quoije/oscars-pool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor READMEs and clarify optional features

Browse Source 
Co-authored-by: mathieumoran1 <[email protected]>
This commit is contained in:
Cursor Agent
2025-12-22 21:27:50 +00:00
co-authored by mathieumoran1
parent eeaf2592ea
commit 9936940c9e
2 changed files with 16 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8 -4
View File
@@ -5,13 +5,13 @@ Little nodejs + mongodb app that I hack together with ChatGPT and Cursor to keep
## Features ## Features
- User accounts: register, login, JWT auth - User accounts: register, login, JWT auth
- Simple registration verification via `DOG_NAMES` - Optional registration "verification" via `DOG_NAMES` (if unset, verification is skipped)
- Mark nominees as watched (per user), with watched date - Mark nominees as watched (per user), with watched date
- Browse movies by Oscar year + API for available years - Browse movies by Oscar year + API for available years
- User stats: watched count/ratio and watched titles - User stats: watched count/ratio and watched titles
- Movie details pulled from OMDb (title/plot/rating/poster) via IMDb ID - Movie details pulled from OMDb (title/plot/rating/poster) via IMDb ID (optional)
- Admin movie management: add, edit (optionally refresh from OMDb), delete - Admin movie management: add, edit (optionally refresh from OMDb), delete
- Built-in player page with multiple source options (VOD link, direct video file, embed) - Built-in player page with multiple source options (VOD link, direct video URL, embed, or server file)
- Resume playback: per-user playback progress saving (time/duration) - Resume playback: per-user playback progress saving (time/duration)
- Global settings: active Oscar year, “completion” modal content for checklist - Global settings: active Oscar year, “completion” modal content for checklist
- Password flows: admin temp password reset + forced change on next login - Password flows: admin temp password reset + forced change on next login
@@ -35,7 +35,7 @@ MONGO_URI=mongodb://127.0.0.1:27017/oscars-pool # MongoDB connection string
JWT_SECRET=replace-with-a-random-string # JWT signing secret (auth) JWT_SECRET=replace-with-a-random-string # JWT signing secret (auth)
# optional # optional
DOG_NAMES=woof,WOOF,Woof # simple registration "verification" DOG_NAMES=woof,WOOF,Woof # registration verification answers (comma-separated)
OMDB_API=your_omdb_key # OMDb API key (movie info) OMDB_API=your_omdb_key # OMDb API key (movie info)
``` ```
@@ -65,6 +65,10 @@ VIDEO_SESSION_MAX_AGE_SECONDS=28800 # video_auth cookie max-age (default: 8h)
MOVIES_CACHE_TTL_MS=30000 # movies route cache TTL (default: 30000ms) MOVIES_CACHE_TTL_MS=30000 # movies route cache TTL (default: 30000ms)
``` ```
Notes:
- The server serves the UI from `public/` (open `http://localhost:5000` by default).
- If you use `video_file` in a movie record, it must be a **relative path** under `VIDEO_FILES_DIR` (the backend blocks traversal/absolute paths).
## Python video server (optional) ## Python video server (optional)
There is also a standalone Python server in `python_video_server/` that mirrors `/api/video/:id` (Range streaming + JWT + Mongo). There is also a standalone Python server in `python_video_server/` that mirrors `/api/video/:id` (Range streaming + JWT + Mongo).
See `python_video_server/README.md` for full instructions. In addition to `MONGO_URI` and `JWT_SECRET`, you may need: See `python_video_server/README.md` for full instructions. In addition to `MONGO_URI` and `JWT_SECRET`, you may need:
python_video_server/README.md
+8 -72
View File
@@ -27,7 +27,7 @@ export CORS_ALLOW_ORIGINS="https://your-app.example.com" # default: "*"
# Cookie behavior for /api/video/session # Cookie behavior for /api/video/session
export VIDEO_COOKIE_SAMESITE="Lax" # Lax|Strict|None (default: Lax) export VIDEO_COOKIE_SAMESITE="Lax" # Lax|Strict|None (default: Lax)
# Mongo TLS / connectivity troubleshooting (Atlas, weird hosts, etc.) # Mongo TLS / connectivity troubleshooting (Atlas, odd hosts, etc.)
export MONGO_TLS_CA_FILE="/path/to/ca.pem" # prefer a valid CA bundle export MONGO_TLS_CA_FILE="/path/to/ca.pem" # prefer a valid CA bundle
export MONGO_TLS_FORCE_TLS12="1" # force TLS 1.2 if TLS 1.3 breaks export MONGO_TLS_FORCE_TLS12="1" # force TLS 1.2 if TLS 1.3 breaks
export MONGO_TLS_INSECURE="1" # NOT recommended; debug only export MONGO_TLS_INSECURE="1" # NOT recommended; debug only
@@ -36,83 +36,19 @@ export MONGO_CONNECT_TIMEOUT_MS="8000"
export MONGO_SOCKET_TIMEOUT_MS="20000" export MONGO_SOCKET_TIMEOUT_MS="20000"
``` ```
## HTTPS (Let’s Encrypt, Python-only) ## HTTPS (optional)
This server can be served over HTTPS by running `uvicorn` with `--ssl-certfile` and `--ssl-keyfile`. You can run behind a reverse proxy/ingress, or run `uvicorn` with TLS directly:
To obtain/renew a trusted cert from Let’s Encrypt **without installing system certbot**, this repo includes a small wrapper that uses the **`certbot` Python package**.
### 1) Issue a certificate (HTTP-01 standalone)
Requirements:
- Your domain’s DNS `A/AAAA` records must point to this machine.
- Port **80** must be reachable from the internet for the ACME challenge.
```bash ```bash
python3 -m pip install -r python_video_server/requirements.txt uvicorn python_video_server.server:app --host 0.0.0.0 --port 443 \
--ssl-certfile /path/to/fullchain.pem \
# Staging by default (recommended first). Add --production when it works. --ssl-keyfile /path/to/privkey.pem
sudo -E python3 -m python_video_server.letsencrypt certonly \
--email [email protected] \
--domains example.com,www.example.com
```
### 1b) Issue a certificate (DNS-01 manual TXT record — no port 80, no root)
If your host already uses port **80** (or you don't have permission to bind it), use DNS-01.
This does **not** require any inbound ports on the machine, but you must be able to edit DNS for the domain.
```bash
python3 -m pip install -r python_video_server/requirements.txt
# Add --production when staging works.
python3 -m python_video_server.letsencrypt certonly \
--challenge dns \
--email [email protected] \
--domains example.com,www.example.com
```
During issuance, certbot will prompt you to create a TXT record like:
- Name: `_acme-challenge.example.com`
- Type: `TXT`
- Value: (a token certbot prints)
After it propagates, press Enter and certbot will continue.
If you run into a situation where the prompt/token only shows up in logs, you can try the hook-based mode:
```bash
python3 -m python_video_server.letsencrypt certonly \
--challenge dns \
--dns-hooks \
--email [email protected] \
--domains example.com,www.example.com
```
Certificates will be written under:
- `python_video_server/certs/config/live/<primary-domain>/fullchain.pem`
- `python_video_server/certs/config/live/<primary-domain>/privkey.pem`
### 2) Run the video server on 443 with TLS
```bash
sudo -E uvicorn python_video_server.server:app --host 0.0.0.0 --port 443 \
--ssl-certfile python_video_server/certs/config/live/example.com/fullchain.pem \
--ssl-keyfile python_video_server/certs/config/live/example.com/privkey.pem
``` ```
Notes: Notes:
- Binding to ports **80/443** usually requires `sudo` (or a reverse proxy / port forwarding). - If you’re behind a proxy, forward `X-Forwarded-Proto: https` so `/api/video/session` can set `Secure` cookies correctly.
- If you’re behind a proxy/ingress, keep sending `X-Forwarded-Proto: https` so `/api/video/session` sets `Secure` cookies correctly. - This repo includes `python_video_server/letsencrypt.py` as an optional helper for cert issuance/renewal (kept intentionally lightweight here).
### 3) Renew certificates
```bash
# Dry-run renewal (safe)
sudo -E python3 -m python_video_server.letsencrypt renew --dry-run
# Actual renew (typically run via cron/systemd timer)
sudo -E python3 -m python_video_server.letsencrypt renew --production
```
## Endpoints ## Endpoints