web: bokftui in the browser (ttyd + bokfweb login gate); per-user login limitv0.1.69

New image bokf-web (Dockerfile target "web", compose service "web" on
127.0.0.1:8790): Caddy routing with forward_auth, the bokfweb login gate
(C, authenticates with bokfd's session.open, per-address limit, cookie +
terminal handle, one login handed to the TUI via /redeem) and ttyd running
bokftui in web mode in an isolated throwaway HOME. TLS stays with the
host's reverse proxy. BOKF_WEB=1 blocks every local file and viewer path in
the TUI. bokfd's login limiter is now per user name instead of one global
counter (5 wrong guesses from anyone locked out everybody), and a full
counter table no longer disables it. The cross build and deploy.sh build
and ship both images.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 47 insertions, 0 deletions

diff --git a/deploy/Caddyfile b/deploy/Caddyfile
new file mode 100644
index 0000000..c86f4e5
--- /dev/null
+++ b/deploy/Caddyfile
@@ -0,0 +1,47 @@
+# Web frontend routing inside the bokf-web container: the login gate
+# (bokfweb, 127.0.0.1:7682) and the browser terminal (ttyd, 127.0.0.1:7681).
+# Nothing reaches ttyd without the gate's OK.
+#
+# Plain HTTP on :8790, published on the host's loopback only. TLS for
+# https://bokf.makandra.eu is the host's reverse proxy (the NAS Caddy):
+#
+#     bokf.makandra.eu {
+#         tls { dns inwx ... }          # as for the other sites
+#         reverse_proxy 127.0.0.1:8790
+#     }
+{
+	auto_https off
+	admin off
+	servers {
+		# the host proxy's X-Forwarded-For names the real client (the
+		# gate limits failed logins per client address)
+		trusted_proxies static private_ranges
+	}
+}
+
+:8790 {
+	header {
+		Strict-Transport-Security "max-age=31536000"
+		-Server
+	}
+
+	redir / /web/ 302
+
+	# the terminal: only with a live login whose handle is in the URL
+	@tty path /web/tty /web/tty/*
+	handle @tty {
+		forward_auth 127.0.0.1:7682 {
+			uri /auth
+		}
+		reverse_proxy 127.0.0.1:7681
+	}
+
+	# login page, login and logout
+	handle /web* {
+		reverse_proxy 127.0.0.1:7682
+	}
+
+	handle {
+		respond "not found" 404
+	}
+}