Files

41 lines
1.3 KiB
Plaintext

radio.home.example.com {
# SDR scanner recordings on the Raspberry Pi. The one internal service reachable from the internet
# (WAN 443 is forwarded here): known home devices / VPN get in directly, everyone else needs basic auth.
bind 192.168.88.221
log {
output file /data/access.log {
roll_size 10MiB
roll_keep 2
}
format json
}
@home remote_ip 192.168.88.0/26 192.168.88.64/27 192.168.88.96/30 192.168.88.200/29 192.168.88.208/28 192.168.88.224/27 10.88.66.0/24 127.0.0.1/8 ::1
handle @home {
# the radio page lets only LAN clients switch the Pi's speakers: tell it who is really asking
reverse_proxy 192.168.88.35:8090 {
header_up X-Home-Client {remote_host}
}
}
# share links: one recording + its conversation, behind a random token (no file path), open to anyone
@share {
method GET HEAD
path_regexp share ^/s/[A-Za-z0-9_-]{16,32}(/data|/a/[0-9]{1,3})?$
}
handle @share {
reverse_proxy 192.168.88.35:8090 {
header_up -X-Home-Client
}
}
handle /favicon.svg {
reverse_proxy 192.168.88.35:8090
}
handle {
basic_auth {
efir @@BCRYPT_HASH@@
}
reverse_proxy 192.168.88.35:8090 {
header_up -X-Home-Client
}
}
}