octoturgeandClaude Opus 5
da6260fa9c
The uplink put its edge JWT in a `token` field on the `hello` message. It now goes in an `Authorization: Bearer` header on the WebSocket upgrade request, which the backend verifies before the socket exists - so a bad token is an HTTP 401 here rather than a connection that opens and is then closed, and the credential stays out of the URL, where it would land in every access and proxy log on the way. `Authorization` is the header those tools already know to redact. `farm_id` stays on the hello even though the token carries the same claim: the backend checks the two against each other rather than trusting the message, so sending it is how a configuration mismatch gets caught instead of silently working against the wrong farm. The cost is that tokio-tungstenite no longer derives the handshake from a URL for us - a request we build ourselves needs its own `Host`, `Connection`, `Upgrade`, `Sec-WebSocket-Version` and `Sec-WebSocket-Key`, and a handshake missing any of them is rejected rather than ignored. `host_header` errors rather than guessing if the URL has no authority, because a wrong `Host` fails the handshake far less legibly than this does. Verified against a real backend rather than assumed: a valid token handshakes to HTTP 101 and the server reads the farm from the token, and a forged one is refused with 401 before any socket exists. 64 tests, clippy unchanged at the two deliberate variant-size warnings, `cargo deny check licenses` ok. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
34 lines
1.5 KiB
Bash
34 lines
1.5 KiB
Bash
# Identity
|
|
CONTINUUM_GATEWAY_ID=gw-farm01-rpi01
|
|
CONTINUUM_FARM_ID=replace-with-farm-uuid
|
|
# The edge JWT from POST /auth/edge-token. Sent as an Authorization: Bearer
|
|
# header on the uplink's WebSocket upgrade - not in a message and not in the
|
|
# URL - so the backend verifies it before any socket exists.
|
|
CONTINUUM_GATEWAY_TOKEN=replace-with-provisioning-token
|
|
|
|
# Cloud uplink
|
|
CONTINUUM_UPLINK_URL=wss://api.continuum.local/ws/edge/v1
|
|
|
|
# Camera restreaming. The config file is GENERATED by this daemon from what
|
|
# the printers themselves report - don't write it by hand, and keep it out of
|
|
# version control: it holds printer access codes.
|
|
CONTINUUM_GO2RTC_BIN=/usr/local/bin/go2rtc
|
|
CONTINUUM_GO2RTC_CONFIG=./go2rtc.yaml
|
|
CONTINUUM_GO2RTC_API_LISTEN=:1984
|
|
|
|
# What a browser can reach the streams at, reported to the cloud. A bind
|
|
# address is not one, which is why this is separate from the listen address
|
|
# above; only you know this gateway's reachable name. Note this is a LAN
|
|
# address: a browser on this network can play the stream, one outside cannot.
|
|
# Leave it unset to advertise no streams at all, which is the safe default -
|
|
# a wrong URL here makes the UI offer a player that cannot connect.
|
|
# CONTINUUM_STREAM_BASE_URL=http://gateway.local:1984
|
|
|
|
# Fleet config - see printers.example.toml. Bambu MQTTS certificate trust
|
|
# (per-printer ca_cert_path/require_valid_cert, and automatic
|
|
# trust-on-first-connect pinning otherwise) is configured per printer in
|
|
# that file, not here.
|
|
CONTINUUM_PRINTERS_PATH=printers.toml
|
|
|
|
RUST_LOG=info,continuum_proxy=debug
|