# Teltonika/OpenWrt public training proxy

These files are an example, not site-specific configuration. The proxy exposes only
RaceCore public training profiles and their two frontend assets.

## Configure

Edit `nginx.conf` before copying it:

- replace `racecore.example.org` with the public FQDN
- replace `192.0.2.10:8081` with the RaceCore host and port on the LAN
- replace the certificate paths if the router does not use `/etc/uhttpd.crt` and `/etc/uhttpd.key`
- keep the three restricted locations and `proxy_set_header Origin ""`

The default Teltonika certificate encrypts traffic but normally does not match a
public FQDN. Install a certificate issued for the configured FQDN to remove browser
warnings.

## Install

```sh
scp scripts/teltonika/nginx.conf root@ROUTER_IP:/etc/nginx/nginx.conf
scp scripts/teltonika/racecore-nginx.init root@ROUTER_IP:/etc/init.d/racecore-nginx
ssh root@ROUTER_IP
chmod +x /etc/init.d/racecore-nginx
/etc/init.d/nginx disable 2>/dev/null
/etc/init.d/racecore-nginx enable
/etc/init.d/racecore-nginx start
```

The custom init script is useful when Teltonika.s bundled `nginx-util` is missing. It discovers Nginx in the firmware PATH, including `/usr/local/usr/sbin/nginx`, before checking standard paths.
It recreates all RAM-backed Nginx temporary directories under `/tmp` on every boot,
validates the config, and starts Nginx under `procd`.

If Nginx was started manually, stop that process before starting the service:

```sh
nginx -s quit -c /etc/nginx/nginx.conf
/etc/init.d/racecore-nginx start
```

## Verify

```sh
nginx -t -c /etc/nginx/nginx.conf
/etc/init.d/racecore-nginx running
netstat -lntp | grep ':443 '
logread -e racecore-nginx
```

A standard Nginx, Caddy, Traefik, Apache, or cloud reverse proxy can provide the
same result. It only needs to expose:

```text
/public-training/*
/src/public_training.js
/src/public_training.css
```

Never expose `/api/state` or the RaceCore administration UI unless separate
authentication and network controls have been added.