Exposing Solid-SDR through an auth layer

[DJLax5]

Hi y'all,

I was wondering how you make your solid sdr instance available to be accessible from the outside / regular internet?

What I did was put an authelia middleware in front of the webservice that lives on my VPS and then relays it to the local device in the same network as my radio. That works totally fine and is just what i want.

However, there is one small caveat: the service worker precaches the index.html. If i now go again to the site after the auth has expired, i am not redirected to login again I rather see the cached app with a failed websocket. Then I need to do a force-reload (Ctrll+F5) to see the login agian.

The browser does not tell the app why the WebSocket failed, so an expired login looks the same as a server that is down. My idea for a small fix in the web client:

• When the signaling WebSocket closes, do one plain fetch of /ws/signal with redirect: "manual".
• If the answer is a redirect or a 401, an auth layer is in the way. Then unregister the service worker and reload. The reload goes to the network and the proxy shows its login. The service worker registers again afterwards.
• In all other cases (the server answers, or the network is down) nothing changes and the client keeps reconnecting as today.

Setups without an auth proxy never hit this path, and the PWA caching stays as it is. A guard would limit it to one automatic reload per minute, so a misconfigured proxy cannot cause a reload loop. It should work the same with other auth proxies (oauth2-proxy, Authentik, Cloudflare Access).
How do you feel about that? Does it fit your design? If yes, I am happy to send a PR. As with my other PRs, I worked this out together with Claude and would test it on my own setup before sending it.

Looking forward to your opinion!

Best,
Fabian

[daveisadork]

I think probably the simplest solution is to just exclude index.html from the service worker cache. We don't really gain anything by having it cached.

[daveisadork]

Oh, and to answer your question... I went low tech. Nginx + Basic auth in front of it.

[DJLax5]

Thanks for your quick reply!

Yep, that is indeed a super simple solution and yet works! I have opend PR #160 .

Yeah Nginx + Basic auth surely works as well!

Thanks!