Probably has bugs. Probably no security bugs. Feedback is welcome (but I don’t care enough about this to try my hardest).

require_once('/var/www/html/geoip2.phar');
use GeoIp2\Database\Reader;

$ip = $_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'];

$cityReader = new Reader('/var/local/php/GeoLite2-City.mmdb');
$record = $cityReader->city($ip);

header('Content-Type: image/png');

$image = @imagecreatefrompng('lemmybase.png');

$black = imagecolorallocate($image, 0, 0, 0);

// "Some City, SS, Country Name"
$text = $record->city->name . ', ' . $record->mostSpecificSubdivision->isoCode . ', ' . $record->country->name;

/* $font_path = '/tmp/ComicSand.ttf'; */
$font_path = '/usr/share/fonts/ubuntu/Ubuntu-M.ttf';

// Render text
imagettftext($image, 30, 0, 28, 224, $black, $font_path, chunk_split($text, 22));

// Dump image to web server
imagepng($image);

// Free resources
imagedestroy($image);

Edit: damn, Lemmy really hates < ? php. Just imagine that’s the first line in the file.