diff options
| author | Anders Betts <anders.betts@gmail.com> | 2026-09-23 11:36:11 +0200 |
|---|---|---|
| committer | Anders Betts <anders.betts@gmail.com> | 2026-09-23 11:36:11 +0200 |
| commit | 1abb7649b930d35d1f5a76fd72856659b1ee8275 (patch) | |
| tree | 50d1d3dd905056b75749e22a58e7247e4a4bb0e2 /docs/DECISIONS.md | |
| parent | 71a702f375750829c634b552217c9925d549828b (diff) | |
| download | bokf-0.1.69.tar.gz bokf-0.1.69.zip | |
web: bokftui in the browser (ttyd + bokfweb login gate); per-user login limitv0.1.69
New image bokf-web (Dockerfile target "web", compose service "web" on
127.0.0.1:8790): Caddy routing with forward_auth, the bokfweb login gate
(C, authenticates with bokfd's session.open, per-address limit, cookie +
terminal handle, one login handed to the TUI via /redeem) and ttyd running
bokftui in web mode in an isolated throwaway HOME. TLS stays with the
host's reverse proxy. BOKF_WEB=1 blocks every local file and viewer path in
the TUI. bokfd's login limiter is now per user name instead of one global
counter (5 wrong guesses from anyone locked out everybody), and a full
counter table no longer disables it. The cross build and deploy.sh build
and ship both images.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'docs/DECISIONS.md')
| -rw-r--r-- | docs/DECISIONS.md | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md index c18f49b..e317758 100644 --- a/docs/DECISIONS.md +++ b/docs/DECISIONS.md @@ -275,6 +275,20 @@ kept verbatim from the STATE.md they were pruned from (2026-09-21). the key parts of #11 and #28; `make check` rejects F-keys, `^N` and `^Enter` in `clients/`. +30. **Web frontend (2026-09-23)**: bokftui runs in the browser through + ttyd in its own container (`bokf-web`), behind a login gate in C + (`bokfweb`) that authenticates with bokfd's `session.open` — no second + password store — and one login: the gate hands the bokfd session to + the TUI through a terminal handle that only works with the login's + cookie. Caddy in the container does the routing and `forward_auth`; + TLS stays with the host's existing Caddy (port 443 was taken), which + proxies `bokf.makandra.eu` to `127.0.0.1:8790`. Every terminal is an + isolated process (private HOME, limits, `BOKF_WEB=1`: no local files or + programs). bokfd's login limiter became per user name (it was one + global counter, so any 5 wrong guesses locked out everybody) and the + gate limits per client address. Audience: the owner and Petter first, + prepared for more users. + ## Completed work formerly listed under "Pending decisions" - Attachments are complete: download (voucher detail `f`, Underlag `Enter`, |