Add local and public QR sharing for training profiles

scripts/teltonika/README.md

@@ -0,0 +1,61 @@
+# Teltonika/OpenWrt public training proxy
+
+These files are an example, not site-specific configuration. The proxy exposes only
+RaceCore public training profiles and their two frontend assets.
+
+## Configure
+
+Edit `nginx.conf` before copying it:
+
+- replace `racecore.example.org` with the public FQDN
+- replace `192.0.2.10:8081` with the RaceCore host and port on the LAN
+- replace the certificate paths if the router does not use `/etc/uhttpd.crt` and `/etc/uhttpd.key`
+- keep the three restricted locations and `proxy_set_header Origin ""`
+
+The default Teltonika certificate encrypts traffic but normally does not match a
+public FQDN. Install a certificate issued for the configured FQDN to remove browser
+warnings.
+
+## Install
+
+```sh
+scp scripts/teltonika/nginx.conf root@ROUTER_IP:/etc/nginx/nginx.conf
+scp scripts/teltonika/racecore-nginx.init root@ROUTER_IP:/etc/init.d/racecore-nginx
+ssh root@ROUTER_IP
+chmod +x /etc/init.d/racecore-nginx
+/etc/init.d/nginx disable 2>/dev/null
+/etc/init.d/racecore-nginx enable
+/etc/init.d/racecore-nginx start
+```
+
+The custom init script is useful when Teltonika's bundled `nginx-util` is missing.
+It recreates all RAM-backed Nginx temporary directories under `/tmp` on every boot,
+validates the config, and starts Nginx under `procd`.
+
+If Nginx was started manually, stop that process before starting the service:
+
+```sh
+nginx -s quit -c /etc/nginx/nginx.conf
+/etc/init.d/racecore-nginx start
+```
+
+## Verify
+
+```sh
+nginx -t -c /etc/nginx/nginx.conf
+/etc/init.d/racecore-nginx running
+netstat -lntp | grep ':443 '
+logread -e racecore-nginx
+```
+
+A standard Nginx, Caddy, Traefik, Apache, or cloud reverse proxy can provide the
+same result. It only needs to expose:
+
+```text
+/public-training/*
+/src/public_training.js
+/src/public_training.css
+```
+
+Never expose `/api/state` or the RaceCore administration UI unless separate
+authentication and network controls have been added.

scripts/teltonika/nginx.conf

@@ -0,0 +1,89 @@
+# RaceCore public-training reverse proxy template for Teltonika/OpenWrt.
+# Replace racecore.example.org, 192.0.2.10:8081 and certificate paths.
+user root;
+worker_processes 1;
+pid /var/run/racecore-nginx.pid;
+error_log /tmp/racecore-nginx-error.log warn;
+
+events { worker_connections 256; }
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    client_body_temp_path /tmp/nginx/client_body;
+    proxy_temp_path /tmp/nginx/proxy;
+    fastcgi_temp_path /tmp/nginx/fastcgi;
+    uwsgi_temp_path /tmp/nginx/uwsgi;
+    scgi_temp_path /tmp/nginx/scgi;
+    access_log off;
+    sendfile on;
+    keepalive_timeout 30;
+    server_tokens off;
+
+    upstream racecore_backend {
+        server 192.0.2.10:8081;
+        keepalive 4;
+    }
+
+    server {
+        listen 443 ssl;
+        server_name racecore.example.org;
+
+        ssl_certificate /etc/uhttpd.crt;
+        ssl_certificate_key /etc/uhttpd.key;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_prefer_server_ciphers on;
+        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA256';
+
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-referrer" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+
+        location ^~ /public-training/ {
+            limit_except GET HEAD { deny all; }
+            proxy_pass http://racecore_backend;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+            proxy_set_header Host $host;
+            # RaceCore normally sees an http backend while the browser uses https.
+            # Removing browser Origin avoids a false same-origin CORS rejection.
+            proxy_set_header Origin "";
+            proxy_set_header Referer "";
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_connect_timeout 3s;
+            proxy_read_timeout 30s;
+            proxy_send_timeout 30s;
+            proxy_buffering off;
+            add_header Cache-Control "no-store" always;
+        }
+
+        location = /src/public_training.js {
+            limit_except GET HEAD { deny all; }
+            proxy_pass http://racecore_backend;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+            proxy_set_header Host $host;
+            proxy_set_header Origin "";
+            proxy_set_header Referer "";
+            proxy_set_header X-Forwarded-Proto $scheme;
+            add_header Cache-Control "no-store" always;
+        }
+
+        location = /src/public_training.css {
+            limit_except GET HEAD { deny all; }
+            proxy_pass http://racecore_backend;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+            proxy_set_header Host $host;
+            proxy_set_header Origin "";
+            proxy_set_header Referer "";
+            proxy_set_header X-Forwarded-Proto $scheme;
+            add_header Cache-Control "no-store" always;
+        }
+
+        location / { return 404; }
+    }
+}

scripts/teltonika/racecore-nginx.init

@@ -0,0 +1,30 @@
+#!/bin/sh /etc/rc.common
+
+START=95
+STOP=10
+USE_PROCD=1
+
+NGINX_BIN="/usr/sbin/nginx"
+NGINX_CONF="/etc/nginx/nginx.conf"
+
+prepare_runtime() {
+    mkdir -p /tmp/nginx/client_body /tmp/nginx/proxy /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
+}
+
+start_service() {
+    prepare_runtime
+    "$NGINX_BIN" -t -c "$NGINX_CONF" || return 1
+    procd_open_instance
+    procd_set_param command "$NGINX_BIN" -c "$NGINX_CONF" -g "daemon off;"
+    procd_set_param respawn 3600 5 5
+    procd_set_param file "$NGINX_CONF"
+    procd_set_param stdout 1
+    procd_set_param stderr 1
+    procd_close_instance
+}
+
+reload_service() {
+    prepare_runtime
+    "$NGINX_BIN" -t -c "$NGINX_CONF" || return 1
+    "$NGINX_BIN" -s reload -c "$NGINX_CONF"
+}