Initial commit - Phase 3/4

🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-06 13:45:29 -08:00
parent 1da6730735
commit 4f35df1781
323 changed files with 98287 additions and 1195 deletions
--- a/nginx/dangerous-pi-https.conf
+++ b/nginx/dangerous-pi-https.conf
@@ -0,0 +1,161 @@
+# Dangerous Pi - Nginx reverse proxy configuration with HTTPS
+# Serves frontend on / and proxies /api/*, /ws/* to backend
+# SSL termination at nginx, backend remains HTTP
+
+upstream frontend {
+    server 127.0.0.1:3000;
+}
+
+upstream backend {
+    server 127.0.0.1:8000;
+}
+
+# HTTP server - captive portal detection + redirect to HTTPS
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name dangerous-pi.local _;
+
+    # ===========================================
+    # CAPTIVE PORTAL DETECTION (must stay on HTTP)
+    # ===========================================
+    # OS connectivity checks don't follow HTTPS redirects.
+    # These endpoints must respond on HTTP for captive portal to work.
+
+    # Android / Chrome OS connectivity check
+    location = /generate_204 {
+        return 204;
+    }
+
+    # Additional Android check paths
+    location = /gen_204 {
+        return 204;
+    }
+
+    # Google connectivity check
+    location = /connectivitycheck/gstatic/generate_204 {
+        return 204;
+    }
+
+    # iOS / macOS captive portal detection
+    location = /hotspot-detect.html {
+        return 200 '<HTML><HEAD><TITLE>Success</TITLE></HEAD><BODY>Success</BODY></HTML>';
+        add_header Content-Type text/html;
+    }
+
+    # iOS alternate path
+    location = /library/test/success.html {
+        return 200 '<HTML><HEAD><TITLE>Success</TITLE></HEAD><BODY>Success</BODY></HTML>';
+        add_header Content-Type text/html;
+    }
+
+    # Windows 10/11 connectivity check
+    location = /connecttest.txt {
+        return 200 'Microsoft Connect Test';
+        add_header Content-Type text/plain;
+    }
+
+    # Windows NCSI check
+    location = /ncsi.txt {
+        return 200 'Microsoft NCSI';
+        add_header Content-Type text/plain;
+    }
+
+    # Firefox / Mozilla connectivity check
+    location = /success.txt {
+        return 200 'success';
+        add_header Content-Type text/plain;
+    }
+
+    # Kindle / Amazon devices
+    location = /kindle-wifi/wifistub.html {
+        return 200 '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html><head><title>Kindle</title></head><body>81ce4465-7167-4dcb-835b-dcc9e44c112a</body></html>';
+        add_header Content-Type text/html;
+    }
+
+    # ===========================================
+    # END CAPTIVE PORTAL DETECTION
+    # ===========================================
+
+    # Redirect all other HTTP traffic to the main HTTPS page
+    # IMPORTANT: For captive portals, we must redirect to OUR domain (not $host)
+    # because the browser may be requesting a random domain like detectportal.firefox.com
+    # and our SSL cert only covers dangerous-pi.local and 192.168.4.1
+    location / {
+        return 302 https://192.168.4.1/;
+    }
+}
+
+# HTTPS server - main application
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    http2 on;
+    server_name dangerous-pi.local _;
+
+    # SSL certificate configuration
+    ssl_certificate /opt/dangerous-pi/ssl/dangerous-pi.crt;
+    ssl_certificate_key /opt/dangerous-pi/ssl/dangerous-pi.key;
+
+    # SSL security settings (modern configuration)
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+    # Proxy API requests to FastAPI backend
+    location /api/ {
+        proxy_pass http://backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_connect_timeout 75s;
+    }
+
+    # Proxy WebSocket connections to backend
+    # nginx handles SSL termination, so wss:// becomes ws:// to backend
+    location /ws/ {
+        proxy_pass http://backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+
+    # Everything else goes to Remix frontend
+    location / {
+        proxy_pass http://frontend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    # HSTS: Tell browsers to always use HTTPS (1 year)
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css text/xml application/json application/javascript application/xml;
+}
--- a/nginx/dangerous-pi.conf
+++ b/nginx/dangerous-pi.conf
@@ -0,0 +1,129 @@
+# Dangerous Pi - Nginx reverse proxy configuration
+# Serves frontend on / and proxies /api/*, /ws/* to backend
+
+upstream frontend {
+    server 127.0.0.1:3000;
+}
+
+upstream backend {
+    server 127.0.0.1:8000;
+}
+
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name dangerous-pi.local _;
+
+    # ===========================================
+    # CAPTIVE PORTAL DETECTION
+    # ===========================================
+    # These endpoints respond to OS connectivity checks.
+    # When a device connects to the AP, the OS checks these URLs.
+    # By responding correctly, we trigger the captive portal popup.
+
+    # Android / Chrome OS connectivity check
+    location = /generate_204 {
+        return 204;
+    }
+
+    # Additional Android check paths
+    location = /gen_204 {
+        return 204;
+    }
+
+    # Google connectivity check
+    location = /connectivitycheck/gstatic/generate_204 {
+        return 204;
+    }
+
+    # iOS / macOS captive portal detection
+    location = /hotspot-detect.html {
+        return 200 '<HTML><HEAD><TITLE>Success</TITLE></HEAD><BODY>Success</BODY></HTML>';
+        add_header Content-Type text/html;
+    }
+
+    # iOS alternate path
+    location = /library/test/success.html {
+        return 200 '<HTML><HEAD><TITLE>Success</TITLE></HEAD><BODY>Success</BODY></HTML>';
+        add_header Content-Type text/html;
+    }
+
+    # Windows 10/11 connectivity check
+    location = /connecttest.txt {
+        return 200 'Microsoft Connect Test';
+        add_header Content-Type text/plain;
+    }
+
+    # Windows NCSI check
+    location = /ncsi.txt {
+        return 200 'Microsoft NCSI';
+        add_header Content-Type text/plain;
+    }
+
+    # Firefox / Mozilla connectivity check
+    location = /success.txt {
+        return 200 'success';
+        add_header Content-Type text/plain;
+    }
+
+    # Kindle / Amazon devices
+    location = /kindle-wifi/wifistub.html {
+        return 200 '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html><head><title>Kindle</title></head><body>81ce4465-7167-4dcb-835b-dcc9e44c112a</body></html>';
+        add_header Content-Type text/html;
+    }
+
+    # ===========================================
+    # END CAPTIVE PORTAL DETECTION
+    # ===========================================
+
+    # Proxy API requests to FastAPI backend
+    location /api/ {
+        proxy_pass http://backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_connect_timeout 75s;
+    }
+
+    # Proxy WebSocket connections to backend
+    location /ws/ {
+        proxy_pass http://backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+
+    # Everything else goes to Remix frontend
+    location / {
+        proxy_pass http://frontend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css text/xml application/json application/javascript application/xml;
+}