diff --git a/stacks/f1-stream/files/Dockerfile b/stacks/f1-stream/files/Dockerfile index 7bac86be..80dd20e4 100644 --- a/stacks/f1-stream/files/Dockerfile +++ b/stacks/f1-stream/files/Dockerfile @@ -14,9 +14,26 @@ FROM python:3.13-slim-bookworm WORKDIR /app +# Headless Chromium runtime libs for the playback verifier. Listed inline +# (instead of running `playwright install-deps`) so the image build doesn't +# need root-network apt fetches at runtime. +RUN apt-get update && apt-get install -y --no-install-recommends \ + ca-certificates \ + libnss3 libnspr4 \ + libatk1.0-0 libatk-bridge2.0-0 libcups2 \ + libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 \ + libxfixes3 libxrandr2 libgbm1 libpango-1.0-0 libcairo2 \ + libasound2 libatspi2.0-0 \ + fonts-liberation fonts-noto-color-emoji \ + && rm -rf /var/lib/apt/lists/* + COPY backend/requirements.txt . RUN pip install --no-cache-dir -r requirements.txt +# Install the Chromium browser binary used by the verifier. Skip +# --with-deps because we already installed the system libs above. +RUN playwright install chromium + COPY backend/ ./backend/ # Copy built frontend into the image diff --git a/stacks/f1-stream/files/backend/embed_proxy.py b/stacks/f1-stream/files/backend/embed_proxy.py new file mode 100644 index 00000000..31df2f21 --- /dev/null +++ b/stacks/f1-stream/files/backend/embed_proxy.py @@ -0,0 +1,302 @@ +"""Embed iframe-stripping reverse proxy. + +Serves third-party embed pages (e.g. https://hmembeds.one/embed/{hash}, +https://pooembed.eu/embed/{slug}) through our origin so we can: + +1. Strip X-Frame-Options and Content-Security-Policy: frame-ancestors headers, + so the embed loads in our