LoadBalancer nginx had no ^/admin/ location, so when a server higher in
the tree pulled a stream whose source is an LB, the LB returned 404 for
/admin/{live,timeshift,thumb,vod} before the request ever reached PHP.
The MAIN→LB direction worked (MAIN has the route); LB→MAIN was silently
broken — stream shown down, nothing in the panel logs.
Add a reduced admin location exposing ONLY the loopback handlers
(live|timeshift|thumb|vod) — not index|api|proxy_api — so the admin
panel itself is never served from a LoadBalancer. Mirrors the MAIN
admin gateway block.
Also fix a PSR-4 rename miss: the directory rename public/ → Public/
(1a296d09) updated src/bin/nginx/conf/nginx.conf but left
lb_configs/nginx.conf pointing at /home/xc_vm/public/ everywhere
(root, stream, progress, api). On a case-sensitive fresh LB install the
on-disk path is Public/, so every SCRIPT_FILENAME 404'd — all LB
streaming broke, not just loopback. Repoint the 8 filesystem paths to
Public/; SCRIPT_NAME stays /public/ (logical CGI path, matches MAIN).
- Added a new VOD stream delivery endpoint in `vod.php` to handle video on demand streaming with authentication and connection management.
- Created 404 Not Found HTML pages for various image directories to improve user experience when accessing non-existent resources.
- Deleted obsolete `index.php`, `constants.php`, and other related files from the admin and stream directories to clean up the codebase and remove deprecated functionality.
- Removed legacy initialization and progress handling scripts to streamline the application and enhance maintainability.
- update nginx routing and add legacy endpoints for admin and progress
- implement stream gateway endpoint for nginx rewrites
- ensure certbot webroot directory is created automatically if missing
- fix safe handling of country code retrieval in EPG and playlist logic
Steps 11.1–11.6: migrated all standalone API entry points to controller classes
dispatched via the Front Controller, then deleted the legacy PHP files.
Controllers created:
- PlayerApiController (player_api.php, 12 actions + numeric aliases)
- Enigma2ApiController (enigma2.php + xplugin.php)
- PlaylistApiController (playlist.php)
- EpgApiController (epg.php)
- InternalApiController (api.php, ~40 server-to-server actions)
Nginx changes (MAIN + LB configs):
- Add location block for streaming API endpoints → FC with XC_SCOPE=api
- Add location block for internal API (/api.php) → FC with XC_API=internal
- Change 6 rewrite rules from break→last for deleted file URLs
- Remove allow/deny from /api.php location — auth handled by PHP
(password + IP whitelist + brute-force guard)
Front Controller (public/index.php):
- Add section 3a: REST API dispatch (XC_SCOPE=includes/api/*)
- Add section 3b: Streaming API dispatch (XC_SCOPE=api, XC_API=*)
- Move autoloader require to top (section 1b) for all code paths
- Controller map: endpoint name → controller class → init → dispatch
Bootstrap changes:
- www/init.php, www/stream/init.php: replace FC_API_NAME constant with
direct $rFilename variable (set by FC before require, checked via isset)
Bug fixes:
- PlayerApiController: fix 3 PHP 8 warnings ($rBouquets undefined,
missing 'rating'/'subtitle' array keys in get_vod_info)
- Fix server-to-server API calls blocked by nginx deny all (api_url_ip
uses external server IP, not 127.0.0.1)
Deleted files (8):
- www/player_api.php, www/enigma2.php, www/xplugin.php
- www/epg.php, www/playlist.php, www/api.php
- includes/api/admin/index.php, includes/api/reseller/index.php
New files:
- tools/test_player_api.sh — comprehensive Player API test suite (13 sections)
Divarion-D