Send a cut-off network's ipctool report to openipc.ru with a 307

[openipc-ai]

From a network the TSPU cuts off, a report with a flash backup sent to
openipc.org's port 80 froze at its first kilobytes and sat at
"Sending 0%" (OpenIPC/ipctool#232). Port 80 now answers it with
307 http://openipc.ru/api/v1/reports, whose port 80 proxies it back
here, as it already does for ipctool's downloads (#397). 307 keeps the
POST and its body.

ipctool since OpenIPC/ipctool#233 waits for an answer to the headers
before sending the body and follows a plain-HTTP 307, so a plain
ipctool upload gets through from Russia with no --host. An older one
reports the 307 and stops, which is quicker than the freeze. Install
after #233 is in the published ipctool. Identify stays: a few
kilobytes, which the freeze lets through.

service/run.sh test (deploytest) and deploy/nginx/check-config.sh --seam pass. The new probe: /api/v1/reports 307 (POST over HTTP from a blocked network).

Do not push-nginx.sh --apply until OpenIPC/ipctool#233 is merged and the rolling ipctool is on openipc.org.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Redirect blocked-network report uploads through openipc.ru

🐞 Bug fix 🧪 Tests 🕐 20-40 Minutes

AI Description

• Send blocked-network HTTP report uploads to openipc.ru with a 307 that preserves the POST body.
• Keep board identification on the origin because its small requests still get through.
• Add configuration and live probes for both routes; deploy after the compatible ipctool release.

Diagram

sequenceDiagram
    actor Camera as ipctool
    participant OriginHTTP as Origin HTTP
    participant Geo as Blocked-net geo
    participant Mirror as Mirror HTTP
    participant OriginHTTPS as Origin HTTPS
    participant Reports as Reports service
    Camera->>OriginHTTP: POST report headers
    OriginHTTP->>Geo: Check peer network
    alt Blocked network
        Geo-->>OriginHTTP: Blocked
        OriginHTTP-->>Camera: 307 mirror URL
        Camera->>Mirror: POST report and body
        Mirror->>OriginHTTPS: Proxy report over HTTPS
        OriginHTTPS->>Reports: Forward report
    else Other network
        Geo-->>OriginHTTP: Not blocked
        OriginHTTP->>Reports: Forward report
    end
    Note over OriginHTTP,Reports: Board identify remains direct on HTTP

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Require --host openipc.ru

• ➕ Uses the mirror's existing HTTP report proxy without changing origin routing.
• ➖ Requires users to know and specify the mirror; plain ipctool upload remains prone to freezing.

Recommendation: Use the conditional 307: it preserves the POST and body while making the mirror transparent to compatible ipctool clients. Deploy only after the redirect-capable ipctool is published, as the PR specifies.

Files changed (3) +28 / -11

Bug fix (1) +11 / -0

org.openipcRedirect blocked-network report uploads with HTTP 307 +11/-0

Redirect blocked-network report uploads with HTTP 307

• The port 80 report location now returns a mirror URL for blocked networks while preserving the request URI. Other networks continue to use the origin's report proxy.

deploy/nginx/sites-available/org.openipc

Tests (2) +17 / -11

check-config.shProbe the report redirect and direct identification path +10/-8

Probe the report redirect and direct identification path

• Adds a blocked-network HTTP POST probe expecting a 307 to openipc.ru for reports. Moves the existing direct-to-service check to board identification, which must remain unredirected.

deploy/nginx/check-config.sh

blocked_nets_test.goAssert the report-only HTTP redirect rule +7/-3

Assert the report-only HTTP redirect rule

• Checks that the report location uses a 307 to the HTTP mirror and that port 80 has only the intended blocked-network redirect locations. Existing HTTPS and ipctool redirect assertions remain.

service/deploytest/blocked_nets_test.go

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Blocked-network guide misstates uploads ✓ Resolved

Description

openipc-blocked-nets.conf still says port 80 redirects downloads alone and leaves report uploads
on the origin because ipctool follows no redirect. The new /api/v1/reports rule does redirect
blocked-network uploads, so a maintainer using that configuration guide to troubleshoot or change
routing is given the opposite behavior.

Code

deploy/nginx/sites-available/org.openipc[R59-60]

+        if ($openipc_blocked_net) {
+            return 307 http://openipc.ru$request_uri;

Evidence

The guide explicitly says port 80 redirects downloads alone and leaves the report upload untouched,
while the added rule returns a 307 for blocked-network requests to the report endpoint.

deploy/nginx/conf.d/openipc-blocked-nets.conf[32-37]
deploy/nginx/sites-available/org.openipc[58-64]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The blocked-network configuration comment says HTTP report uploads stay on the origin, but this PR redirects them to the mirror.
## Fix Focus Areas
- deploy/nginx/conf.d/openipc-blocked-nets.conf[32-37]
- deploy/nginx/sites-available/org.openipc[59-60]
## Recommended Fix
Update the configuration comment to describe the report's HTTP 307 and distinguish current ipctool behavior from older clients.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗