Enable separately hosted kwmbridge (#471)

* block access to internal endpoints
* add dedicated vhost for kwmserver mcu api
* update docker-compose.yml

web/kweb.cfg

@@ -137,6 +137,10 @@
 		to /upstreams/kwmserver/{path}
 	}
 
+	# block access to internal endpoints
+	internal /upstreams/kwmserver/api/kwm/v2/admin
+	internal /upstreams/kwmserver/api/kwm/v2/mcu
+
 	proxy /meet/ {%KWEBD_DNS_MEET%}:9080 {
 		fail_timeout 10s
 		try_duration 30s
@@ -247,3 +251,22 @@
 
 	import /etc/kweb-extras/*
 }
+
+{%FQDN%}:8443 {
+	log stdout
+	errors stdout
+
+	gzip
+	header / Server kweb
+
+	# tls settings. defaults to tls_auto
+	import /etc/{%TLS_MODE%}
+
+	# serve static content from /var/www/
+	root /var/www/
+
+	proxy /api/kwm/v2/mcu/ {%KWEBD_DNS_KWMSERVER%}:8778 {
+		websocket
+		transparent
+	}
+}