Add local and public QR sharing for training profiles

2026-09-03 20:15:13 +02:00
parent 4f847610dc
commit 2d56b74731
15 changed files with 965 additions and 226 deletions
--- a/scripts/teltonika/nginx.conf
+++ b/scripts/teltonika/nginx.conf
@@ -0,0 +1,89 @@
+# RaceCore public-training reverse proxy template for Teltonika/OpenWrt.
+# Replace racecore.example.org, 192.0.2.10:8081 and certificate paths.
+user root;
+worker_processes 1;
+pid /var/run/racecore-nginx.pid;
+error_log /tmp/racecore-nginx-error.log warn;
+
+events { worker_connections 256; }
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    client_body_temp_path /tmp/nginx/client_body;
+    proxy_temp_path /tmp/nginx/proxy;
+    fastcgi_temp_path /tmp/nginx/fastcgi;
+    uwsgi_temp_path /tmp/nginx/uwsgi;
+    scgi_temp_path /tmp/nginx/scgi;
+    access_log off;
+    sendfile on;
+    keepalive_timeout 30;
+    server_tokens off;
+
+    upstream racecore_backend {
+        server 192.0.2.10:8081;
+        keepalive 4;
+    }
+
+    server {
+        listen 443 ssl;
+        server_name racecore.example.org;
+
+        ssl_certificate /etc/uhttpd.crt;
+        ssl_certificate_key /etc/uhttpd.key;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_prefer_server_ciphers on;
+        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA256';
+
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-referrer" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+
+        location ^~ /public-training/ {
+            limit_except GET HEAD { deny all; }
+            proxy_pass http://racecore_backend;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+            proxy_set_header Host $host;
+            # RaceCore normally sees an http backend while the browser uses https.
+            # Removing browser Origin avoids a false same-origin CORS rejection.
+            proxy_set_header Origin "";
+            proxy_set_header Referer "";
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_connect_timeout 3s;
+            proxy_read_timeout 30s;
+            proxy_send_timeout 30s;
+            proxy_buffering off;
+            add_header Cache-Control "no-store" always;
+        }
+
+        location = /src/public_training.js {
+            limit_except GET HEAD { deny all; }
+            proxy_pass http://racecore_backend;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+            proxy_set_header Host $host;
+            proxy_set_header Origin "";
+            proxy_set_header Referer "";
+            proxy_set_header X-Forwarded-Proto $scheme;
+            add_header Cache-Control "no-store" always;
+        }
+
+        location = /src/public_training.css {
+            limit_except GET HEAD { deny all; }
+            proxy_pass http://racecore_backend;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+            proxy_set_header Host $host;
+            proxy_set_header Origin "";
+            proxy_set_header Referer "";
+            proxy_set_header X-Forwarded-Proto $scheme;
+            add_header Cache-Control "no-store" always;
+        }
+
+        location / { return 404; }
+    }
+}