9386dfc580
Three intertwined bodies of work developed and tested together this session. Full test suite green: python (edge) + phpunit (cloud). ## Edge/Pi install path - setup_online.sh: apt-lock retry (apt-daily contention), Type=exec unit + StartLimitIntervalSec in [Unit], journalctl-on-failure, crash-loop detection. - onnxruntime is now best-effort (no sdist / no 32-bit-ARM wheel); [6/8] probes the real backend and hard-fails if none works. - Hailo HEF auto-fetch: edge/tools/fetch_hailo_hef.py (pinned sha256, refuses to guess 8 vs 8L, HAILO_ARCH override for serial-less boards); hailo_pose.py run() timeout fix. - install_offline.sh: mirrors the backend gate; onnxruntime optional. ## Cafe24 cloud package (cloud/deploy/) - build_cafe24_package.sh emits move_detect_app/ (private, one folder) + www/move_detect/ (docroot subdir); no-dev classmap autoloader; preflight.php; hardened .htaccess. - Subdirectory mount support: Request::baseFrom/pathFor strip the mount prefix; index.php walks up to find the app root; views/JS prefix every URL with APP_BASE; session cookie scoped to the mount. ## Delivery audit — silent-failure & correctness (docs/delivery-audit.md) All 4 blockers + all Phase-1 silent-failure + Phase-2 HIGH correctness: - Edge cloud clients send a custom User-Agent (cafe24 WAF blocks python-requests) and allow_redirects=False. - Daemon fails loud on blank CAFE24_URL/DEVICE_SECRET; run_loop logs swallowed exceptions; heartbeat carries real fps + per-camera health; UvcSource reopens a dead camera; offline queue is size-capped and drops poison rows; TARGET_FPS/QUEUE_DB validated. - Zone coordinates normalized 0..1 on both sides (were canvas-px vs camera-px — every zone misplaced); pinch zones emit PINCH/HIGH (were downgraded to WARNING). - Fall detection uses bbox cues when keypoints are low-confidence (occluded fallen person); ghost incident not cancelled by a bystander; displacement normalized per-second (FPS-invariant). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW
64 lines
2.7 KiB
Text
64 lines
2.7 KiB
Text
# move-detect cloud — belongs in the DocumentRoot (Cafe24: /home/hosting_users/<ID>/www/).
|
|
# Built into the upload package as www/.htaccess by build_cafe24_package.sh.
|
|
#
|
|
# mod_rewrite is confirmed on Cafe24 web hosting. mod_headers and mod_authz_core are not,
|
|
# so every dependent block is wrapped in <IfModule> and degrades instead of 500-ing.
|
|
|
|
<IfModule mod_rewrite.c>
|
|
RewriteEngine On
|
|
|
|
# 1) Force HTTPS. This is REQUIRED, not hardening: src/Auth/Session.php hard-codes
|
|
# 'cookie_secure' => true, so over plain HTTP the browser never sends the session
|
|
# cookie back — login appears to succeed, then silently loses the session on the very
|
|
# next request. All three conditions must hold before redirecting, so a TLS-terminating
|
|
# proxy that sets any one of them cannot trigger a redirect loop.
|
|
# R=302 on purpose. Promote to R=301 only after verifying in a real browser: a wrong
|
|
# 301 is cached by clients and is very hard to walk back.
|
|
RewriteCond %{HTTPS} !=on
|
|
RewriteCond %{SERVER_PORT} !^443$
|
|
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
|
|
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L]
|
|
|
|
# 2) Front controller — every non-file, non-directory path goes to index.php.
|
|
RewriteCond %{REQUEST_FILENAME} !-f
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteRule ^ index.php [QSA,L]
|
|
</IfModule>
|
|
|
|
<IfModule mod_headers.c>
|
|
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set X-Frame-Options "DENY"
|
|
Header always set Referrer-Policy "no-referrer"
|
|
</IfModule>
|
|
|
|
# 3) No directory listings. Backstop against an unauthenticated listing of
|
|
# storage/snapshots/ (JPEGs of people at work) if it is ever misplaced under the docroot.
|
|
Options -Indexes
|
|
|
|
# 4) Deny dotfiles (.git, .env, .htaccess, .user.ini, .phpunit.result.cache, ...).
|
|
<FilesMatch "^\.">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order allow,deny
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|
|
|
|
# 5) Deny anything Apache would serve as PLAINTEXT for lack of a handler. schema.sql is the
|
|
# sharp one: it is full DDL, and unlike a .php file PHP would not swallow it.
|
|
<FilesMatch "\.(sql|md|json|lock|dist|ini|log|sh|ya?ml|cache)$">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order allow,deny
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|
|
|
|
# NOTE: there are deliberately no deny rules for src/ vendor/ storage/ config.php here.
|
|
# Those live OUTSIDE the DocumentRoot (siblings of www/), where no .htaccess under www/
|
|
# could reach them and none is needed. Placement is the control; keep them out of www/.
|