Hosts
| Host | Backend | Login |
|---|---|---|
opmo.loca.zone | Backlot on loopback 4750 via opmo.service | required on every route |
wiki.opmo.loca.zone | static Quartz output from the vault’s current/ directory | required on content routes |
remotion.opmo.loca.zone | Remotion Studio on loopback 52181 via opmo-remotion-studio.service | required on every route |
hyperframes.opmo.loca.zone | HyperFrames Studio on loopback 52182 via opmo-hyperframes-studio.service | required on every route |
The original two names retain their opmo.loca.zone certificate. The Studio names use a separate opmo-studios.loca.zone certificate covering both Studio hosts and a separate nginx site; the original nginx site and certificate lineage were not edited. Plain HTTP redirects to HTTPS. Paths and renewal state: private page (sign-in required).
The boundary
nginx runs an auth_request subrequest to the existing Authelia instance for all application routes:
- Backlot library/board HTML, JSON APIs, SSE streams, media, thumbnails and UI assets
- Remotion and HyperFrames Studio pages, assets and long-lived live-update streams
- wiki pages and assets
Policy for all four domains is one_factor. The internal authorization endpoint and ACME challenge locations are infrastructure exceptions, not project-content routes. Fresh unauthenticated HTTPS probes return 302 to the login portal; this proves the gates and valid TLS, not authenticated application playback.
Identity headers (Remote-User, Remote-Groups, Remote-Name, Remote-Email) are forwarded upstream by the shared snippet; Backlot ignores them. No accounts were created for this project — existing loca.zone identities apply.
Proxy behaviour
| Routes | Configuration | Why |
|---|---|---|
/api/library/events, /api/project/<id>/events | proxy_buffering off, proxy_cache off, one-hour read timeout, empty Connection header | Backlot’s 15-second heartbeats and change events reach the browser immediately |
/media/*, /thumb/* | unbuffered, temp-file buffering disabled; Range and HEAD pass through to Backlot’s FileResponse | <video> seeking works |
/, /p/*, /ui/* | Backlot’s own Cache-Control: no-cache | UI fixes appear on a plain refresh |
What authentication does not do
- Auth is checked per request. An already-established stream or download is not terminated when a session expires or is revoked — only the next request is denied. A logged-out client cannot reconnect to an event stream or reopen media.
- Content already downloaded to a browser is not revoked.
- Backlot is read-only: a session grants viewing only; nothing in that UI mutates the project directory. The two Studio editors are deliberately writable and can modify the checkout/project each serves.
Verifying the boundary
curl -sI https://opmo.loca.zone/api/projects # expect 302 to the auth portal
curl -sI https://opmo.loca.zone/media/demos/renders/world-in-numbers.mp4 # expect 302
curl -sI https://wiki.opmo.loca.zone/ # expect 302
curl -sI https://remotion.opmo.loca.zone/HeroTitle # expect 302
curl -sI 'https://hyperframes.opmo.loca.zone/#project/studio-hyperframes-demo' # expect 302A 302 proves only that the gate sits in front of the route — never that the content behind it exists or renders. Run these in a shell, not a Python cell; see private page (sign-in required) for the header-reading recipe and the recorded acceptance gaps (no authenticated session was available to this worker, so authenticated browser success and expired-session behaviour remain unproved). Do not expose a bypass route to test it.