jp
857284abbf
- mailcmd replacement (vm_mailcmd.py): faster-whisper transcription (CPU int8), extractive summary + intent tags + spoken-digit number extraction, multipart/alternative HTML email, fail-safe relay of original message - Telegram DM delivery (vm_telegram.py) with per-mailbox routing - Caller-ID -> name (vm_contacts.py): file / google / carddav backends - SQLite store (vm_store.py) with content-addressed audio - FastAPI portal (vm_web.py): PIN login, list/play/delete, per-user settings, zero JS, loopback-only behind Apache TLS - Backfill importer (vm_import.py) for existing spool recordings - systemd unit, Apache vhost + certbot TLS, install.sh - Docs: INSTALL, CONFIGURATION, ARCHITECTURE, OPERATIONS, SECURITY, TESTING Verified end-to-end on mail.txt3.net: 157 historical messages backfilled, live voicemail -> transcribed -> stored -> visible at https://vm.txt3.net.
55 lines
2.2 KiB
Plaintext
55 lines
2.2 KiB
Plaintext
<VirtualHost 51.68.212.39:80 [2001:41d0:801:2000::2245]:80>
|
|
ServerName vm.txt3.net
|
|
ErrorLog /var/log/virtualmin/vm.txt3.net_error_log
|
|
CustomLog /var/log/virtualmin/vm.txt3.net_access_log combined
|
|
|
|
# Let certbot answer HTTP-01 challenges from the webroot
|
|
Alias /.well-known/acme-challenge/ /home/txt3/domains/vm.txt3.net/public_html/.well-known/acme-challenge/
|
|
<Directory /home/txt3/domains/vm.txt3.net/public_html/.well-known/acme-challenge>
|
|
Require all granted
|
|
Options -Indexes
|
|
</Directory>
|
|
ProxyPass /.well-known !
|
|
|
|
# Everything else goes to HTTPS
|
|
RewriteEngine on
|
|
RewriteCond %{HTTPS} !=on
|
|
RewriteRule ^/(?!\.well-known)(.*)$ https://vm.txt3.net/$1 [R=301,L]
|
|
</VirtualHost>
|
|
|
|
<VirtualHost 51.68.212.39:443 [2001:41d0:801:2000::2245]:443>
|
|
ServerName vm.txt3.net
|
|
ErrorLog /var/log/virtualmin/vm.txt3.net_error_log
|
|
CustomLog /var/log/virtualmin/vm.txt3.net_access_log combined
|
|
|
|
SSLEngine on
|
|
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
|
|
# Replaced by certbot with the vm.txt3.net cert once issued.
|
|
SSLCertificateFile /etc/letsencrypt/live/vm.txt3.net/fullchain.pem
|
|
SSLCertificateKeyFile /etc/letsencrypt/live/vm.txt3.net/privkey.pem
|
|
|
|
# --- security headers -------------------------------------------------
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set X-Frame-Options "DENY"
|
|
Header always set Referrer-Policy "strict-origin-when-cross-origin"
|
|
Header always set Strict-Transport-Security "max-age=15768000"
|
|
# The app uses only inline <style>, no external or inline JS.
|
|
Header always set Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; media-src 'self'; img-src 'self' data:; script-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
|
|
|
|
# --- reverse proxy to the voicemail portal ----------------------------
|
|
ProxyPreserveHost On
|
|
ProxyRequests Off
|
|
# Recordings can be a few MB; give uploads/streams room.
|
|
ProxyTimeout 120
|
|
|
|
ProxyPass /.well-known !
|
|
ProxyPass / http://127.0.0.1:8099/ retry=0
|
|
ProxyPassReverse / http://127.0.0.1:8099/
|
|
|
|
RequestHeader set X-Forwarded-Proto "https"
|
|
|
|
<Location />
|
|
Require all granted
|
|
</Location>
|
|
</VirtualHost>
|