octoturge
b4948076a0
Windows discovery tool / windows (push) Successful in 1m24s
The proxy put its configured gateway_token straight into the upgrade's Authorization header, but the backend only accepts a one-hour edge JWT (scope "edge") there, minted by POST /auth/edge-token from the farm's edge proxy token. Nothing in the proxy ever made that call, so a gateway configured with the token the console hands out could not connect at all, and one given a hand-minted JWT (which is what every test did) would have been locked out an hour later on its first reconnect. Each connection attempt now starts by trading gateway_token for a fresh JWT, at an address derived from the socket URL so there is one to configure. A 401 is reported as what it means (token rotated or wrong), since retrying will not fix it. Config's Debug no longer prints the token. tests/uplink_late_result.rs now plays the cloud's exchange endpoint and asserts the socket opens with the minted JWT, not the configured token. .env.example and continuum.example.toml say what the token is.
46 lines
2.2 KiB
Bash
46 lines
2.2 KiB
Bash
# Identity
|
|
CONTINUUM_GATEWAY_ID=gw-farm01-rpi01
|
|
CONTINUUM_FARM_ID=replace-with-farm-uuid
|
|
# The farm's edge proxy token, shown once by the console's Setup page (or
|
|
# POST /farms/:id/edge-proxy-token). The gateway trades it for a one-hour edge
|
|
# JWT (POST /auth/edge-token) on every connection, and the JWT - sent as an
|
|
# Authorization: Bearer header on the WebSocket upgrade, never in a message
|
|
# or the URL - is what the backend verifies before any socket exists.
|
|
CONTINUUM_GATEWAY_TOKEN=replace-with-the-farms-edge-proxy-token
|
|
|
|
# Cloud uplink
|
|
CONTINUUM_UPLINK_URL=wss://api.continuum.local/ws/edge/v1
|
|
|
|
# Camera restreaming. The config file is GENERATED by this daemon from what
|
|
# the printers themselves report - don't write it by hand, and keep it out of
|
|
# version control: it holds printer access codes.
|
|
CONTINUUM_GO2RTC_BIN=/usr/local/bin/go2rtc
|
|
CONTINUUM_GO2RTC_CONFIG=./go2rtc.yaml
|
|
CONTINUUM_GO2RTC_API_LISTEN=:1984
|
|
|
|
# The go2rtc API serves WebRTC, and the listen address above is every
|
|
# interface, so it is always password-protected: leave this unset and the
|
|
# daemon generates a random password each run and writes it into the config
|
|
# file above, which is already a secret. Set it only if you need a stable one
|
|
# (to open go2rtc's own web UI, say). The username is always "continuum".
|
|
#
|
|
# go2rtc exempts loopback from this, so a check from the gateway itself always
|
|
# succeeds - test from another machine if you want to confirm it is on.
|
|
# CONTINUUM_GO2RTC_PASSWORD=
|
|
|
|
# What a browser can reach the streams at, reported to the cloud. A bind
|
|
# address is not one, which is why this is separate from the listen address
|
|
# above; only you know this gateway's reachable name. Note this is a LAN
|
|
# address: a browser on this network can play the stream, one outside cannot.
|
|
# Leave it unset to advertise no streams at all, which is the safe default -
|
|
# a wrong URL here makes the UI offer a player that cannot connect.
|
|
# CONTINUUM_STREAM_BASE_URL=http://gateway.local:1984
|
|
|
|
# Fleet config - see printers.example.toml. Bambu MQTTS certificate trust
|
|
# (per-printer ca_cert_path/require_valid_cert, and automatic
|
|
# trust-on-first-connect pinning otherwise) is configured per printer in
|
|
# that file, not here.
|
|
CONTINUUM_PRINTERS_PATH=printers.toml
|
|
|
|
RUST_LOG=info,continuum_proxy=debug
|