goodtiding5

Secured HLS setup with Nginx as media server

This example is part of this article.

This is an example for an HLS delivery with basic security. Nginx compiled with nginx-rtmp-module & secure-link is used as media server. Features:

• Domain filtering
• Referrer filtering
• Embed buster

goodtiding5

Development Software

• VirtualBox - Virtualization software for running local operating systems within your computer. This allows us have a full version of linux within our computers that better match how a live webserver works.
• Vagrant - A tool for provisioning (creating) virtual machines.
• VVV - A pre-built, community-supported Vagrant configuration for WordPress development.
• Git - Version control system for managing code during development. Easily allows for tracking changes, and merging new code into an existing project.
• SourceTree - A GUI available on Windows and Mac for managing Git projects. This makes Git much easier to use, as we won't have to learn the command line interface.
• Github.com - A website that provides free Git repositories for both open source and private projects.
• SASS - (SCSS) A CSS preprocessing implementation that allows us to write much less CSS for a project. This basically makes CSS into a simple programming language.

goodtiding5

Modifying an Existing Docker Image

To install a custom package or modify an existing docker image we need to

1. run a docker a container from the image we wish to modify
2. modify the docker container
3. commit the changes to the container as a docker image
4. test changes made to image

1.) Running a docker container from an image

goodtiding5

--- a/setup.py    2014-03-17 03:31:31.000000000 +0100
+++ b/setup.py    2014-03-17 19:06:03.000000000 +0100
@@ -750,10 +750,8 @@
         exts.append( Extension('_socket', ['socketmodule.c'],
                                depends = ['socketmodule.h']) )
         # Detect SSL support for the socket module (via _ssl)
-        search_for_ssl_incs_in = [
-                              '/usr/local/ssl/include',
-                              '/usr/contrib/ssl/include/'
-                             ]

goodtiding5

Local mac:

npm install --production

sudo echo node_modules > .gitignore
git init
git add --all
git commit -m 'Initial commit'

goodtiding5

#!/usr/bin/env python

import sys
import gmpy

import curve25519

from struct import pack
from hashlib import sha256
from binascii import hexlify, unhexlify

goodtiding5

Configuring nginx for SSL SNI vhosts

Gotchas

• Note that SHA2 hash algorithm may be not supported on older systems (Windows XP, Windows 2003, among others).
• Be aware that mandatory https on SNI vhosts eliminate [Internet Explorer on Windows XP, among others] (http://en.wikipedia.org/wiki/Server_Name_Indication#Web_browsers.5B6.5D).

Remarks

• My version of konklones SSL config does not have SPDY support(my nginx+openssl does not support it)
• You need a default ssl server (example.org-default.conf).
• Some SSL-options have to be unique across your instance, so it's easier to have them in a common file(ssl.conf).

goodtiding5

Contact [email protected] for more info.

goodtiding5

# based on
# https://dev.openwrt.org/browser/trunk/target/linux/atheros/base-files/etc/hotplug.d/button/00-button
# https://forum.openwrt.org/viewtopic.php?pid=172110#p172110

. /lib/functions.sh

export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

do_button () {
	local button