd for apache logrotate

tile: switch to zstd for apache logrotate

Merge remote-tracking branch 'github/pull/782'

build(deps): bump test-kitchen from 3.7.2 to 3.8.0

Bumps [test-kitchen](https://github.com/test-kitchen/test-kitchen) from 3.7.2 to 3.8.0.
- [Release notes](https://github.com/test-kitchen/test-kitchen/releases)
- [Changelog](https://github.com/test-kitchen/test-kitchen/blob/main/CHANGELOG.md)
- [Commits](https://github.com/test-kitchen/test-kitchen/compare/v3.7.2...v3.8.0)

---
updated-dependencies:
- dependency-name: test-kitchen
  dependency-version: 3.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'github/pull/781'

build(deps): bump kitchen-dokken from 2.20.7 to 2.20.8

Bumps [kitchen-dokken](https://github.com/test-kitchen/kitchen-dokken) from 2.20.7 to 2.20.8.
- [Release notes](https://github.com/test-kitchen/kitchen-dokken/releases)
- [Changelog](https://github.com/test-kitchen/kitchen-dokken/blob/main/CHANGELOG.md)
- [Commits](https://github.com/test-kitchen/kitchen-dokken/compare/v2.20.7...v2.20.8)

---
updated-dependencies:
- dependency-name: kitchen-dokken
  dependency-version: 2.20.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

overpass: Run make with multiple jobs

Switch apt_repository repos to using url for key retrieval

chef: Bump client to latest  18.7.10

Cleanup inactive nginx cache quicker on lockheed

nginx: fix apt_repository key to use url

Fix new cookstyle warnings

Merge remote-tracking branch 'github/pull/779'

Merge remote-tracking branch 'github/pull/778'

Drop docker hub login from test workflow

build(deps): bump test-kitchen from 3.7.0 to 3.7.2

Bumps [test-kitchen](https://github.com/test-kitchen/test-kitchen) from 3.7.0 to 3.7.2.
- [Release notes](https://github.com/test-kitchen/test-kitchen/releases)
- [Changelog](https://github.com/test-kitchen/test-kitchen/blob/main/CHANGELOG.md)
- [Commits](https://github.com/test-kitchen/test-kitchen/compare/v3.7.0...v3.7.2)

---
updated-dependencies:
- dependency-name: test-kitchen
  dependency-version: 3.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

imagery: fix quote linting

imagery: again change NA imagery notice by request.

imagery: Fix quoting issue

imagery: Another NA copyright notice change

imagery: Additional minor Nambian topo tweak

imagery: NA topo, updated copyright name per request

vectortile: Update spirit

OSQA test should run on Debian 12

Fix podman chef command

Use same chef image for podman - workaround docker repo limits

dev: Block abusive AI scraper

imagery: Use alpha enabled namibia-50k-topo file

imagery: Update Namibian topo to latest file

Add command usage and extra command aliases to nftables script

build(deps): bump cookstyle from 8.1.4 to 8.2.1

Bumps [cookstyle](https://github.com/chef/cookstyle) from 8.1.4 to 8.2.1.
- [Release notes](https://github.com/chef/cookstyle/releases)
- [Changelog](https://github.com/chef/cookstyle/blob/main/CHANGELOG.md)
- [Commits](https://github.com/chef/cookstyle/compare/v8.1.4...v8.2.1)

---
updated-dependencies:
- dependency-name: cookstyle
  dependency-version: 8.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Drop OCSP checks as letsencrypt is dropping OCSP

nominatim: fix UI forwarding

community: enable ruby YJIT

community: bump discourse_docker version

community: fix acme-challenge redirect. Bump discourse version

Merge branch 'vector_oceanupdate'

vectortile: Move ocean updates to timer

This allows updates of ocean tile-layers when the shapefiles
are updated

Revert "Switch web site to readonly mode"

This reverts commit 40195d124490ead03ae537b6c99cd9d62a0afaa0.

Switch web site to readonly mode

Use public URLs for S3 resources

Merge remote-tracking branch 'github/pull/776'

New SSH key for milliams

Give grant read access to the database

Drop matt as a database user

vectortile: update spirit

tile: Add Fastly credit. Modernise HTML

wiki: use wiki specific favicon.ico (in png format)

Fixes: https://github.com/openstreetmap/operations/issues/1245

Manage permissions for spamassassin auto whitelist database

Load the spamassassin AWL plugin

Enable the spamassassin whitelist before configuring it

backup: update cleanup list

vectortile: Fix min/max typo

Merge pull request #775 from pnorman/vectortile_ocean

Re-render ocean layers weekly

Re-render ocean layers weekly

This is a brute-force approach to updating the coastline

Update to tilekiln 0.8.1

Drop some old dev instances

vectortile: Update to tilekiln 0.8.0 for layer-zoom rendering

Fix exim configuration on Ubuntu 20.04

exim: Increase message_linelength_limit to avoid dropping emails

mailman: tweak tar exclude for txt.gz duplicates

osqa: move to container on naga

git: block shortlog for ai scraper

apache: backport idris manual tweaks

git: add additional url to ai scraper block list

blog-staging: fix linting issue

blog-staging: re-enable backup management

git: block fake scraper on even more urls

git: block fake scraper from additional URLs

Dummy commit to retry knife upload

mailman: only backup archive txt files once, not the txt.gz duplicates

Tune shenron disk kernel read ahead

osqa: block unknown scraper abuse

community: bump discourse to v3.4.5 (security upgrade)

git: block some anonymous bot abuse

exim: Add myself to root alias

Add --quiet to zstd invocations

Switch backups to using zstd

mediawiki: add protection against UA faking abusive scraper

Move SMTP recipient limit to exim so it applies to all mail

mailman: limit smtp rcpts to workaround gmx.de limits

gmx.de error: https://postmaster.gmx.net/en/case?c=r0407

Update bundle

Update SST CLI to version 2.3