bokftui: remember server/user, BOKFD_TOKEN auto-login, sudo credential launcherv0.1.4

1 files changed, 25 insertions, 0 deletions

diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 74f3953..5281fb6 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -116,6 +116,31 @@ The clients honor `BOKFD_SOCKET`; a host-installed client can also point at
 `var/run/bokfd.sock`, but that file is owned by uid 10001, so the host user
 must be in that group (or use `sudo`).
 
+The TUI remembers the server and user (never the password) in
+`$XDG_CONFIG_HOME/bokf/tui.conf` (`~/.config/bokf/tui.conf`), written after
+a successful login. Precedence: `--socket`/`--user`, then `BOKFD_SOCKET`/
+`BOKFD_USER`, then that file.
+
+For a credential read from a root-only file, unlocked with `sudo`, create an
+admin-scoped token on the host and store it on the client machine:
+
+```sh
+docker compose exec -e BOKFD_PASSWORD='<pw>' bokfd \
+    bokfctl --user admin --org 1 token.create \
+    '{"label":"tui-laptop","scopes":["read","write","admin"]}'
+
+# on the client machine:
+sudo install -d -m 700 /etc/bokf
+sudo sh -c 'umask 077; printf "%s\n" "bokf_..." > /etc/bokf/tui-token'
+install -m 755 scripts/bokftui-sudo ~/bin/bokftui-sudo
+bokftui-sudo
+```
+
+`bokftui-sudo` runs `sudo -v`, reads `/etc/bokf/tui-token` (falling back to
+`/etc/bokf/tui-password`), exports the credential and execs `bokftui` as
+your user; with `BOKFD_TOKEN` set the TUI logs in without showing the login
+screen. Revoke the token with `token.revoke` when a machine goes away.
+
 ## TLS and external users
 
 Put the ACME DNS credentials in the host's `.env` once (they are never