mix
d72a383904
Implements the secure single-admin panel entry (spec 7.6). - internal/store: modernc.org/sqlite (pure Go, static build), WAL + foreign keys, embedded PRAGMA user_version migrations; schema 0001 covers admin/settings/domains/applications/send_log/rate_limits (spec 9). - Setup secret-link (spec 7.6.1): 128-bit crypto/rand token, printed to log + /data/setup-token (0600), 10-min TTL with regeneration, per-IP rate limit, subtle.ConstantTimeCompare, failures don't invalidate, one-time admin form, permanent invalidation once admin exists (/setup 404). - bcrypt admin password; server-side username/password validation. - Login + in-memory sessions, crypto-random token, cookie HttpOnly/Secure/SameSite (Secure toggleable for dev HTTP), login rate limit, auth middleware. - html/template base layout + setup/login/dashboard, vendored htmx 2.0.4. - build/entrypoint.sh: fix bind-mounted /data ownership as root before supervisord drops to the unprivileged panel user (found via container test). Verified on selfpost.example.com: go vet/build/test/gofmt clean; e2e curl of setup+login flows; docker build + run with -v ./data:/data creates the DB and 0600 token owned by panel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
696 B
HTML
21 lines
696 B
HTML
{{define "content"}}
|
|
<h1>Sign in</h1>
|
|
<div class="card narrow">
|
|
{{if .SetupHint}}
|
|
<p class="muted">No administrator has been created yet. Open the one-time
|
|
setup link printed in the container log to get started.</p>
|
|
{{else}}
|
|
{{if .Error}}<p class="error">{{.Error}}</p>{{end}}
|
|
<form method="post" action="/login">
|
|
<label for="username">Username</label>
|
|
<input id="username" name="username" autocomplete="username" autofocus required>
|
|
|
|
<label for="password">Password</label>
|
|
<input id="password" name="password" type="password" autocomplete="current-password" required>
|
|
|
|
<button type="submit">Sign in</button>
|
|
</form>
|
|
{{end}}
|
|
</div>
|
|
{{end}}
|