Initial OpenWrt RMM implementation

docs/reverse-proxy.md

@@ -0,0 +1,82 @@
+# Reverse Proxy
+
+The web UI and HTTP API work through a standard HTTP reverse proxy. The application uses same-origin requests and an `HttpOnly` signed session cookie.
+
+For NPMplus, use the dedicated [npmplus.md](npmplus.md) guide. The included Caddy overlay is only an optional standalone alternative.
+
+## What The Proxy Handles
+
+- Web UI.
+- Operator login/logout.
+- Operator HTTP API.
+- Agent enrollment, heartbeat, command polling, and command results.
+
+## What The Proxy Does Not Handle
+
+An ordinary HTTP reverse proxy does not proxy SSH:
+
+- `2222/tcp` must remain reachable by managed routers, or be handled by a TCP proxy.
+- `22000-22099/tcp` must remain reachable by trusted operators, or be handled by a TCP proxy/VPN.
+
+## Included Caddy Configuration
+
+Set a public DNS name in `.env`:
+
+```env
+RMM_DOMAIN=rmm.example.com
+RMM_COOKIE_SECURE=true
+RMM_HTTP_BIND_IP=127.0.0.1
+```
+
+Start the base stack with the proxy overlay:
+
+```sh
+docker compose -f compose.yaml -f compose.proxy.yaml up -d --build
+```
+
+Caddy automatically obtains and renews a TLS certificate when:
+
+- the domain resolves to the server;
+- ports `80` and `443` are reachable from the internet.
+
+Open:
+
+```text
+https://rmm.example.com
+```
+
+## Existing Reverse Proxy
+
+Proxy HTTP traffic to:
+
+```text
+http://rmm-server:8080
+```
+
+When the browser uses HTTPS, set:
+
+```env
+RMM_COOKIE_SECURE=true
+```
+
+Preserve the original `Host` header and forward client/protocol headers. Example Nginx location:
+
+```nginx
+location / {
+    proxy_pass http://127.0.0.1:18080;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+```
+
+No WebSocket settings are currently required.
+
+## Recommended Network Policy
+
+- Public or VPN operator access: `443/tcp`.
+- Router tunnel access: `2222/tcp`.
+- Trusted operator/VPN access only: `22000-22099/tcp`.
+- Do not expose the direct application port `18080` publicly when using a reverse proxy.