tfaour
6c7468a36e
Build and push server image / build-and-push (push) Successful in 31s
ESP32 side can now reach the tools server over HTTPS: the Tools Server field accepts an https:// address for a TLS-terminating reverse proxy in front of the server (which still only ever speaks plain HTTP itself), trusting Cloudflare's Origin CA root (embedded at build time) since that's the common way to get a real cert on a private origin. Every URL the device builds -- image fetch, config check, manage-menu data, the QR codes' own links -- goes through one build_url() helper that picks the scheme from what's configured. Also adds an optional MANAGEMENT_TOKEN (docker-compose.yml) that gates the web UI (/, /api/*) behind a shared secret -- unset by default, so existing trusted-LAN deployments are unaffected. The same token is entered once during the ESP32's captive-portal setup and gets baked into the manage-menu's QR code (?token=...), so scanning it just works; visiting the page without a valid token shows a plain entry prompt instead of the config UI, and a valid query-param hit sets a cookie so the page's own fetch()/<img> calls stay authorized for the rest of the visit. Device-facing /frame/* endpoints are unaffected -- a separate, already-documented trust boundary.
19 lines
688 B
Plaintext
19 lines
688 B
Plaintext
services:
|
|
espresso-frame-server:
|
|
image: git.thumeit.com/tfaour/espresso-frame-server:latest
|
|
build: .
|
|
ports:
|
|
- "8420:8420"
|
|
volumes:
|
|
- ./data:/data
|
|
environment:
|
|
- CONFIG_PATH=/data/config.json
|
|
- IMMICH_URL=http://your-immich-host:2283
|
|
- IMMICH_API_KEY=your-immich-api-key-here
|
|
# Optional: gates the web UI (/, /api/*) behind this shared secret --
|
|
# leave unset to keep it open on a trusted LAN, same as before. Paste
|
|
# the same value into the ESP32's captive portal setup form (Access
|
|
# Token field) so its manage-menu QR code embeds it automatically.
|
|
- MANAGEMENT_TOKEN=changeme
|
|
restart: unless-stopped
|