feat: self-host Hobbs Family Organizer (Shield TV dashboard) on hf-pdocker-02:8340

- tv app/Hobbs-Family-Organizer-Self-Hosted-v1.0.0: release bundle (Next.js app + Shield APK v1.4 + source) - compose/hf-pdocker-02/hobbs-organizer: override (local-disk secrets, watchtower off), .env (port 8340), Shield provisioning script - CLAUDE.md: service tree + internal ports Trusted-LAN mode. Secrets live only on .100 /var/lib/hobbs-organizer/secrets (not in git). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3
2026-11-04 18:27:22 -06:00
parent 122ea392d1
commit e9c7e9df1a
68 changed files with 12831 additions and 0 deletions
@@ -0,0 +1,35 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+
+function tokenMatches(actual: string, expected: string) {
+  const actualValue = createHash("sha256").update(actual).digest();
+  const expectedValue = createHash("sha256").update(expected).digest();
+  return timingSafeEqual(actualValue, expectedValue);
+}
+
+export function proxy(request: NextRequest) {
+  if (request.nextUrl.pathname === "/api/health") return NextResponse.next();
+
+  const configuredToken = process.env.ORGANIZER_ACCESS_TOKEN?.trim();
+  if (!configuredToken) return NextResponse.next();
+
+  const authorization = request.headers.get("authorization") || "";
+  const suppliedToken = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
+  if (tokenMatches(suppliedToken, configuredToken)) return NextResponse.next();
+
+  return NextResponse.json(
+    { error: "Unauthorized" },
+    {
+      status: 401,
+      headers: {
+        "Cache-Control": "no-store",
+        "WWW-Authenticate": "Bearer realm=\"Hobbs Family Organizer\"",
+      },
+    },
+  );
+}
+
+export const config = {
+  matcher: ["/((?!api/health).*)"],
+};