rays/ipx
1
0
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases 20 Wiki Activity

iOS: the player goes to ipxapi.sdf1.net with one API token; unread badge (#419, #421)

Browse Source 
The Access service token plus API token pair was three values to enter
and Access in front of both. The player, the badge and CarPlay now send
the ipx API token alone to https://ipxapi.sdf1.net: a route of the
rays-unraid tunnel to the same ipx-web, with no Access application, held
to the paths the app uses by a custom firewall rule on the sdf1.net zone
(403 for anything without a bearer header or off the list: the page, the
login form, /api/login, ?token= sign-in, the admin API). docs/sso.md
says so, since it also says not to bypass Access for /api/*; this is
that warning's narrow version, and the rule is on Cloudflare, not here.

The unread badge (#421) shows All Subscriptions' count, as the page's
badge does: set when the app comes forward, after an item is read, and
by a background refresh iOS runs now and then. The test target had no
Info.plist and could never have run; it does now.

Build 4. Not yet run on a phone with the token set.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Ray Slakinski
2026-11-08 14:11:03 -05:00
parent 7d4456bb2f
commit 3626a30b52
14 changed files with 234 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/sso.md
View File

@@ -261,5 +261,19 @@ the `ipodderx` application, and send `CF-Access-Client-Id` and `CF-Access-Client
API token as who is asking. Do not bypass Access for `/api/*` instead; the token would then be the
only thing between the internet and the API.
### `ipxapi.sdf1.net`, for the iOS app (#419)
The app's player cannot send an Access service token's pair of headers as well as sign in, and its
cookie from Access ends mid-drive, so it has an address of its own: `ipxapi.sdf1.net`, a route of
the `rays-unraid` tunnel to the same `192.168.1.130:8099` as `ipodderx.sdf1.net`, with a proxied
CNAME to the tunnel and **no Access application**. That is the exposure the paragraph above warns
against, held narrow another way: a custom firewall rule on the `sdf1.net` zone (Security, WAF)
blocks every request to that host unless it carries `Authorization: Bearer` and is for
`/api/feeds`, `/api/me`, `/api/art`, `/api/entries/*` or `/media/*`. So the page, the sign-in form,
`/api/login`, `?token=` sign-in and the admin API answer 403 there, and ipx still checks the
token on what is let through. A new path the app needs is added to that rule's expression. The
rule is on Cloudflare, not in this repository; if the hostname is ever served without it, the
whole of ipx is on the internet behind bearer tokens alone.
See also [users.md](users.md) for what several people share, [configuration.md](configuration.md)
for every `[web]` key, and [cli.md](cli.md) for the `ipx user` commands.