Overpass API on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Overpass API on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Overpass API is an open source, read only query server for OpenStreetMap data. You send it a query written in Overpass QL, and it returns exactly the map objects you asked for: every pharmacy within a bounding box, every cycle path in a city, every building with a given tag, the members of a relation. It is the engine behind Overpass Turbo and behind a great deal of the tooling built on top of OpenStreetMap.

Running your own instance matters when you query at any volume. The public instances are a shared community resource with strict per address quotas, and they are the wrong place to point a production service. A private Overpass API server has no quota you did not set, no queue you are sharing with the rest of the world, and no dependency on somebody else's uptime.

The image answers real queries the moment it boots. A query server with no data is not a product, so the database is built at image build time rather than downloaded on your first boot: the Geofabrik Luxembourg extract, snapshot 2026-09-01, imported with metadata onto a dedicated data volume, complete with a generated area index so area queries work too. You can query it immediately, and replace it with your own region, or the full planet, whenever you are ready.

Secure by default, for a product that is deliberately unauthenticated. Overpass API is a public read only API by design and has no login of its own, exactly as the public instances run it. This image does not invent a fake one. What it does instead is bound the blast radius. The Apache instance that hosts the query CGI binds 127.0.0.1 only. Both dispatchers speak over Unix domain sockets inside the database directory and open no TCP port at all. The only network facing surface is nginx on port 443, which terminates TLS, rate limits per client address, and serves an explicit allowlist of six endpoints while returning 404 for everything else. The complete set of ports reachable from off the machine is 22, 80 and 443, and nothing else.

The one secret in this appliance is generated on your own virtual machine. A self signed TLS key pair baked into an image would be a private key that every customer shares. This image ships with no key pair at all, and nginx.service is gated so that it physically cannot start until first boot has minted one. Two virtual machines launched from this image present different certificate fingerprints.

What is included:

• Overpass API 0.7.62.11, the current upstream release, built unmodified from the official source tarball and pinned by SHA-256

• A Luxembourg OpenStreetMap extract already imported with full metadata, on a dedicated 32 GiB data volume at /srv/overpass

• A generated area index, so area["name"=...] queries resolve, refreshed by a daily systemd timer

• nginx terminating TLS on :443 with a certificate generated per virtual machine at first boot, HSTS, and per client rate limiting; port :80 redirects to HTTPS

• Query resource caps set explicitly for this machine size rather than left at the upstream defaults, which are sized for a 32 GB public server

• The replication start point recorded, so turning on incremental updates does not require you to work out where in the OpenStreetMap replication stream your snapshot sits

• A built in self test at /usr/local/bin/overpass-selftest that proves the whole appliance end to end

• Ubuntu 24.04 LTS base with the latest security patches applied at build time and unattended security upgrades left enabled

• Azure Linux Agent for seamless cloud integration and SSH key injection

• 24/7 cloudimg support with a guaranteed 24 hour response SLA

Overpass API is licensed under the GNU Affero General Public License v3.0 and is shipped here unmodified. cloudimg is not affiliated with the Overpass API project.

Map data (c) OpenStreetMap contributors, available under the Open Database Licence (ODbL) 1.0 — https://www.openstreetmap.org/copyright. OpenStreetMap is a trademark of the OpenStreetMap Foundation and is used here under the OSMF Trademark Policy's provisions for factually naming an aspect of the movement; cloudimg is not endorsed by or affiliated with the OpenStreetMap Foundation.

Prerequisites

• An Azure subscription with permission to deploy virtual machines
• An SSH key pair for the azureuser account
• A network security group that permits 443 (and 80, if you want the redirect) from the networks that should reach the service, and 22 from your management network only
• Standard_B2s or larger. Overpass recommends at least 4 GB of RAM, which Standard_B2s provides; give it more if you import a large region

Step 1: Deploy from the Azure Portal

1. Locate the Overpass API on Ubuntu 24.04 LTS image in the Azure Marketplace and select Create.

2. Choose your subscription, resource group and region.

3. Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.

4. On the Networking tab, allow inbound 443 and 80 from the networks that should reach the service, and 22 from your management network only.

5. Leave the data disk that ships with the image in place. It is mounted at /srv/overpass and holds the OpenStreetMap database.

6. Review and create. First boot takes a few seconds while the virtual machine generates its own TLS key pair and starts the API.

Step 2: Deploy from the Azure CLI

az group create --name overpass-rg --location eastus

az vm create \
  --resource-group overpass-rg \
  --name overpass-vm \
  --image cloudimg:overpass-api-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

az vm open-port --resource-group overpass-rg --name overpass-vm --port 443 --priority 1001
az vm open-port --resource-group overpass-rg --name overpass-vm --port 80 --priority 1002

Step 3: Find this virtual machine's endpoint and TLS identity

Every virtual machine writes its own endpoint details and certificate fingerprint to a root only file at first boot:

sudo cat /root/overpass-credentials.txt

You will see this machine's own values:

OVERPASS_URL=https://<your VM address>/
OVERPASS_API_ENDPOINT=https://<your VM address>/api/interpreter
OVERPASS_STATUS_URL=https://<your VM address>/api/status
OVERPASS_TLS_FINGERPRINT=<the SHA-256 fingerprint of this VM's certificate>
OVERPASS_TLS_CERT=/etc/nginx/tls/overpass.crt
OVERPASS_TLS_KEY=/etc/nginx/tls/overpass.key
OVERPASS_DB_DIR=/srv/overpass/db

The certificate is self signed and unique to this machine, so clients will warn on first contact. That warning is meaningful rather than noise: verify you are talking to the machine you think you are by comparing the fingerprint above with the one the server actually presents.

echo | openssl s_client -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256

The two must match. Step 14 covers replacing the certificate with one from a certificate authority.

Step 4: Run your first query

Overpass QL queries are sent as a form encoded data parameter to /api/interpreter. This one asks for cafes with a name in central Luxembourg City and returns JSON:

curl -sk --data-urlencode 'data=[out:json][timeout:25];
node["amenity"="cafe"]["name"](49.60,6.10,49.63,6.15);
out center 5;' https://127.0.0.1/api/interpreter

Real objects come back, with their tags, coordinates and OpenStreetMap identifiers:

Note the copyright field in every response. Overpass emits the ODbL notice in its JSON and XML output automatically; see the Data licence section before you publish anything built from these results.

From another machine, use your virtual machine's own address rather than the loopback one. First boot wrote it to the credentials file, so you never have to guess it:

OVERPASS_URL=$(sudo grep -m1 '^OVERPASS_URL=' /root/overpass-credentials.txt | cut -d= -f2-); PRIV=$(hostname -I | awk '{print $1}'); echo "From another machine, query: ${OVERPASS_URL}api/interpreter"; echo "Checking the same listener over this VM's own network address (${PRIV}):"; curl -sk --data-urlencode 'data=[out:json][timeout:25];node["amenity"="pharmacy"](49.60,6.10,49.63,6.15);out center 3;' "https://${PRIV}/api/interpreter" | head -12

Note that the check above uses the virtual machine's private address, not the public one printed on the line before it. That is deliberate: an Azure virtual machine generally cannot reach its own public IP address from inside itself, because the address lives on the load balancer rather than on the network interface. A query to your own public address from the machine itself will simply hang, which looks alarming and is not a fault in the server. Test the public address from somewhere else.

-k tells curl to accept the self signed certificate; drop it once you have installed a certificate from a certificate authority (Step 14).

Step 5: Use the browser query form

Open https://<your VM address>/ in a browser. The appliance landing page lists every endpoint and carries the data attribution:

Follow the Query form link for the browser form that ships with Overpass API. Type or paste a query into the box:

Submit it, and the results come straight back in the browser:

Further down the landing page there is a worked example and a pointer to loading your own region:

Overpass Turbo can be pointed at this server instead of a public one. In Turbo, open Settings, and set the server to https://<your VM address>/api/. A browser will not trust the self signed certificate until you either accept it once by visiting the server directly, or install a certificate from a certificate authority as described in Step 14.

Step 6: Check server status and data freshness

/api/status reports the dispatcher's live state: how the server identifies you, the rate limit, how many query slots are free, and what is running.

curl -sk https://127.0.0.1/api/status

/api/timestamp reports the OpenStreetMap timestamp of the loaded data, which is how you tell how fresh your answers are:

curl -sk https://127.0.0.1/api/timestamp

For the image as shipped that is the snapshot date of the bundled extract:

2026-09-01T20:20:50Z

Step 7: Query by area, not just by bounding box

The image ships with a generated area index, so you can select by administrative boundary or any named area rather than by coordinates. This counts pharmacies in Luxembourg by name rather than by bounding box:

curl -sk --data-urlencode 'data=[out:json][timeout:60];
area["name"="Luxembourg"]["boundary"="administrative"]->.searchArea;
node["amenity"="pharmacy"](area.searchArea);
out count;' https://127.0.0.1/api/interpreter

Areas are regenerated daily by a systemd timer, using the same command upstream ships:

systemctl list-timers overpass-areas-update.timer --no-pager

If you have just imported a new region and want the area index rebuilt immediately rather than waiting for the timer, run the update by hand. It takes seconds for a country sized extract and considerably longer for the planet:

sudo systemctl start overpass-areas-update.service; systemctl show overpass-areas-update.service --property=Result --value

That prints success. The unit is a oneshot, so it correctly shows as inactive once it has finished — systemctl status would report exit code 3 for exactly that reason, which is why the result property is the thing to read.

Step 8: Output formats

Overpass QL selects the output format in the query prologue. JSON is the default choice for programmatic use; XML is the OpenStreetMap native format; CSV is convenient for spreadsheets and quick analysis.

curl -sk --data-urlencode 'data=[out:xml][timeout:25];node["amenity"="cafe"]["name"](49.61,6.12,49.62,6.13);out 2;' https://127.0.0.1/api/interpreter

curl -sk --data-urlencode 'data=[out:csv(::id,name,::lat,::lon)][timeout:25];node["amenity"="cafe"]["name"](49.60,6.10,49.63,6.15);out 5;' https://127.0.0.1/api/interpreter

The Overpass QL language reference is at https://wiki.openstreetmap.org/wiki/Overpass_API/Overpass_QL.

Step 9: What is exposed, and what is not

The services, and the complete set of ports reachable from off the machine:

systemctl is-active overpass-dispatcher.service overpass-areas-dispatcher.service apache2.service nginx.service overpass-areas-update.timer

ss -tlnH | awk '{print $4}' | grep -vE '^(127\.|\[::1\])' | sed -E 's/.*:([0-9]+)$/\1/' | sort -un | tr '\n' ' '

That prints 22 80 443 and nothing else. Everything else in the appliance is loopback bound or uses a Unix domain socket:

• apache2 hosts the query CGI on 127.0.0.1:8080 and is reachable only through nginx
• both dispatchers communicate over Unix domain sockets in /srv/overpass/db plus POSIX shared memory, and open no TCP port whatsoever

Under /api/, nginx serves an explicit allowlist and returns 404 for everything else. Apache's ScriptAlias would otherwise expose the whole cgi-bin directory, several programs of which need data this image deliberately does not import, or advertise facilities only the public servers run. The six endpoints are interpreter, status, timestamp, kill_my_queries, convert and map.

for e in interpreter status timestamp kill_my_queries convert map trigger_clone augmented_diff sketch-line; do printf '%-18s ' "$e"; curl -skI -o /dev/null -w '%{http_code}\n' "https://127.0.0.1/api/$e"; done

The six allowlisted endpoints answer; everything else returns 404.

If you want one of the others, add its name to the allowlist regex in /etc/nginx/sites-available/cloudimg-overpass and reload nginx. Nothing has been removed from the installation; only the front door is narrower than upstream's default.

If a query of your own is running too long, you can cancel your own — and only your own — queries:

curl -sk https://127.0.0.1/api/kill_my_queries

Step 10: Resource limits, and how to change them

Upstream's dispatcher defaults are sized for the public overpass-api.de hardware: 12 GiB of query space, 262,144 time units, and no rate limit at all. On a Standard_B2s that first number is three times the machine's RAM. This image therefore starts the dispatcher with limits chosen for the machine:

Setting	Value here	Upstream default	What it does
--space	1 GiB	12 GiB	Total memory across all running queries
--time	3600	262144	Total time units across all running queries
--rate-limit	2	0 (disabled)	Concurrent queries from one client address
--allow-duplicate-queries	yes	no	Whether an identical repeated query is accepted

Individual queries can ask for less with [timeout:N] (seconds, default 180) and [maxsize:N] (bytes, default 512 MiB) in the query prologue. A query asking for more than the server allows is refused rather than accepted and then killed.

The last row deserves a word. Upstream refuses a byte identical query from the same client until the first one's timeout window elapses, which is sound anti abuse for a public server facing the open internet. On a private appliance it is a trap: polling one query on a schedule, or a dashboard refreshing, would fail for up to three minutes at a time. This image allows repeats. If you are exposing this server to untrusted traffic, set it back to no.

To change any of them, edit the unit and restart:

sudo grep -A2 '^ExecStart=' /etc/systemd/system/overpass-dispatcher.service

Set new values in /etc/systemd/system/overpass-dispatcher.service, then sudo systemctl daemon-reload && sudo systemctl restart overpass-dispatcher.service. The dispatcher can also be re-limited live, without a restart, by calling it with no --db-dir:

sudo /usr/local/overpass/bin/dispatcher --rate-limit=2 && sleep 1 && curl -sk https://127.0.0.1/api/status | grep -i 'rate limit'

nginx adds its own limits on top, in /etc/nginx/conf.d/cloudimg-overpass-limits.conf: 2 requests per second per client address with a burst of 10, and a cap of 4 concurrent connections to /api/. Clients over the limit get 429.

Step 11: Load your own region

The bundled Luxembourg extract is there so the server works out of the box. Replacing it with your own region is the normal next step.

Pick your extract from Geofabrik at https://download.geofabrik.de/. Anything from a city to a continent works; the full planet is available from https://planet.openstreetmap.org/. Overpass reads OpenStreetMap XML rather than PBF, so the download is streamed through osmium, which is already installed.

Import takes minutes for a country and many hours for the planet, so run it under screen or nohup for anything large. Stop the dispatchers first — update_database refuses to touch a database that a dispatcher is holding, and it is right to.

# 1. Download your region and verify it against Geofabrik's published checksum
cd /srv/overpass
sudo curl -fL -o region.osm.pbf https://download.geofabrik.de/europe/belgium-latest.osm.pbf
sudo curl -fL -o region.osm.pbf.md5 https://download.geofabrik.de/europe/belgium-latest.osm.pbf.md5
sudo sed 's/  .*/  region.osm.pbf/' region.osm.pbf.md5 | md5sum -c

# 2. Note the data timestamp and replication sequence from the file header
osmium fileinfo -g header.option.osmosis_replication_timestamp region.osm.pbf
osmium fileinfo -g header.option.osmosis_replication_sequence_number region.osm.pbf

# 3. Stop the dispatchers and clear the old database
sudo systemctl stop overpass-areas-dispatcher.service overpass-dispatcher.service
sudo rm -rf /srv/overpass/db/*

# 4. Import. --map-compression-method=lz4 is not optional: without it the .map files are
#    written uncompressed and a country sized extract produces a database several times
#    larger than it needs to be.
sudo -u overpass bash -c 'osmium cat -f osm /srv/overpass/region.osm.pbf \
  | /usr/local/overpass/bin/update_database --db-dir=/srv/overpass/db/ --meta \
      --version=2026-09-01T20:20:50Z \
      --compression-method=lz4 --map-compression-method=lz4'

# 5. Put the area rules back, record the replication start point, restart, rebuild areas
sudo cp -pR /usr/local/overpass/rules /usr/local/overpass/templates /srv/overpass/db/
echo 4897 | sudo -u overpass tee /srv/overpass/db/replicate_id
sudo chown -R overpass:overpass /srv/overpass/db
sudo systemctl start overpass-dispatcher.service overpass-areas-dispatcher.service
sudo systemctl start overpass-areas-update.service
sudo rm -f /srv/overpass/region.osm.pbf /srv/overpass/region.osm.pbf.md5

Substitute the timestamp and sequence number you read in step 2. The --version value is what /api/timestamp reports, so getting it right is what lets your users tell how fresh your data is.

Sizing, measured on this image: a 47 MB Luxembourg extract produces a 2.2 GB database with lz4 compression, and roughly 17 GB without it. Scale from there, and give yourself headroom — Overpass is heavily dependent on the page cache, so a database that fits comfortably in RAM answers a great deal faster than one that does not.

Step 12: Grow the data volume

A larger region needs a larger volume. Azure managed disks can be expanded in place; the virtual machine must be deallocated first.

# From your workstation, with the VM deallocated
az vm deallocate --resource-group overpass-rg --name overpass-vm
DISK=$(az vm show -g overpass-rg -n overpass-vm --query "storageProfile.dataDisks[0].name" -o tsv)
az disk update --resource-group overpass-rg --name "$DISK" --size-gb 256
az vm start --resource-group overpass-rg --name overpass-vm

# Then on the VM, grow the filesystem onto the new space
sudo resize2fs /dev/disk/azure/scsi1/lun0
df -h /srv/overpass

Disks can be grown but not shrunk, so increase in steps you are comfortable paying for.

Step 13: Keep the data current

A snapshot ages. Overpass ships a pair of daemons that fetch replication diffs and apply them continuously — but which diffs you want depends on what you imported, and the distinction matters more than it first appears.

If you imported the full planet, use the OpenStreetMap minute diffs. This is the setup upstream documents, and it keeps a planet database within a couple of minutes of live:

sudo -u overpass mkdir -p /srv/overpass/diffs
sudo -u overpass nohup /usr/local/overpass/bin/fetch_osc.sh auto \
  "https://planet.openstreetmap.org/replication/minute/" "/srv/overpass/diffs/" &
sudo -u overpass nohup /usr/local/overpass/bin/apply_osc_to_db.sh \
  "/srv/overpass/diffs/" auto --meta=yes &

If you imported a regional extract, minute diffs are the wrong source. They are planet wide, and applying them to a region does not do what you would expect. Geofabrik publishes per region daily updates instead, at the replication URL recorded in the file header when you imported. The image records both values for the bundled extract so you do not have to work out where in the stream your snapshot sits:

cat /srv/overpass/db/replicate_id; cat /srv/overpass/db/replicate_base_url

Point fetch_osc.sh at that base URL rather than the planet one, and note that region updates are daily, not minutely. Geofabrik's per region diffs require a free account for some regions; see https://download.geofabrik.de/technical.html.

If you would rather not run diffs at all, re-importing a fresh extract on a schedule (Step 11) is a perfectly reasonable alternative, and is simpler to reason about.

When the database is being updated continuously, the daily area rebuild may be too infrequent for you. Upstream's rules_loop.sh regenerates areas in a continuous loop instead; this image uses a daily timer because a database that only changes when you change it does not need a permanent background job on two vCPUs.

Step 14: Replace the TLS certificate

The certificate generated at first boot is self signed, which is right for a machine that has no name yet. Once yours has a DNS name, replace it.

# With a certificate authority, for example Let's Encrypt
sudo apt-get install -y certbot
sudo certbot certonly --standalone -d overpass.example.com
sudo ln -sf /etc/letsencrypt/live/overpass.example.com/fullchain.pem /etc/nginx/tls/overpass.crt
sudo ln -sf /etc/letsencrypt/live/overpass.example.com/privkey.pem /etc/nginx/tls/overpass.key
sudo nginx -t && sudo systemctl reload nginx

certbot --standalone needs port 80 free, so stop nginx for the issuance and start it again afterwards, or use the webroot plugin against /var/www/overpass.

If you are bringing your own certificate, put the full chain at /etc/nginx/tls/overpass.crt and the private key at /etc/nginx/tls/overpass.key with mode 0600, then sudo nginx -t && sudo systemctl reload nginx.

Step 15: Verify the deployment

The image ships a self test that exercises the whole appliance the way a customer meets it: both dispatchers, the TLS front, the certificate identity, every allowlisted endpoint, a real query returning real objects, the area index, the attribution, the database shape, and the complete set of network facing ports.

sudo /usr/local/bin/overpass-selftest

Every line must read ok and the last line must read PASS.

A few individual checks worth knowing by hand:

curl -sk -o /dev/null -w 'landing page: %{http_code}\n' https://127.0.0.1/ ; curl -s -o /dev/null -w 'port 80 redirect: %{http_code}\n' http://127.0.0.1/

du -sh /srv/overpass/db && df -h /srv/overpass | tail -1

Baked versions and configuration

Component	Version / value
Overpass API	0.7.62.11 (source hash 87bfad187673d891327f8bb68de7002a9e0e401d)
Source	https://dev.overpass-api.de/releases/osm-3s_v0.7.62.11.tar.gz, SHA-256 pinned
Base OS	Ubuntu 24.04 LTS
Install prefix	/usr/local/overpass
Database	/srv/overpass/db on a dedicated 32 GiB volume
Bundled extract	Geofabrik Luxembourg, snapshot 2026-09-01
Extract SHA-256	772c9abc4afb4058010c36e9b9fa39e3e5c3ec7ee3fc918eefbda89a99b542c7
Data timestamp	2026-09-01T20:20:50Z
Database size	~2.2 GB (lz4 map and data compression)
Web front	nginx 1.24 on :443 (TLS) and :80 (redirect)
CGI host	Apache 2.4 on 127.0.0.1:8080
Service account	overpass (system account)

Useful paths:

ls /usr/local/overpass/bin/ | head -12

cat /srv/overpass/ATTRIBUTION.txt

Data licence and attribution

The map data this server returns comes from OpenStreetMap and is licensed under the Open Database Licence (ODbL) 1.0. This is a share alike licence and it travels with the data.

In practice, if you publish anything produced from this server — a map, a dataset, an application screen showing the results — you must:

• credit (c) OpenStreetMap contributors, somewhere a user would reasonably look
• make clear the data is available under the ODbL, with a link to https://opendatacommons.org/licenses/odbl/1-0/ or to https://www.openstreetmap.org/copyright
• if you publish an adapted database, offer it under the ODbL as well

Overpass API emits the notice in every JSON and XML response for you, and the appliance carries the full statement in three places on the machine: the landing page at /, /srv/overpass/ATTRIBUTION.txt, and /usr/share/doc/overpass-api/ATTRIBUTION.txt. Read the full text before you redistribute anything.

The software is separate from the data. Overpass API is licensed under the GNU Affero General Public License v3.0, and the licence text is on the machine:

head -3 /usr/share/doc/overpass-api/COPYING && ls /usr/share/doc/overpass-api/

It is shipped here unmodified; the pristine upstream source for this exact build is the tarball named in the table above. Because the AGPL's section 13 concerns offering modified software over a network, and this software is not modified, pointing users at that upstream release is what the licence asks for.

OpenStreetMap is a trademark of the OpenStreetMap Foundation. It is used throughout this guide and on the appliance to factually name the data this server serves, which is what the OSMF Trademark Policy permits. cloudimg is not endorsed by or affiliated with the OpenStreetMap Foundation, and is not affiliated with the Overpass API project.

Security notes

• Overpass API has no authentication, by design. It is a read only query API and that is how every public instance runs. This image does not pretend otherwise. Treat the network security group as the access control: allow 443 only from the networks that should reach the service.

• Only nginx faces the network. Apache, which hosts the query CGI, binds 127.0.0.1:8080. Both dispatchers use Unix domain sockets and open no TCP port. The complete set of off machine ports is 22, 80, 443.

• The /api/ surface is an allowlist, not everything Apache could serve. Six endpoints are exposed; every other program in the CGI directory returns 404.

• Client addresses are real. nginx passes X-Forwarded-For and Apache's mod_remoteip restores it, so per address rate limiting and kill_my_queries act on the actual client rather than seeing every request as coming from the proxy.

• The TLS key pair is generated on your machine. No key material ships in the image, and nginx is configured so that it cannot start until first boot has produced one. Two virtual machines from this image have different certificates.

• Nothing runs as root that does not need to. The dispatchers and the database are owned by the overpass system account. It is deliberately a system account: systemd-logind removes a departing user's shared memory, and the dispatcher keeps its coordination state there, so a normal user account would mean an administrator logging out of SSH could stop the database.

• Read only means read only. There is no endpoint on this appliance that modifies the database. Updates happen only through the import and diff tooling you run yourself, as root, on the machine.

• Unattended security upgrades are enabled, and the base was fully patched at build time.

Support

Every cloudimg image comes with 24/7 support and a guaranteed 24 hour response SLA. Contact support@cloudimg.co.uk.

Upstream documentation: the Overpass API manual at https://dev.overpass-api.de/overpass-doc/en/, the Overpass QL reference at https://wiki.openstreetmap.org/wiki/Overpass_API/Overpass_QL, and a local copy of the upstream install guides at /usr/share/doc/overpass-api/html/.