web: bokftui in the browser (ttyd + bokfweb login gate); per-user login limitv0.1.69

New image bokf-web (Dockerfile target "web", compose service "web" on
127.0.0.1:8790): Caddy routing with forward_auth, the bokfweb login gate
(C, authenticates with bokfd's session.open, per-address limit, cookie +
terminal handle, one login handed to the TUI via /redeem) and ttyd running
bokftui in web mode in an isolated throwaway HOME. TLS stays with the
host's reverse proxy. BOKF_WEB=1 blocks every local file and viewer path in
the TUI. bokfd's login limiter is now per user name instead of one global
counter (5 wrong guesses from anyone locked out everybody), and a full
counter table no longer disables it. The cross build and deploy.sh build
and ship both images.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 60 insertions, 0 deletions

diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 6fe6a53..99b7661 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -224,6 +224,66 @@ Agents use `token.create` instead of a password; tokens are scoped and
 revocable. Only the TLS port is forwarded, and every command still requires
 authentication (`meta` and `health` excepted).
 
+## Web frontend (`https://bokf.makandra.eu/web`)
+
+The `web` service (image `bokf-web`, built from the `web` target of the
+same Dockerfile and shipped by `scripts/deploy.sh` with the daemon) serves
+bokftui in the browser:
+
+```
+browser ──443──▶ host Caddy (TLS) ──▶ 127.0.0.1:8790  bokf-web container
+                                        Caddy: routing + forward_auth
+                                        ├─ /web, /web/login, /web/logout ─▶ bokfweb (login gate)
+                                        └─ /web/tty/* (gate OK only) ────▶ ttyd ─▶ bokftui-web ─▶ bokftui
+                                                                                    │
+                                                              bokfd ◀── unix socket ┘
+```
+
+- **Login gate** (`bokfweb`, `clients/bokfweb.c`): the login page checks
+  the credentials with bokfd's own `session.open` — there is no second
+  password store, and bokfd's audit and per-user lockout apply. The gate
+  limits failed logins per client address (5 per 15 min) before bokfd's
+  limit is reached. A login sets a cookie (`HttpOnly`, `Secure`,
+  `SameSite=Strict`, 12 h) and redirects to `/web/tty/?arg=<handle>`.
+- **One login**: the terminal wrapper (`deploy/bokftui-web`) trades the
+  handle for the bokfd session on the gate's internal `/redeem` (never
+  routed by Caddy) and starts `bokftui` with `BOKFD_SESSION`, so the TUI
+  opens logged in. Caddy's `forward_auth` lets a request reach ttyd only
+  with a live cookie whose session owns the handle in the URL; a leaked
+  URL is useless without the cookie. Quitting the TUI (or `/web/logout`)
+  closes the bokfd session and with it the web session.
+- **Isolation**: every browser terminal is its own bokftui process with a
+  private throwaway `HOME` (config, drafts, log), memory/CPU/file limits,
+  and `BOKF_WEB=1`: the TUI refuses everything that would read or write
+  files or start programs on the frontend (file browser, save prompts,
+  downloads, the PDF viewer). No shell is ever offered. The container runs
+  as uid 10001, read-only root, `/tmp` tmpfs, all capabilities dropped,
+  `no-new-privileges`, pids/memory limits, and it sees bokfd only through
+  the protocol socket (no database, no secrets, no certificates).
+- **TLS** is the host's reverse proxy. On the NAS, add to the existing
+  Caddy (`/mnt/data/caddy/Caddyfile`) a site block like the others and
+  reload it:
+
+  ```
+  bokf.makandra.eu {
+      tls {
+          dns inwx { ... }        # as for the other sites
+      }
+      reverse_proxy 127.0.0.1:8790
+  }
+  ```
+
+  Port 443 is already forwarded for the other sites. The container
+  publishes 8790 on the host's loopback only, so it is unreachable until
+  that block exists.
+- `BOKF_WEB_MAX_SESSIONS` (default 20) caps concurrent terminals.
+  `docker compose logs web` shows logins, logouts and failed attempts
+  (never passwords).
+
+Not yet in the web version: uploading and downloading files (attachments,
+bank files, SRU/eSKD/årsredovisning files, PDFs). The TUI says so where it
+applies; use bokftui on a computer for those.
+
 ## Mock company
 
 ```sh