No description
- Rust 81.5%
- Nix 11.5%
- HTML 7%
Andreas Rammhold
080f62277d
Running a deck on a phone means reaching it from the phone, which in practice means a name, TLS and something asking who you are — the deck presses real buttons on a live show. The module does that part: instances are named (services.web-deck.instances.<name>), each with its own Companion, port and htpasswd file, and nginx publishes them. Instances rather than a singleton because one machine may front several Companion instances — a stage rig and a booth rig, or one deck per person. They can share a virtual host under different path prefixes, so a single domain and certificate covers all of them while each keeps separate credentials. nginx strips the prefix and the page looks for its WebSocket relative to wherever it was loaded, so the deck never needs to know where it is mounted. Publishing without a basicAuthFile is refused by an assertion rather than left to the operator to remember. TLS stays in the host's own virtual host config, which merges with ours — worth adding, since browsers only grant the screen wake lock on a secure origin. The VM test runs two decks on one virtual host and checks what would actually break in production: per-path credentials (each rejects the other's), the redirect for a missing trailing slash, a real WebSocket client registering a surface through the proxy, unauthenticated sockets refused, and each deck talking to its own Companion. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FmVqDpdemjeXPfTYKxfz5i |
||
|---|---|---|
| crates | ||
| docs | ||
| etc/udev/rules.d | ||
| nix | ||
| .envrc | ||
| .gitignore | ||
| Cargo.lock | ||
| Cargo.toml | ||
| CLAUDE.md | ||
| flake.lock | ||
| flake.nix | ||
| LICENSE | ||
| TODO.md | ||
| treefmt.nix | ||