Update intranet tools and voucher comparison

deployment/nginx_intranet_auth.conf.example

@@ -0,0 +1,24 @@
+# Example reverse-proxy guard for the intranet app.
+# Put this in an nginx server block. To keep 172.16.40.90:8010 as the public
+# address, move the FastAPI app to 127.0.0.1:8011 and let nginx listen on 8010.
+#
+# Create the password file:
+#   sudo apt-get install apache2-utils
+#   sudo htpasswd -c /etc/nginx/.htpasswd-hanmac USERNAME
+
+server {
+    listen 8010;
+    server_name 172.16.40.90;
+
+    auth_basic "Hanmac Intranet";
+    auth_basic_user_file /etc/nginx/.htpasswd-hanmac;
+
+    location / {
+        proxy_pass http://127.0.0.1:8011;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}