mirror of
https://github.com/MeshCore-Beacon/beacon-docs.git
synced 2026-10-24 04:32:20 +00:00
MrAlders0n
f2728b059b
* docs: move design and API contract into docs/ * docs: add releases and versioning page * docs: add configuration reference for server and web * docs: add reverse proxy page * docs: add upgrading page * docs: add operations page and move backup and profiling docs * docs: add getting packets in and security pages * docs: add troubleshooting page * docs(api): fold admin, activity, route and summary notes into the contract * docs(deploy): add type 2 split deployment, finish the beacon rename, ignore secrets * docs: rewrite README as the front door and share the contributor workflow * docs: remove em dashes from prose and config comments * docs: apply review fixes to type 2, upgrading, troubleshooting and first-run notes * docs: fix upgrade order, restore steps, type 2 setup and contract details from review * docs: keep the gitignore to deployment secrets and runtime state
47 lines
2.0 KiB
Plaintext
47 lines
2.0 KiB
Plaintext
# Beacon behind a host Apache (the analyzer.meshmapper.net shape). Drop these lines into the
|
|
# *:443 VirtualHost next to the existing ProxyPass rules. Needs mod_headers, mod_proxy,
|
|
# mod_proxy_http, mod_proxy_wstunnel, mod_authz_core (all already loaded on that box).
|
|
|
|
# dedicated log so fail2ban and the runbook can parse it (other_vhosts uses vhost_combined)
|
|
ErrorLog ${APACHE_LOG_DIR}/analyzer-ssl-error.log
|
|
CustomLog ${APACHE_LOG_DIR}/analyzer-ssl-access.log combined
|
|
|
|
# client-IP hygiene: beacon-server reads the client IP only from X-Real-IP, and only from
|
|
# server.trusted_proxies (the compose subnet: Apache reaches the published port via its
|
|
# gateway), so Apache overwrites it.
|
|
# mod_proxy re-adds a clean X-Forwarded-For after the unset; the app ignores it.
|
|
RequestHeader unset X-Forwarded-For early
|
|
RequestHeader unset X-Real-IP early
|
|
RequestHeader unset True-Client-IP early
|
|
RequestHeader set X-Real-IP "%{REMOTE_ADDR}s"
|
|
|
|
# scraper User-Agent signatures live in /etc/apache2/beacon-blocklist-ua.conf; a match sets
|
|
# beacon_block, which the /api and /ws blocks below reject
|
|
Include /etc/apache2/beacon-blocklist-ua.conf
|
|
|
|
# manual block list for /api and /ws: edit /etc/apache2/beacon-blocklist.conf, then
|
|
# `apachectl configtest && systemctl reload apache2`
|
|
<Location "/api">
|
|
<RequireAll>
|
|
Require all granted
|
|
Require not env beacon_block
|
|
Include /etc/apache2/beacon-blocklist.conf
|
|
</RequireAll>
|
|
</Location>
|
|
<Location "/ws">
|
|
<RequireAll>
|
|
Require all granted
|
|
Require not env beacon_block
|
|
Include /etc/apache2/beacon-blocklist.conf
|
|
</RequireAll>
|
|
</Location>
|
|
|
|
# /etc/apache2/beacon-blocklist.conf: one `Require not ip <ip-or-cidr>` per line.
|
|
# Keep the TEST-NET placeholder so the file is never empty:
|
|
#
|
|
# Require not ip 192.0.2.0/24
|
|
#
|
|
# /etc/apache2/beacon-blocklist-ua.conf: one SetEnvIfNoCase per scraper User-Agent signature:
|
|
#
|
|
# SetEnvIfNoCase User-Agent "some-scraper" beacon_block
|