michaelandClaude Fable 5.1
d785ebf979
PUBLIC-ACCESS.md now describes what actually runs: a local UniFi DNS record at Apollo Beach and North Attleboro pointing the name at the Boba-Fett NAS, a DSM reverse proxy rule from port 80 to the booth Mac at 10.1.7.39:3100 with WebSocket headers, X-Forwarded-Host and a 3600 s read timeout, and an nginx block that redirects https:// to http://. The hand-written nginx example is kept for non-DSM proxies, with the booth Mac address corrected and proxy_buffering off for live audio. docs/examples/waters-church-na/ holds the runbook, the script run on Boba-Fett, and the UniFi DNS record script used to create the records. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
4.6 KiB
translate.watersmedia.org — local DNS and reverse proxy
Puts the Church Translate congregation page on a church hostname inside the Apollo Beach and North Attleboro networks. LAN only, plain HTTP, no WAN access. The app's own requirements are in PUBLIC-ACCESS.md. This was done on 2026-10-15 against app 3.23.2 build 121.
| What | Value |
|---|---|
| App host | Translate Mac, North Attleboro LAN 10.1.7.39 |
| App port | TCP 3100, plain HTTP + WebSocket on /ws (the only port to expose) |
| Reverse proxy | Boba-Fett (Synology DSM 7.0.1), 10.1.1.4, ssh boba-fett (port 202, user Michael) |
| Hostname | translate.watersmedia.org |
| Local DNS | A record on the AB and NA UDM Pro consoles → 10.1.1.4, TTL 300 |
| HTTPS | no certificate; https://translate.watersmedia.org answers 301 to http:// |
curl -s http://10.1.7.39:3100/healthz should return {"ok":true,"live":true,...}
before anything below is tested.
1. Local DNS on UniFi (AB and NA) — done 2026-10-15
Each console has its own Network API key saved as
~/.config/unifi/<site>-network-api-key (created in Settings → Control Plane →
Integrations → Create API Key; all five sites are saved on Michael's Mac). The
record was created with:
python3 docs/examples/waters-church-na/unifi-dns-record.py translate.watersmedia.org 10.1.1.4 --sites apollo-beach,north-attleboro
Resulting policy ids: AB 379f868d-a956-4ec1-acef-13557153ff3f, NA
16bf7109-ec68-41f9-9c16-fa6a62471430. Both gateways answer 10.1.1.4.
--list shows every DNS policy per console; --dry-run previews.
Why Boba-Fett and not the Mac: the proxy owns the hostname so the port never
appears in the URL, and AB clients reach 10.1.1.4 over the site-to-site link
exactly as they already do for chronicles-na.waterschurch.org.
2. Reverse proxy on Boba-Fett — done 2026-10-15
boba-fett-translate-proxy.sh does the whole
job and is idempotent. It was run on 2026-10-15; afterwards /healthz,
/api/languages, the /ws upgrade (101) and the HTTPS 301 all checked out
from both the AB and NA LANs, and /operator returned 404 as designed. A copy lives at ~/translate-proxy.sh on Boba-Fett
(Michael's home). DSM's reverse-proxy API and nginx reload both need root, and
sudo there asks for Michael's password, so run it interactively:
ssh -t boba-fett sudo bash translate-proxy.sh
What it creates:
| Piece | Where | Content |
|---|---|---|
| DSM reverse proxy rule | Control Panel → Login Portal → Advanced → Reverse Proxy, "translate.watersmedia.org" | HTTP translate.watersmedia.org:80 → HTTP 10.1.7.39:3100; custom headers Upgrade: $http_upgrade, Connection: $connection_upgrade (WebSocket), X-Forwarded-Host: $http_host; read timeout 3600 s; HTTP/1.1 |
| HTTPS redirect | /usr/local/etc/nginx/sites-enabled/translate-redirect.conf |
server { listen 443 ssl; server_name translate.watersmedia.org; return 301 http://translate.watersmedia.org$request_uri; } |
DSM already sends Host, X-Real-IP, X-Forwarded-For and
X-Forwarded-Proto on every rule. The whole host lands on /, which the app
requires. /operator returning 404 through the proxy is intended; staff use
http://10.1.7.39:3100/operator on the LAN.
To undo: delete the rule in the DSM Reverse Proxy list, remove the redirect
file, and sudo synosystemctl reload nginx.
Known limits:
- The HTTPS redirect only runs after a TLS handshake with Boba-Fett's default certificate, so a browser shows a certificate warning first. A trusted certificate for this name would need DNS-01 validation against the watersmedia.org zone (cPanel), which is not set up.
- DSM's reverse proxy cannot turn
proxy_bufferingoff. HLS segments under/live/are small discrete files and the WebSocket is a tunnel after upgrade, so the effect is minor; if audio lag is reported, that is the first thing to revisit with a hand-written nginx include.
3. After the proxy answers
- On the NA LAN open
http://10.1.7.39:3100/operator, enter the operator PIN, and set Public address tohttp://translate.watersmedia.org(no trailing slash). Otherwise the QR code and poster keep advertising10.1.7.39:3100. - Verify from a machine at AB and one at NA:
curl -s http://translate.watersmedia.org/healthz
It must return the same JSON as the direct 10.1.7.39:3100 check.
3. Open the page on a phone on guest wifi and confirm captions appear
(WebSocket) and spoken audio plays (/live/). If phones cannot connect at
all, look at client isolation on the guest network and the guest → 10.1.1.4
firewall rule before anything else.