feat: add operator landing and login

deploy/unraid/run-dockerman-container.sh

@@ -33,6 +33,11 @@ GEOINTEL_POSTGRES_USER="${GEOINTEL_POSTGRES_USER:-geointel}"
 GEOINTEL_POSTGRES_PASSWORD="${GEOINTEL_POSTGRES_PASSWORD:-}"
 GEOINTEL_CORS_ORIGINS="${GEOINTEL_CORS_ORIGINS:-http://localhost:${GEOINTEL_FRONTEND_PORT},http://127.0.0.1:${GEOINTEL_FRONTEND_PORT},http://192.168.10.150:${GEOINTEL_FRONTEND_PORT}}"
 GEOINTEL_MAX_UPLOAD_MB="${GEOINTEL_MAX_UPLOAD_MB:-500}"
+GEOINTEL_AUTH_ENABLED="${GEOINTEL_AUTH_ENABLED:-false}"
+GEOINTEL_AUTH_USERNAME="${GEOINTEL_AUTH_USERNAME:-}"
+GEOINTEL_AUTH_PASSWORD_HASH="${GEOINTEL_AUTH_PASSWORD_HASH:-}"
+GEOINTEL_AUTH_SESSION_SECRET="${GEOINTEL_AUTH_SESSION_SECRET:-}"
+GEOINTEL_AUTH_SESSION_TTL_SECONDS="${GEOINTEL_AUTH_SESSION_TTL_SECONDS:-43200}"
 ORTHOPHOTO_ENABLED="${ORTHOPHOTO_ENABLED:-true}"
 ORTHOPHOTO_WMS_URL="${ORTHOPHOTO_WMS_URL:-https://geo.api.vlaanderen.be/OMWRGBMRVL/wms}"
 ORTHOPHOTO_WMS_LAYER="${ORTHOPHOTO_WMS_LAYER:-Ortho}"
@@ -171,6 +176,29 @@ validate_runtime_config() {
     return 2
   fi
 
+  case "$GEOINTEL_AUTH_ENABLED" in
+    true|false) ;;
+    *)
+      echo "GEOINTEL_AUTH_ENABLED must be true or false." >&2
+      return 2
+      ;;
+  esac
+  if [ "$GEOINTEL_AUTH_ENABLED" = "true" ]; then
+    if [ -z "$GEOINTEL_AUTH_USERNAME" ] \
+      || [ -z "$GEOINTEL_AUTH_PASSWORD_HASH" ] \
+      || [ "${#GEOINTEL_AUTH_SESSION_SECRET}" -lt 32 ]; then
+      echo "Enabled operator authentication requires username, password hash and a 32+ character session secret." >&2
+      return 2
+    fi
+    case "$GEOINTEL_AUTH_PASSWORD_HASH" in
+      pbkdf2_sha256\$*) ;;
+      *)
+        echo "GEOINTEL_AUTH_PASSWORD_HASH must use the pbkdf2_sha256 format." >&2
+        return 2
+        ;;
+    esac
+  fi
+
   case "$GEOINTEL_POSTGRES_PASSWORD" in
     ''|geointel|postgres|password|changeme|change-me-before-shared-use)
       echo "Refusing deployment with an empty or known-default PostGIS password." >&2
@@ -241,6 +269,11 @@ docker run -d \
   -e GEOINTEL_STORAGE_ROOT=/app/storage \
   -e GEOINTEL_CORS_ORIGINS="$GEOINTEL_CORS_ORIGINS" \
   -e GEOINTEL_MAX_UPLOAD_MB="$GEOINTEL_MAX_UPLOAD_MB" \
+  -e GEOINTEL_AUTH_ENABLED="$GEOINTEL_AUTH_ENABLED" \
+  -e GEOINTEL_AUTH_USERNAME="$GEOINTEL_AUTH_USERNAME" \
+  -e GEOINTEL_AUTH_PASSWORD_HASH="$GEOINTEL_AUTH_PASSWORD_HASH" \
+  -e GEOINTEL_AUTH_SESSION_SECRET="$GEOINTEL_AUTH_SESSION_SECRET" \
+  -e GEOINTEL_AUTH_SESSION_TTL_SECONDS="$GEOINTEL_AUTH_SESSION_TTL_SECONDS" \
   -e ORTHOPHOTO_ENABLED="$ORTHOPHOTO_ENABLED" \
   -e ORTHOPHOTO_WMS_URL="$ORTHOPHOTO_WMS_URL" \
   -e ORTHOPHOTO_WMS_LAYER="$ORTHOPHOTO_WMS_LAYER" \