Send the networks the TSPU cuts off to openipc.ru with a 301

[widgetii]

In Russia the TSPU freezes a TLS connection to the origin's network after the first 20-odd kilobytes. Camera uploads from Russian providers die mid-body and end as nginx 408s: 561 on 2026-10-02, 300-570 a day since at least 2026-09-19.

Evidence (production, 2026-10-02/03)

• Packet capture on the origin, 11:45 UTC: four uploads from Rostelecom, KES and SOVAM addresses completed TCP and TLS, delivered 22.8-24.9 KB with every segment ACKed, then went silent in both directions. nginx's FIN at the 60 s body timeout was retransmitted seven times and never acknowledged.
• In the same period every upload that came through openipc.ru (proxied from a host inside Russia) was stored: 552 × 201, 8 × 429, no 408.

Change

• conf.d/openipc-blocked-nets.conf: geo $realip_remote_addr $openipc_blocked_net, loading openipc-blocked-nets.list — every network announced by an AS registered in Russia (4,999 ASes, 12,334 IPv4 + 1,905 IPv6 networks), generated by deploy/blocked-nets.py from iptoasn.com and committed.
• sites-available/org.openipc, HTTPS server: if ($openipc_blocked_net) { return 301 https://openipc.ru$request_uri; } — pages, APIs and POST /snapshots alike. Port 80 is untouched (stock firmware fetches ipctool and posts reports over plain HTTP).
• Keyed on the peer, not the realip-rewritten address: behind a mirror the reader is Russian, and openipc.ru's own host is in a Russian AS (197695), so every set_real_ip_from address is listed as not blocked. Otherwise the mirror's requests would be redirected back to it.

Known consequence: cameras on current firmware run curl without -L, so they do not follow the 301. Five Russian cameras that upload directly today (355 uploads stored since 2026-10-02) stop until their firmware follows redirects (curl -L --post301, no mirror named). The six that freeze today are already failing.

Tests

• deploy/nginx/check-config.sh --seam (nginx 1.26 in a container): from a stand-in blocked address, GET /ru/get-started?a=1, POST /snapshots and GET /api/v1/wizard/… each answer 301 to the same path and query on openipc.ru; the rest of the seam unchanged.
• service/deploytest TestBlockedNetsGoToTheMirror: peer key, every trusted mirror exempt, list well-formed and covering the frozen cameras but not the origin or GitHub, redirect on HTTPS only and not on dev. Keying on $remote_addr and dropping a mirror's exemption were each checked to fail it.
• deploy/push-nginx.sh dry run: the host differs from this branch only by the vhost lines and the two new files.

Not yet applied to the host.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Redirect Russian-network HTTPS traffic to the openipc.ru mirror

🐞 Bug fix ⚙️ Configuration changes 🧪 Tests 🕐 40+ Minutes

AI Description

• Redirect affected HTTPS requests to openipc.ru before origin connections stall mid-upload.
• Generate and commit Russian-AS network ranges, exempting trusted mirrors to prevent redirect
 loops.
• Test redirect coverage and preserve plain-HTTP routes used by stock firmware.

Diagram

graph TD
  Table["iptoasn table"] --> Generator["Network generator"] --> List["Committed CIDRs"] --> Geo["Peer-address geo"] --> Decision{"Blocked peer?"} -->|yes| Mirror["openipc.ru mirror"]
  Peer["Incoming peer"] --> Geo
  Decision -->|no| Origin["Origin routes"]
  Peer -->|plain HTTP| Origin

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Enable firmware redirect following before redirecting uploads

• ➕ Avoids interrupting uploads from cameras that currently reach the origin.
• ➖ Leaves already-stalling uploads unresolved until firmware is updated and deployed.

2. Redirect page and API requests but exclude snapshots

• ➕ Preserves uploads from current firmware that does not follow redirects.
• ➖ Does not fix the mid-body snapshot failures motivating the change.

Recommendation: The origin-side, peer-keyed redirect is a reasonable immediate response to the measured connection stalls, and mirror exemptions are essential. Treat deployment as a deliberate compatibility trade-off: current firmware without redirect following will stop uploading even from Russian cameras whose direct uploads still succeed.

Files changed (7) +14494 / -2

Bug fix (1) +6 / -0

org.openipcRedirect matching HTTPS requests to openipc.ru +6/-0

Redirect matching HTTPS requests to openipc.ru

• Adds a server-level 301 to the same path and query on openipc.ru for matched peers, including snapshot uploads. The plain-HTTP server remains unchanged.

deploy/nginx/sites-available/org.openipc

Tests (2) +113 / -1

check-config.shExercise blocked-peer redirects in the nginx seam +21/-1

Exercise blocked-peer redirects in the nginx seam

• Copies the generated list into the container, adds a stand-in blocked address, and checks that HTTPS GET and POST requests receive a 301 preserving their path and query.

deploy/nginx/check-config.sh

blocked_nets_test.goGuard peer matching, exemptions, and redirect scope +92/-0

Guard peer matching, exemptions, and redirect scope

• Checks the geo key, trusted-mirror exemptions, CIDR formatting and representative coverage. Also verifies that only the production HTTPS vhost redirects and preserves the request URI.

service/deploytest/blocked_nets_test.go

Documentation (1) +4 / -1

CLAUDE.mdDocument the blocked-network mirror redirect +4/-1

Document the blocked-network mirror redirect

• Adds the Russian-AS redirect to the site's routing overview and points maintainers to the generator and nginx configuration.

CLAUDE.md

Other (3) +14371 / -0

blocked-nets.pyGenerate collapsed Russian-AS CIDRs +88/-0

Generate collapsed Russian-AS CIDRs

• Fetches or reads an iptoasn table, filters ranges by AS registration country, and writes collapsed IPv4 and IPv6 nginx rules. Rejects implausibly small input before replacing the output.

deploy/blocked-nets.py

openipc-blocked-nets.confClassify connecting peers with mirror exemptions +41/-0

Classify connecting peers with mirror exemptions

• Defines an nginx geo rule keyed on $realip_remote_addr and includes the generated CIDRs. Explicitly exempts trusted mirror peers so proxied requests cannot redirect back to a mirror.

deploy/nginx/conf.d/openipc-blocked-nets.conf

openipc-blocked-nets.listCommit generated Russian-AS network rules +14242/-0

Commit generated Russian-AS network rules

• Contains the generated CIDR rules loaded by nginx: 12,334 IPv4 and 1,905 IPv6 networks from 4,999 ASes. This file is present in the checkout and described as committed, although its contents were omitted from the supplied diff.

deploy/nginx/conf.d/openipc-blocked-nets.list

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Russian readers cannot use club actions ✓ Resolved

Description

org.openipc redirects blocked readers to openipc.ru, but the club API's post middleware accepts
a browser Origin only when it matches the configured openipc.org site URL. Browser POSTs made from
the mirror therefore receive 403 before Telegram or email sign-in, reports, and other club actions
reach their handlers.

Code

deploy/nginx/sites-available/org.openipc[R109-110]

+    if ($openipc_blocked_net) {
+        return 301 https://openipc.ru$request_uri;

Evidence

The redirect makes openipc.ru the browser's origin. Club calls use relative URLs, while the API
compares the browser's Origin to its configured site URL and rejects a mismatch before invoking the
handler.

deploy/nginx/sites-available/org.openipc[107-111]
frontend/apps/site/src/lib/club.ts[69-74]
service/internal/club/api.go[65-110]
service/internal/config/config.go[35-38]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new redirect moves blocked readers onto openipc.ru, where the club API rejects their browser POSTs because its origin check expects openipc.org.
## Fix Focus Areas
- deploy/nginx/sites-available/org.openipc[109-110]
- service/internal/club/api.go[88-110]
- frontend/apps/site/src/lib/club.ts[69-74]
## Recommended Fix
Allow the explicitly trusted Russian mirror as a valid club POST origin while retaining rejection of unrelated origins. Add tests for both the mirror and an untrusted origin.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Russian users cannot upload large reports ✓ Resolved

Description

org.openipc redirects blocked HTTPS report submissions to openipc.ru, whose proxy caps request
bodies at 1 MiB instead of the origin report location's 300 MiB. A redirected submission containing
a larger photo, document, or backup receives 413 at the mirror before the report handler can process
it.

Code

deploy/nginx/sites-available/org.openipc[R109-110]

+    if ($openipc_blocked_net) {
+        return 301 https://openipc.ru$request_uri;

Evidence

The new rule redirects the report endpoint; the mirror catch-all limits bodies to 1 MiB, whereas the
origin permits 300 MiB and the service accepts individual photos and documents up to 20 MiB.

deploy/nginx/sites-available/org.openipc[107-111]
deploy/nginx/mirrors/ru.openipc.snippet[104-137]
deploy/nginx/sites-available/org.openipc[373-390]
service/internal/reports/handler.go[24-31]
service/internal/reports/handler.go[38-47]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The redirect sends blocked users' HTTPS report uploads through a mirror limited to 1 MiB, while the origin accepts reports up to 300 MiB.
## Fix Focus Areas
- deploy/nginx/sites-available/org.openipc[109-110]
- deploy/nginx/mirrors/ru.openipc.snippet[104-137]
- deploy/nginx/sites-available/org.openipc[373-390]
## Recommended Fix
Configure the Russian mirror's report upload path with the origin's body-size and upload timeout settings before enabling the redirect for that path. Verify a report larger than 1 MiB reaches the origin through the mirror.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can copy the agent prompt from any finding and feed it to your IDE agent

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[widgetii]

Both Qodo findings addressed in e270945:

1. Club POSTs from the mirror — club.post now also accepts the origins of the names that proxy the site (CLUB_MIRROR_ORIGINS, default openipc.ru, опенипц.рф, openipc.kz, openipc.cloud). Other origins are still refused; TestAMirrorsPageCanPost covers the mirror, plain-HTTP and look-alike origins.
2. Report uploads through openipc.ru — the mirror now has location ~ ^/api/v1/(?:reports$|club/) with the origin's limits (300m, 300 s, unbuffered); deploytest fails if they drift from the origin's. Applied on the mirror host; a 2 MB body through https://openipc.ru/api/v1/reports now reaches the service (which answered it) instead of the mirror's 413.