feat: add secure on-demand HLS playback plugin

2026-09-04 20:23:10 +02:00
commit 6fae6a3a43
35 changed files with 2283 additions and 0 deletions
@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Plugin\AzuraCastOnDemandHls\EventHandler;
+
+use App\Event\Nginx\WriteNginxConfiguration;
+use Plugin\AzuraCastOnDemandHls\Config;
+
+final readonly class NginxConfiguration
+{
+    public function __construct(private Config $config)
+    {
+    }
+
+    public function __invoke(WriteNginxConfiguration $event): void
+    {
+        if (!$this->config->enabled) {
+            return;
+        }
+
+        $station = $event->getStation();
+        $stationId = $station->id;
+        $assetDirectory = rtrim($station->getRadioTempDir(), '/')
+            . '/' . $this->config->cacheDirectory . '/assets/';
+        $transcodeTimeout = $this->config->transcodeTimeout;
+
+        $event->appendBlock(<<<NGINX
+        # Protected on-demand HLS. Handle this route directly in PHP-FPM so denied
+        # bearer-token requests never leave this access_log-off location.
+        location ^~ /api/station/{$stationId}/ondemand-hls/playback/ {
+            access_log off;
+
+            include fastcgi_params;
+            fastcgi_read_timeout {$transcodeTimeout};
+            fastcgi_index index.php;
+            fastcgi_param SCRIPT_FILENAME \$realpath_root/index.php;
+            fastcgi_param SCRIPT_NAME /index.php;
+            fastcgi_param PHP_SELF /index.php;
+            fastcgi_param DOCUMENT_ROOT \$realpath_root;
+            fastcgi_pass php-fpm-www;
+        }
+
+        # Successful authorization redirects internally here. Keeping access logs
+        # disabled in the final X-Accel location prevents the original bearer URL
+        # from being logged after Nginx performs the internal redirect.
+        location ^~ /internal/ondemand-hls/{$stationId}/ {
+            internal;
+            access_log off;
+            add_header Cache-Control "private, no-store, max-age=0" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            alias {$assetDirectory};
+        }
+        NGINX);
+    }
+}