feat(nh3-svos): SVOS voice (app-voice) live — /voice route before Basic auth (lease bearer), unit + quiesce hook; app credentials vaulted

2026-10-08 13:55:13 -07:00
parent a3184f66b9
commit b04cee5579
7 changed files with 50 additions and 3 deletions
@@ -65,6 +65,19 @@ https://svos.phasefinal.com:443 {
 			root * /opt/svos/current/static
 			file_server
 		}
+		# Voice (U12, app-voice on 127.0.0.1:8402; Prime 2026-10-08 "voice on"). BEFORE basic_auth on purpose: the browser
+		# calls /voice/* with `Authorization: Bearer <lease secret>` (web/src/lib/voice.ts), minted by a signed kernel open
+		# that itself goes through /api behind Basic auth. Basic auth here would reject the bearer, and the kernel's
+		# Authorization strip below would drop it. The lease IS the auth; the app refuses /voice without it. The /voice
+		# prefix is preserved upstream, Authorization passes untouched, no buffering (streamed audio), cancellation
+		# reaches the listener (client disconnect closes the upstream). Engines stay private (fv-ml1 :8300, irv-ml1 :8198).
+		@voice path /voice /voice/*
+		handle @voice {
+			reverse_proxy 127.0.0.1:8402 {
+				flush_interval -1
+			}
+		}
+
 		# Previous release's hashed assets across a rollout (svos-dev 2026-10-05): open workers restore evicted inventory
 		# credential-free. Generated by the same tool: a matcher + handle rooted in THAT release's static dir, or
 		# comments only when there is no previous release.