Allow better control over Google Geolocale API calls

[esko-piirainen]

As Luomus IT manager I want to know what services are causing Google to bill us on Geolocate API usage

• Google API key is not public
• Logging of calls to investigate what services and users are executing geolocate requests

Services that need changes:

• api.laji.fi: Add endpoints that replace calling google api directly
• Google Cloud: Create new API key for api.laji.fi, limit access to our server IPs
• laji-map - library to call api.laji.fi
• udpate laji map: laji.fi / viranomaiset
• udpate laji map: loydos
• update laji map: vieraslajit.fi
• update laji map: wkartta (Tipu, Kirjekyyhky, ..)
• (PS: Sulka geolocate doesn't work currently -- add there as well?)
• Once all services migrated: disable current (public) API key

[olzraiti]

It would be quite a lot of work to do this if the geolocating endpoint would be a proxy in laji-api, because that would require adding the authorization header to the requests, which would require forking the leaflet-geosearch package.

That's doable, but it would be significantly easier to do the proxying via proxy.laji.fi which would simply hide the google api key. Nginx has access logs that look like this:

127.0.0.1 - - [18/Feb/2026:00:00:49 +0200] "GET /mml/maasto/wmts/1.0.0/maastokartta/default/ETRS-TM35FIN/14/12972/7368.png HTTP/1.1" 200 4383 "https://laji.fi/observation/map?informalTaxonGroupId=MVL.701&time=-1600%2F0&coordinates=60.676562:60.688878:25.042472:25.07143:WGS84:0" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0" "85.23.215.253, 192.168.10.60"

It logs the service calling the proxy (in this case https://laji.fi/observation/map?informalTaxonGroupId=MVL.701&time=-1600%2F0&coordinates=60.676562:60.688878:25.042472:25.07143:WGS84:0). That can be spoofed of course, but even if we put the proxy to laji-api anybody could use our google key in practice by calling laji.fi/api.

Unless we really want to limit using geolocating to logged in users, proxy.laji.fi should be enough?