ignace/fasthue
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

removed authorization for browser user

Browse Source
This commit is contained in:
ignace
2026-08-09 17:25:45 +02:00
parent b477737bad
commit 2677c81d0f
4 changed files with 18 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -19
View File
@@ -29,9 +29,8 @@ python3 -m venv .venv
.venv/bin/python app.py
```
On the iPhone, open `http://YOUR-COMPUTER-IP:5000/?key=YOUR_API_KEY` in Safari.
The key is saved only for that browser session and removed from the displayed
URL. The iPhone and computer must be on the same local network.
On the iPhone, open `http://YOUR-COMPUTER-IP:5000/` in Safari. The iPhone and
computer must be on the same local network.
## Configure buttons and scenes
@@ -71,16 +70,14 @@ Credentials are saved with owner-only permissions in
```yaml
bridge: 192.168.1.10
app_key: your-hue-application-key. # the hue bride api key
api_key: your-dashboard-api-key # the key for this services api
app_key: your-hue-application-key
```
The file is ignored by Git and should not be shared. `hue.py register` creates
or updates it, including a random dashboard API key. You can override values
for either tool with environment variables:
or updates it. You can override the bridge values with environment variables:
```sh
FASTHUE_API_KEY=YOUR_DASHBOARD_KEY HUE_BRIDGE=192.168.1.10 HUE_APP_KEY=YOUR_HUE_KEY .venv/bin/python app.py
HUE_BRIDGE=192.168.1.10 HUE_APP_KEY=YOUR_HUE_KEY .venv/bin/python app.py
```
The reverse-proxy path is configured separately in `config.yaml`:
@@ -93,17 +90,16 @@ Set it to an empty value when FastHue is served at `/`.
## HTTP API
Every API request needs the single `api_key` from `secrets.yaml` as a Bearer
token. Override it with `FASTHUE_API_KEY` or `--api-key` when necessary.
The dashboard API does not require a key. Do not expose it to untrusted users:
every client that can reach it can read and control the configured lights.
```sh
export FASTHUE_API_KEY='the-api_key-from-secrets.yaml'
curl -H "Authorization: Bearer $FASTHUE_API_KEY" http://localhost:5000/api/groups
curl -X POST -H "Authorization: Bearer $FASTHUE_API_KEY" \
curl http://localhost:5000/api/groups
curl -X POST \
http://localhost:5000/api/groups/GROUP_UUID/next-scene
curl -X POST -H "Authorization: Bearer $FASTHUE_API_KEY" \
curl -X POST \
http://localhost:5000/api/groups/GROUP_UUID/off
curl -X POST -H "Authorization: Bearer $FASTHUE_API_KEY" \
curl -X POST \
-H 'Content-Type: application/json' \
-d '{"name":"Relax"}' \
'http://localhost:5000/api/groups/Ground%20floor/scene'
@@ -190,7 +186,6 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Prefix /hue;
proxy_set_header Authorization $http_authorization;
}
}
```
@@ -199,9 +194,8 @@ The `www-data` group in the systemd unit and `--umask 007` make the socket
readable by Nginx. If your Nginx workers use another group, replace `www-data`
in the unit with that group. Test and reload Nginx with
`sudo nginx -t && sudo systemctl reload nginx`.
Use the HTTPS URL on the iPhone with `/hue/?key=YOUR_API_KEY` once per browser
session. Set `url_prefix` in `config.yaml` to another leading-slash prefix when
needed, and use the same value in Nginx's `location` and
Use the HTTPS URL on the iPhone with `/hue/`. Set `url_prefix` in `config.yaml`
to another leading-slash prefix when needed, and use the same value in Nginx's `location` and
`X-Forwarded-Prefix`. Keep
`secrets.yaml` readable only by the service account.