mirror of
https://github.com/MarekWo/mc-webui.git
synced 2026-10-30 23:51:57 +01:00
MarekWoandClaude Opus 5
05ec5fa13e
Adds an opt-in HTTPS layer without touching anything for existing installs. The proxy is a service in docker-compose.yml behind the "https" Compose profile, activated with COMPOSE_PROFILES=https in .env. That keeps the whole setup inside files git owns while the switch lives in a file it ignores -- important because scripts/update.sh runs `git pull`, so any user edit to a tracked compose file would break the next update with a merge conflict. mcupdate needs no change: compose reads COMPOSE_PROFILES from .env itself. Both services share the project's default network, so the proxy forwards to http://mc-webui:5000 internally; MC_BIND_ADDRESS lets the plain-HTTP port be restricted to loopback once HTTPS works, and MC_TRUST_PROXY turns on ProxyFix so the app sees the real client address and scheme. Also fixes copying over plain HTTP. navigator.clipboard only exists in a secure context, and 9 call sites across 5 entry points used it with no fallback, so copy buttons silently did nothing on a LAN address. They now share clipboard-utils.js, loaded via _head_i18n.html (the one include every entry point already has), which falls back to execCommand. Verified locally against the real stack: self-signed cert uploaded to NPM, proxy host created, app served over HTTPS with socket.io upgrading to a real wss:// WebSocket (transport "websocket"), and the clipboard fallback checked end-to-end by pasting back what it copied over http://. Two findings from that run are documented in docs/https-setup.md: NPM 2.15 dropped the default admin@example.com account for a setup wizard, and its default 443 server now refuses connections without SNI -- which is every connection made to a bare IP address. docker/npm-default-site.conf is the opt-in way around that, mounted writable (a :ro mount aborts s6 init and leaves nginx not listening at all). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
122 lines
4.8 KiB
Bash
122 lines
4.8 KiB
Bash
# mc-webui Environment Configuration
|
|
# Copy this file to .env and adjust values for your setup
|
|
|
|
# ============================================
|
|
# MeshCore Device Connection
|
|
# ============================================
|
|
# Three transport options: Serial (USB), TCP (network), or BLE (Bluetooth).
|
|
# Priority: BLE > TCP > Serial. Set the relevant variable to activate.
|
|
|
|
# --- Option A: Serial (default) ---
|
|
# Use "auto" for automatic detection (recommended if only one USB device)
|
|
# Or specify manually: /dev/serial/by-id/usb-xxx or /dev/ttyUSB0
|
|
# Find available devices: ls /dev/serial/by-id/
|
|
MC_SERIAL_PORT=auto
|
|
|
|
# --- Option B: TCP (e.g. remote device via ser2net, meshcore-proxy) ---
|
|
# Set the IP/hostname of the device to connect via TCP instead of serial.
|
|
# When MC_TCP_HOST is set, MC_SERIAL_PORT is ignored.
|
|
# MC_TCP_HOST=192.168.1.100
|
|
# MC_TCP_PORT=5555
|
|
|
|
# --- Option C: BLE (Bluetooth Low Energy companion devices) ---
|
|
# Requires: USB BLE dongle on host, BlueZ installed.
|
|
# The device MUST be paired and trusted on the host BEFORE starting mc-webui.
|
|
# See docs/meshcore_bluetooth_pairing.md for detailed setup instructions.
|
|
# When MC_BLE_ADDRESS is set, serial and TCP are ignored.
|
|
# MC_BLE_ADDRESS=AA:BB:CC:DD:EE:FF
|
|
|
|
# Your MeshCore device name (used for .msgs file)
|
|
# Use "auto" for automatic detection from device (recommended)
|
|
# Or specify manually: MarWoj, SP5XYZ, MyNode
|
|
MC_DEVICE_NAME=auto
|
|
|
|
# MeshCore configuration directory (where .msgs and settings files are stored)
|
|
# Default: ./data/meshcore (inside project directory)
|
|
# This directory is mounted as a Docker volume and shared between both containers
|
|
MC_CONFIG_DIR=./data/meshcore
|
|
|
|
# ============================================
|
|
# Application Settings
|
|
# ============================================
|
|
|
|
# Note: Auto-refresh is now intelligent and checks for new messages every 10 seconds
|
|
# No configuration needed - the system automatically updates UI only when new messages arrive
|
|
# Contact cleanup threshold is set directly in the UI (default: 48 hours)
|
|
|
|
# ============================================
|
|
# Archive Configuration
|
|
# ============================================
|
|
|
|
# Directory for storing archived messages
|
|
# Default: ./data/archive (inside project directory)
|
|
# This directory is mounted as a Docker volume for mc-webui container
|
|
MC_ARCHIVE_DIR=./data/archive
|
|
|
|
# Enable automatic daily archiving at midnight
|
|
MC_ARCHIVE_ENABLED=true
|
|
|
|
# Number of days to show in live view (older messages available in archives)
|
|
MC_ARCHIVE_RETENTION_DAYS=7
|
|
|
|
# ============================================
|
|
# Flask Server Configuration
|
|
# ============================================
|
|
|
|
# Listen on all interfaces (0.0.0.0) or specific IP
|
|
FLASK_HOST=0.0.0.0
|
|
|
|
# Port to expose the web interface
|
|
FLASK_PORT=5000
|
|
|
|
# Debug mode (true/false) - use false in production
|
|
FLASK_DEBUG=false
|
|
|
|
# ============================================
|
|
# HTTPS (optional) - see docs/https-setup.md
|
|
# ============================================
|
|
# Off by default: mc-webui serves plain HTTP on FLASK_PORT and nothing else runs.
|
|
#
|
|
# Uncommenting the line below starts Nginx Proxy Manager alongside the app, which
|
|
# terminates HTTPS and forwards to it. You then configure the certificate in its
|
|
# web UI (http://<server>:81) - Let's Encrypt, or your own certificate file.
|
|
# HTTPS also unlocks browser features that require a secure context, such as
|
|
# installing mc-webui as an app on a phone.
|
|
# COMPOSE_PROFILES=https
|
|
|
|
# Ports published by the proxy. Change them if something else already uses 80/443
|
|
# on this host. Note that Let's Encrypt HTTP-01 validation needs the *public*
|
|
# port 80 to reach this container, so it only works with NPM_HTTP_PORT=80.
|
|
# NPM_HTTP_PORT=80
|
|
# NPM_HTTPS_PORT=443
|
|
# NPM_ADMIN_PORT=81
|
|
|
|
# Where the proxy keeps its configuration and issued certificates.
|
|
# Must NOT be a synced folder (Dropbox, Synology Drive) - it holds a SQLite database.
|
|
# NPM_DATA_DIR=./data/npm
|
|
# NPM_LETSENCRYPT_DIR=./data/letsencrypt
|
|
|
|
# Set to false only if your host has working IPv6.
|
|
# NPM_DISABLE_IPV6=true
|
|
|
|
# Pin the proxy image instead of following latest, e.g. jc21/nginx-proxy-manager:2.12.6
|
|
# NPM_IMAGE=jc21/nginx-proxy-manager:latest
|
|
|
|
# Let the app read the real client address and scheme from the proxy's
|
|
# X-Forwarded-* headers. Enable ONLY when reaching the app through the proxy;
|
|
# a client talking to FLASK_PORT directly can forge those headers.
|
|
# MC_TRUST_PROXY=true
|
|
|
|
# Restrict the plain-HTTP port to the machine itself, so the app is reachable
|
|
# only through HTTPS. Set this only AFTER the proxy works - otherwise you lock
|
|
# yourself out. Leave unset (0.0.0.0) to keep HTTP available as before.
|
|
# MC_BIND_ADDRESS=127.0.0.1
|
|
|
|
# ============================================
|
|
# System Configuration
|
|
# ============================================
|
|
|
|
# Timezone for container logs (default: UTC)
|
|
# Examples: Europe/Warsaw, America/New_York, Asia/Tokyo
|
|
TZ=Europe/Warsaw
|