web: bokftui in the browser (ttyd + bokfweb login gate); per-user login limitv0.1.69

New image bokf-web (Dockerfile target "web", compose service "web" on
127.0.0.1:8790): Caddy routing with forward_auth, the bokfweb login gate
(C, authenticates with bokfd's session.open, per-address limit, cookie +
terminal handle, one login handed to the TUI via /redeem) and ttyd running
bokftui in web mode in an isolated throwaway HOME. TLS stays with the
host's reverse proxy. BOKF_WEB=1 blocks every local file and viewer path in
the TUI. bokfd's login limiter is now per user name instead of one global
counter (5 wrong guesses from anyone locked out everybody), and a full
counter table no longer disables it. The cross build and deploy.sh build
and ship both images.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 36 insertions, 6 deletions

diff --git a/Dockerfile b/Dockerfile
index 63d120f..a46e15e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,11 @@
 FROM alpine:3.24 AS build
 # VERSION is declared after the expensive layers: the legacy builder
 # invalidates every layer that follows a changed build argument.
-RUN apk add --no-cache build-base openssl-dev
+# Alpine's ncurses has no ncursesw/ include directory; the TUI includes
+# <ncursesw/ncurses.h> like Debian, so point it at the one header.
+RUN apk add --no-cache build-base openssl-dev ncurses-dev \
+ && mkdir -p /usr/include/ncursesw \
+ && ln -s ../ncurses.h /usr/include/ncursesw/ncurses.h
 WORKDIR /src
 COPY . .
 ARG VERSION=0.1.0-dev
@@ -12,16 +16,42 @@ ARG VERSION=0.1.0-dev
 # source on this host.
 RUN if [ -x .prebuilt/bokfd ]; then \
         mkdir -p build && \
-        cp .prebuilt/bokfd .prebuilt/bokfctl build/; \
+        cp .prebuilt/bokfd .prebuilt/bokfctl .prebuilt/bokftui \
+           .prebuilt/bokfweb build/; \
     else \
-        make -j"$(nproc)" backend VERSION="$VERSION" \
+        make -j"$(nproc)" backend build/bokftui build/bokfweb \
+             VERSION="$VERSION" \
         && make test-core VERSION="$VERSION"; \
     fi \
- && strip build/bokfd build/bokfctl
+ && strip build/bokfd build/bokfctl build/bokftui build/bokfweb
+
+# The web frontend (image bokf-web, `--target web`): Caddy for routing, the
+# bokfweb login gate, ttyd and bokftui in web mode. It reaches bokfd only
+# through the protocol socket; no database, no secrets, no certificates
+# (TLS is the host's reverse proxy). Everything runs as an unprivileged
+# user; Caddy listens on 8790.
+FROM alpine:3.24 AS web
+RUN apk add --no-cache ca-certificates caddy ttyd ncurses-terminfo-base \
+        ncurses-libs libssl3 libcrypto3 \
+ && addgroup -S bokfd \
+ && adduser -S -D -H -u 10001 -G bokfd -s /sbin/nologin bokfd
+COPY --from=build /src/build/bokftui /src/build/bokfweb /usr/local/bin/
+COPY deploy/bokftui-web deploy/web-entrypoint.sh /usr/local/bin/
+COPY deploy/Caddyfile /etc/caddy/Caddyfile
+RUN chmod 0755 /usr/local/bin/bokftui-web /usr/local/bin/web-entrypoint.sh
+ENV BOKFD_SOCKET=/run/bokfd/bokfd.sock \
+    TERM=xterm-256color \
+    LANG=C.UTF-8
+USER 10001
+EXPOSE 8790
+HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
+    CMD ["wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7682/healthz"]
+ENTRYPOINT ["/usr/local/bin/web-entrypoint.sh"]
 
 # The runtime image carries the daemon and bokfctl only, statically linked
-# against OpenSSL and the C library; the ncurses TUI is a frontend built on the
-# machine you sit at.
+# against OpenSSL and the C library; the ncurses TUI is a frontend (on the
+# machine you sit at, or in the web image above). It is the last stage, so a
+# plain `docker build` still produces it.
 FROM alpine:3.24 AS runtime
 RUN apk add --no-cache ca-certificates util-linux \
  && addgroup -S bokfd \