74 lines
2.7 KiB
PHP
74 lines
2.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Plugin\AzuraCastOnDemandHls\EventHandler;
|
|
|
|
use App\Event\Nginx\WriteNginxConfiguration;
|
|
use Plugin\AzuraCastOnDemandHls\Config;
|
|
use Plugin\AzuraCastOnDemandHls\Cors\CorsConfigurationProvider;
|
|
use Plugin\AzuraCastOnDemandHls\Cors\NginxRules;
|
|
|
|
final readonly class NginxConfiguration
|
|
{
|
|
public function __construct(
|
|
private Config $config,
|
|
private CorsConfigurationProvider $corsConfiguration,
|
|
)
|
|
{
|
|
}
|
|
|
|
public function __invoke(WriteNginxConfiguration $event): void
|
|
{
|
|
if (!$this->config->enabled) {
|
|
return;
|
|
}
|
|
|
|
$station = $event->getStation();
|
|
$stationId = $station->id;
|
|
$assetDirectory = rtrim($station->getRadioTempDir(), '/')
|
|
. '/' . $this->config->cacheDirectory . '/assets/';
|
|
$transcodeTimeout = $this->config->transcodeTimeout;
|
|
$corsOriginRules = $this->corsOriginRules($station->id);
|
|
|
|
$event->appendBlock(<<<NGINX
|
|
# Protected on-demand HLS. Handle this route directly in PHP-FPM so denied
|
|
# bearer-token requests never leave this access_log-off location.
|
|
location ^~ /api/station/{$stationId}/ondemand-hls/playback/ {
|
|
access_log off;
|
|
|
|
include fastcgi_params;
|
|
fastcgi_read_timeout {$transcodeTimeout};
|
|
fastcgi_index index.php;
|
|
fastcgi_param SCRIPT_FILENAME \$realpath_root/index.php;
|
|
fastcgi_param SCRIPT_NAME /index.php;
|
|
fastcgi_param PHP_SELF /index.php;
|
|
fastcgi_param DOCUMENT_ROOT \$realpath_root;
|
|
fastcgi_pass php-fpm-www;
|
|
}
|
|
|
|
# Successful authorization redirects internally here. Keeping access logs
|
|
# disabled in the final X-Accel location prevents the original bearer URL
|
|
# from being logged after Nginx performs the internal redirect.
|
|
location ^~ /internal/ondemand-hls/{$stationId}/ {
|
|
internal;
|
|
access_log off;
|
|
# The allowlist is emitted as exact Origin matches. Nginx omits an
|
|
# add_header with an empty value, so missing/disallowed Origins do not
|
|
# receive Access-Control-Allow-Origin. This applies after X-Accel.
|
|
{$corsOriginRules}
|
|
add_header Access-Control-Allow-Origin \$ondemand_hls_cors_origin always;
|
|
add_header Vary \$ondemand_hls_cors_vary always;
|
|
add_header Cache-Control "private, no-store, max-age=0" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
alias {$assetDirectory};
|
|
}
|
|
NGINX);
|
|
}
|
|
|
|
private function corsOriginRules(int $stationId): string
|
|
{
|
|
return NginxRules::forOrigins($this->corsConfiguration->getAllowedOrigins($stationId));
|
|
}
|
|
}
|