Need external HTTPS proxy docs

[dpw13]

I briefly looked at implementing TLS in the uvloop/llhttp server and it appears non-trivial to say the least. Adding a simple nginx reverse proxy in front (or any other comparable service) seems quite a lot easier. However, I found that the go2rtc endpoints also need to be separately proxied. Some endpoints worked as-is, but /go2rtc/api/ws in particular did not as it uses websockets. In getGo2rtcBaseUrl() there is a reference to the go2rtc base URL changing if there is a reverse proxy in front of the system, and I was able to infer the proper configuration for nginx. I'll add the nginx configuration I used to get live views working once my VPN comes back online (temporary outage).

It would be nice to have some clear documentation on what endpoints need to be forwarded if a reverse proxy is set up in front of lightNVR. So far I have / to http://127.0.0.1:8080 and /go2rtc to http://127.0.0.1:1984/go2rtc, but I don't know whether any other endpoints are expected.

[dpw13]

Here's the nginx config I used:

server {
        server_name nvr.internal;

        # SSL configuration
        #
        listen 443 ssl default_server;
        listen [::]:443 ssl default_server;
        ssl_certificate /etc/ssl/private/nvr.crt;
        ssl_certificate_key /etc/ssl/private/nvr.key;

        ssl_protocols TLSv1.2 TLSv1.3;

        location / {
                proxy_pass http://127.0.0.1:8080;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
        }

        location /go2rtc {
                proxy_pass http://127.0.0.1:1984/go2rtc;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
        }
}

Note that websocket support (Upgrade and Connection headers) was necessary to get some of the live views working, though that may only be necessary on the go2rtc endpoints.