feat: complete device onboarding and mobile binding workflows

2026-09-12 08:57:29 +08:00
parent 7846f30d0b
commit 98fb2965d0
116 changed files with 15669 additions and 64 deletions
@@ -1,7 +1,21 @@
 server {
    listen 80;
    server_name _;
-    return 301 https://121.41.46.238$request_uri;
+    # First-boot clock bootstrap only. The response is authenticated by TIME1.
+    location = /api/v1/device/time-challenges {
+        limit_except POST { deny all; }
+        client_max_body_size 8k;
+        resolver 127.0.0.11 ipv6=off valid=10s;
+        set $clock_backend http://api:8080;
+        proxy_pass $clock_backend;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Proto http;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_buffering off;
+    }
+    location / {
+        return 301 https://121.41.46.238$request_uri;
+    }
 }

 server {