michaelandClaude Fable 5.1
d785ebf979
PUBLIC-ACCESS.md now describes what actually runs: a local UniFi DNS record at Apollo Beach and North Attleboro pointing the name at the Boba-Fett NAS, a DSM reverse proxy rule from port 80 to the booth Mac at 10.1.7.39:3100 with WebSocket headers, X-Forwarded-Host and a 3600 s read timeout, and an nginx block that redirects https:// to http://. The hand-written nginx example is kept for non-DSM proxies, with the booth Mac address corrected and proxy_buffering off for live audio. docs/examples/waters-church-na/ holds the runbook, the script run on Boba-Fett, and the UniFi DNS record script used to create the records. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
65 lines
3.0 KiB
Bash
Executable File
65 lines
3.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# translate.watersmedia.org on Boba-Fett (Synology DSM 7.0.1).
|
|
#
|
|
# 1. Creates the DSM reverse-proxy rule http://translate.watersmedia.org:80
|
|
# -> http://10.1.7.39:3100 (Church Translate) with WebSocket headers,
|
|
# X-Forwarded-Host, and a 3600 s read timeout, through DSM's own API so it
|
|
# shows up in Control Panel -> Login Portal -> Advanced -> Reverse Proxy.
|
|
# 2. Adds an nginx server block that answers https://translate.watersmedia.org
|
|
# with a 301 to the http:// address (the name is LAN-only and has no
|
|
# certificate, so browsers warn before the redirect; that is expected).
|
|
# 3. Tests the nginx config, reloads it, and prints a local check.
|
|
#
|
|
# Idempotent: re-running skips the rule if it exists and rewrites the redirect.
|
|
# Run on Boba-Fett as root: sudo bash ~/translate-proxy.sh
|
|
set -euo pipefail
|
|
|
|
NAME=translate.watersmedia.org
|
|
BACKEND_IP=10.1.7.39
|
|
BACKEND_PORT=3100
|
|
RP_JSON=/usr/syno/etc/www/ReverseProxy.json
|
|
REDIRECT_CONF=/usr/local/etc/nginx/sites-enabled/translate-redirect.conf
|
|
|
|
if [ "$(id -u)" != 0 ]; then
|
|
echo "Run with sudo: sudo bash $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "== 1. DSM reverse proxy rule for $NAME"
|
|
if grep -q "\"fqdn\" : \"$NAME\"" "$RP_JSON"; then
|
|
echo " rule already present in $RP_JSON, skipping create"
|
|
else
|
|
# $http_upgrade etc. are nginx variables and must reach DSM literally.
|
|
ENTRY='{"description":"translate.watersmedia.org","frontend":{"acl":null,"fqdn":"translate.watersmedia.org","https":{"hsts":false},"port":80,"protocol":0},"backend":{"fqdn":"10.1.7.39","port":3100,"protocol":0},"customize_headers":[{"name":"Upgrade","value":"$http_upgrade"},{"name":"Connection","value":"$connection_upgrade"},{"name":"X-Forwarded-Host","value":"$http_host"}],"proxy_connect_timeout":60,"proxy_read_timeout":3600,"proxy_send_timeout":60,"proxy_http_version":1,"proxy_intercept_errors":false}'
|
|
OUT=$(/usr/syno/bin/synowebapi --exec api=SYNO.Core.AppPortal.ReverseProxy method=create version=1 entry="$ENTRY" 2>&1 || true)
|
|
echo " $OUT"
|
|
if ! echo "$OUT" | grep -q '"success" *: *true'; then
|
|
echo " synowebapi did not report success; stopping before the redirect." >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
echo "== 2. HTTPS -> HTTP redirect block"
|
|
cat > "$REDIRECT_CONF" <<'EOF'
|
|
# translate.watersmedia.org is served over plain HTTP on the LAN (no certificate).
|
|
# Anyone who types https:// is sent to the http:// address. Added 2026-10-15.
|
|
server {
|
|
listen 443 ssl;
|
|
server_name translate.watersmedia.org;
|
|
return 301 http://translate.watersmedia.org$request_uri;
|
|
}
|
|
EOF
|
|
echo " wrote $REDIRECT_CONF"
|
|
|
|
echo "== 3. nginx test + reload"
|
|
/usr/bin/nginx -t
|
|
/usr/syno/bin/synosystemctl reload nginx 2>/dev/null || /usr/bin/nginx -s reload
|
|
echo " reloaded"
|
|
|
|
echo "== 4. Local checks from Boba-Fett"
|
|
echo -n " http /healthz : "
|
|
curl -s -m 5 --resolve "$NAME:80:127.0.0.1" "http://$NAME/healthz"; echo
|
|
echo -n " https / : "
|
|
curl -sk -m 5 -o /dev/null -w '%{http_code} -> %{redirect_url}\n' --resolve "$NAME:443:127.0.0.1" "https://$NAME/"
|
|
echo "done"
|