diff options
Diffstat (limited to 'docs/DEPLOY.md')
| -rw-r--r-- | docs/DEPLOY.md | 60 |
1 files changed, 60 insertions, 0 deletions
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index 6fe6a53..99b7661 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -224,6 +224,66 @@ Agents use `token.create` instead of a password; tokens are scoped and revocable. Only the TLS port is forwarded, and every command still requires authentication (`meta` and `health` excepted). +## Web frontend (`https://bokf.makandra.eu/web`) + +The `web` service (image `bokf-web`, built from the `web` target of the +same Dockerfile and shipped by `scripts/deploy.sh` with the daemon) serves +bokftui in the browser: + +``` +browser ──443──▶ host Caddy (TLS) ──▶ 127.0.0.1:8790 bokf-web container + Caddy: routing + forward_auth + ├─ /web, /web/login, /web/logout ─▶ bokfweb (login gate) + └─ /web/tty/* (gate OK only) ────▶ ttyd ─▶ bokftui-web ─▶ bokftui + │ + bokfd ◀── unix socket ┘ +``` + +- **Login gate** (`bokfweb`, `clients/bokfweb.c`): the login page checks + the credentials with bokfd's own `session.open` — there is no second + password store, and bokfd's audit and per-user lockout apply. The gate + limits failed logins per client address (5 per 15 min) before bokfd's + limit is reached. A login sets a cookie (`HttpOnly`, `Secure`, + `SameSite=Strict`, 12 h) and redirects to `/web/tty/?arg=<handle>`. +- **One login**: the terminal wrapper (`deploy/bokftui-web`) trades the + handle for the bokfd session on the gate's internal `/redeem` (never + routed by Caddy) and starts `bokftui` with `BOKFD_SESSION`, so the TUI + opens logged in. Caddy's `forward_auth` lets a request reach ttyd only + with a live cookie whose session owns the handle in the URL; a leaked + URL is useless without the cookie. Quitting the TUI (or `/web/logout`) + closes the bokfd session and with it the web session. +- **Isolation**: every browser terminal is its own bokftui process with a + private throwaway `HOME` (config, drafts, log), memory/CPU/file limits, + and `BOKF_WEB=1`: the TUI refuses everything that would read or write + files or start programs on the frontend (file browser, save prompts, + downloads, the PDF viewer). No shell is ever offered. The container runs + as uid 10001, read-only root, `/tmp` tmpfs, all capabilities dropped, + `no-new-privileges`, pids/memory limits, and it sees bokfd only through + the protocol socket (no database, no secrets, no certificates). +- **TLS** is the host's reverse proxy. On the NAS, add to the existing + Caddy (`/mnt/data/caddy/Caddyfile`) a site block like the others and + reload it: + + ``` + bokf.makandra.eu { + tls { + dns inwx { ... } # as for the other sites + } + reverse_proxy 127.0.0.1:8790 + } + ``` + + Port 443 is already forwarded for the other sites. The container + publishes 8790 on the host's loopback only, so it is unreachable until + that block exists. +- `BOKF_WEB_MAX_SESSIONS` (default 20) caps concurrent terminals. + `docker compose logs web` shows logins, logouts and failed attempts + (never passwords). + +Not yet in the web version: uploading and downloading files (attachments, +bank files, SRU/eSKD/årsredovisning files, PDFs). The TUI says so where it +applies; use bokftui on a computer for those. + ## Mock company ```sh |