Quickfix could be to use https://monumental.toolforge.org which seems to be whitelisted. This doesn't work for all of the use cases (ie. main site is still broken)

EDIT: Monumental.toolforge.org's login is broken. Maybe becaeuse toolforge.org transition and now the redirect url is wrong. (ie. T251668 and T234617)

@Zache for the login issue I have created: T260538: Monumental's OAuth integration is broken due to tools.wmflabs.org -> toolforge.org transition

@AntiCompositeNumber @Aklapper This seems to trivial to fix as it is just configuration change in maps.wikimedia.org, however I don't know who to ask. Do you have any ideas who to ping?

@Zache: Hard to say as I either don't understand what the problem is or I don't understand how to reproduce it. Here is what I see with the given steps in a (slightly outdated) Chromium 84.0.4147.89:

Thanks, here is some screenshots from my computer.

And request headers of single failed request from Chrome's devtools (Chrome 84.0.4147.125, Windows 7)

General

• Request URL: https://maps.wikimedia.org/osm-intl/12/2302/1177.png
• Request Method: GET
• Status Code: 429
• Remote Address: [2620:0:862:ed1a::2:b]:443
• Referrer Policy: no-referrer-when-downgrade

Response headers

• content-length: 1846
• content-type: text/html; charset=utf-8
• date: Wed, 19 Aug 2020 09:38:26 GMT
• server: Varnish
• server-timing: cache;desc="int-front"
• set-cookie: WMF-Last-Access=19-Aug-2020;Path=/;HttpOnly;secure;Expires=Sun, 20 Sep 2020 00:00:00 GMT
• status: 429
• strict-transport-security: max-age=106384710; includeSubDomains; preload
• x-cache: cp3065 int
• x-cache-status: int-front
• x-client-ip: 2001:14ba:4f9:2d00:fca8:6213:c88e:d2e

Request headers

• :authority: maps.wikimedia.org
• :method: GET
• :path: /osm-intl/12/2302/1177.png
• :scheme: https
• accept: image/webp,image/apng,image/*,*/*;q=0.8
• accept-encoding: gzip, deflate, br
• accept-language: en-FI,en;q=0.9,fi-FI;q=0.8,fi;q=0.7,lv-LV;q=0.6,lv;q=0.5,et-EE;q=0.4,et;q=0.3,en-US;q=0.2
• cache-control: no-cache
• pragma: no-cache
• referer: https://maps.wikilovesmonuments.org/map?c=60.5134:22.2633:12
• sec-fetch-dest: image
• sec-fetch-mode: no-cors
• sec-fetch-site: cross-site
• user-agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Mobile Safari/537.36

This is due to mitigation from T244278/https://wikitech.wikimedia.org/wiki/Incident_documentation/20200204-maps. The toolforge.org referrer is whitelisted, so it is allowed to generate new map tiles. Other referrers (like maps.wikilovesmonuments.org) will only be served cached map tiles.

The relevant configuration is https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/refs/heads/production/modules/varnish/templates/upload-frontend.inc.vcl.erb#176. I don't know what the process would be to add a site to that list. The latest information I have is https://lists.wikimedia.org/pipermail/maps-l/2020-April/001718.html. @JKatzWMF, any updates on 3rd-ish-party maps usage?

Looks like the current code can take exactly one "maps_domain" but not a list or array of multiple ones.

It's set in Hiera. Note how it has a different value in cloud/beta/"labs" vs production.

There it is " maps_domain: 'maps.beta.wmflabs.org'"

No, it’s the line below that. Maps domain is what u give access to, referrer is what is used to check what gets access.

So it would be just to add wikilovesmonuments.org to config files regexp?

if (req.http.Host == "<%= @vcl_config.fetch('maps_domain') %>") {
   // below is attempted mitigation of https://phabricator.wikimedia.org/T244278
   if (req.http.referer && req.http.referer !~ "^https?://(([^/]*\.)*(wikipedia|wikimedia|wikibooks|wikinews|wikiquote|wikisource|wikiversity|wikivoyage|wikidata|wikimediafoundation|wiktionary|mediawiki|wmfusercontent|wmflabs|toolforge|wmcloud)\.org|w\.wiki|localhost(:\d*)?)(/|$)") {
      return (synth(429, "Too Many Requests"));
   }
}

Change 621342 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] varnish: add wikimedialovesmonuments to domains allowed to access maps servers

https://gerrit.wikimedia.org/r/621342

Change 621347 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] varnish: add wikilovesmonuments to tests for maps access

https://gerrit.wikimedia.org/r/621347

Change 621342 merged by CDanis:
[operations/puppet@production] varnish: add wikilovesmonuments.org to domains allowed to access maps servers

https://gerrit.wikimedia.org/r/621342

Change 621347 merged by CDanis:
[operations/puppet@production] varnish: add wikilovesmonuments to tests for maps access

https://gerrit.wikimedia.org/r/621347

@Zache You may try again now. Is the 429 gone?

edit: I see maps on https://maps.wikilovesmonuments.org/map?c=60.5134:22.2633:12

works for me

Confirming, the map seems to work, thank you for everybody involved!