docs/PUBLIC-ACCESS.md now describes what actually runs as of 2026-10-15 instead of a hypothetical nginx block:
Local DNS on the UniFi consoles at Apollo Beach and North Attleboro: translate.watersmedia.org → 10.1.1.4 (Boba-Fett), TTL 300. No public record; the name works on the building WiFi at both campuses and nowhere else.
A DSM reverse proxy rule on Boba-Fett: HTTP translate.watersmedia.org:80 → HTTP 10.1.7.39:3100, with the WebSocket headers, X-Forwarded-Host: $http_host and a 3600 s read timeout. Created through DSM's own API so it appears in the Reverse Proxy UI.
An nginx block on Boba-Fett that answers https://translate.watersmedia.org with a 301 to http://.
The hand-written nginx example is kept for non-DSM proxies, with the booth Mac address corrected from 10.6.3.222 to 10.1.7.39 and proxy_buffering off added for live audio.
The verification section adds the WebSocket upgrade check, the guest-WiFi caveat, and the /operator 404 note.
docs/examples/waters-church-na/ holds the runbook (README.md), the script that was run on Boba-Fett (boba-fett-translate-proxy.sh), and the UniFi DNS record script (unifi-dns-record.py).
Verified
From both the Apollo Beach and North Attleboro LANs after the setup: /healthz returns the same JSON as the direct 10.1.7.39:3100 check, /api/languages is 200, /ws answers 101 Switching Protocols, https:// answers 301 to http://, and /operator is 404 as designed.
Still to do on the Mac: set Public address on the operator page to http://translate.watersmedia.org.
## What changed
`docs/PUBLIC-ACCESS.md` now describes what actually runs as of 2026-10-15 instead of a hypothetical nginx block:
- Local DNS on the UniFi consoles at Apollo Beach and North Attleboro: `translate.watersmedia.org` → `10.1.1.4` (Boba-Fett), TTL 300. No public record; the name works on the building WiFi at both campuses and nowhere else.
- A DSM reverse proxy rule on Boba-Fett: HTTP `translate.watersmedia.org:80` → HTTP `10.1.7.39:3100`, with the WebSocket headers, `X-Forwarded-Host: $http_host` and a 3600 s read timeout. Created through DSM's own API so it appears in the Reverse Proxy UI.
- An nginx block on Boba-Fett that answers `https://translate.watersmedia.org` with a 301 to `http://`.
- The hand-written nginx example is kept for non-DSM proxies, with the booth Mac address corrected from `10.6.3.222` to `10.1.7.39` and `proxy_buffering off` added for live audio.
- The verification section adds the WebSocket upgrade check, the guest-WiFi caveat, and the `/operator` 404 note.
`docs/examples/waters-church-na/` holds the runbook (`README.md`), the script that was run on Boba-Fett (`boba-fett-translate-proxy.sh`), and the UniFi DNS record script (`unifi-dns-record.py`).
## Verified
From both the Apollo Beach and North Attleboro LANs after the setup: `/healthz` returns the same JSON as the direct `10.1.7.39:3100` check, `/api/languages` is 200, `/ws` answers `101 Switching Protocols`, `https://` answers 301 to `http://`, and `/operator` is 404 as designed.
Still to do on the Mac: set Public address on the operator page to `http://translate.watersmedia.org`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
PUBLIC-ACCESS.md now describes what actually runs: a local UniFi DNS
record at Apollo Beach and North Attleboro pointing the name at the
Boba-Fett NAS, a DSM reverse proxy rule from port 80 to the booth Mac at
10.1.7.39:3100 with WebSocket headers, X-Forwarded-Host and a 3600 s
read timeout, and an nginx block that redirects https:// to http://.
The hand-written nginx example is kept for non-DSM proxies, with the
booth Mac address corrected and proxy_buffering off for live audio.
docs/examples/waters-church-na/ holds the runbook, the script run on
Boba-Fett, and the UniFi DNS record script used to create the records.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
michael
merged commit d289d33aab into main2026-10-15 13:21:36 -04:00
michael
deleted branch docs/waters-na-lan-proxy2026-10-15 13:22:04 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What changed
docs/PUBLIC-ACCESS.mdnow describes what actually runs as of 2026-10-15 instead of a hypothetical nginx block:translate.watersmedia.org→10.1.1.4(Boba-Fett), TTL 300. No public record; the name works on the building WiFi at both campuses and nowhere else.translate.watersmedia.org:80→ HTTP10.1.7.39:3100, with the WebSocket headers,X-Forwarded-Host: $http_hostand a 3600 s read timeout. Created through DSM's own API so it appears in the Reverse Proxy UI.https://translate.watersmedia.orgwith a 301 tohttp://.10.6.3.222to10.1.7.39andproxy_buffering offadded for live audio./operator404 note.docs/examples/waters-church-na/holds the runbook (README.md), the script that was run on Boba-Fett (boba-fett-translate-proxy.sh), and the UniFi DNS record script (unifi-dns-record.py).Verified
From both the Apollo Beach and North Attleboro LANs after the setup:
/healthzreturns the same JSON as the direct10.1.7.39:3100check,/api/languagesis 200,/wsanswers101 Switching Protocols,https://answers 301 tohttp://, and/operatoris 404 as designed.Still to do on the Mac: set Public address on the operator page to
http://translate.watersmedia.org.🤖 Generated with Claude Code