thepraandClaude Opus 5.5
7cfc8b6de5
Phases two and three ship together, because their code grew in the same files. With consent the app asks the router to open 80, 443 and a high port for ten minutes (UPnP, NAT-PMP or PCP), and the server, holding a single-use ticket bound to the caller's own address, connects back and must get an HMAC only the app can give; the mappings are removed after the run and remembered until then, so a crash cannot leave one open. Hairpin is tried from inside. Two STUN servers, the outside one first, tell easy from hard NAT. Mail gets port 25 to Gmail and Outlook, the reverse name and five blocklists through the user's own resolver, network-wide UCEPROTECT listings counted as a caution. DNS, speed against the server (four at a time, twelve an hour per address) and the device follow, and six uses (website, home from outside, files, game server, fediverse, mail) close the run as possible, possible with a named workaround, or can't tell. Findings can be shared after reading the exact JSON: a file per submission under the unit's state directory, ten a day per address, deletable by the token the app keeps, swept after twelve months; /privacy says all of it in English and Italian. QR codes lead to the downloads. Every language carries every string. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
73 lines
1.9 KiB
Plaintext
73 lines
1.9 KiB
Plaintext
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name meweb.arasaka.software v4.meweb.arasaka.software v6.meweb.arasaka.software;
|
|
access_log off;
|
|
|
|
location ^~ /.well-known/acme-challenge/ {
|
|
root /var/www/acme;
|
|
default_type "text/plain";
|
|
allow all;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen 8444 ssl proxy_protocol;
|
|
listen [::]:443 ssl;
|
|
server_name meweb.arasaka.software v4.meweb.arasaka.software v6.meweb.arasaka.software;
|
|
|
|
ssl_certificate /root/.acme.sh/meweb.arasaka.software_ecc/fullchain.cer;
|
|
ssl_certificate_key /root/.acme.sh/meweb.arasaka.software_ecc/meweb.arasaka.software.key;
|
|
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
|
|
access_log off;
|
|
error_log /var/log/nginx/meweb.arasaka.software.error.log;
|
|
|
|
client_max_body_size 128k;
|
|
|
|
location ^~ /.well-known/acme-challenge/ {
|
|
root /var/www/acme;
|
|
default_type "text/plain";
|
|
allow all;
|
|
}
|
|
|
|
location = /api/speed/up {
|
|
client_max_body_size 12m;
|
|
proxy_request_buffering off;
|
|
proxy_pass http://127.0.0.1:5480;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header Connection "";
|
|
}
|
|
|
|
location = /api/speed/down {
|
|
proxy_buffering off;
|
|
proxy_pass http://127.0.0.1:5480;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header Connection "";
|
|
}
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:5480;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header Connection "";
|
|
}
|
|
}
|