Update

deploy/unraid/README.md

@@ -86,6 +86,24 @@ the backend remain available to trusted in-container operator scripts.
 Production startup fails before replacing the active container when the
 password is empty or one of the documented defaults.
 
+Guest access is enabled by default when the operator login gate is active:
+
+```env
+GEOINTEL_GUEST_ACCESS_ENABLED=true
+GEOINTEL_GUEST_DISPLAY_NAME=Gast
+GEOINTEL_GUEST_SESSION_TTL_SECONDS=7200
+```
+
+No extra guest setting is required for a new authenticated deployment. Set
+`GEOINTEL_GUEST_ACCESS_ENABLED=false` to disable the button and guest endpoint.
+This adds **Als gast verkennen** to the landing page. The generated guest cookie
+is short-lived, project-scoped and limited to the canonical demo workflow.
+Operator mutations and access to another project are rejected by the backend,
+and the frontend hides management and task-starting controls. The mechanism is
+not tenant isolation: never enable it on an instance that contains private,
+customer or operational data. Deploy a separate demo container and storage
+root for public or recruiter-facing access.
+
 The repository deploy scripts run the same flow automatically. They validate
 the Compose reference, preserve the current image as
 `geointel-all-in-one:previous`, build an immutable `<commit-sha>-ai` or

deploy/unraid/geointel-unraid-template.xml

@@ -37,6 +37,9 @@
   <Config Name="Operator Password Hash" Target="GEOINTEL_AUTH_PASSWORD_HASH" Default="" Mode="" Description="PBKDF2-SHA256 password hash. Never enter a plaintext password." Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
   <Config Name="Operator Session Secret" Target="GEOINTEL_AUTH_SESSION_SECRET" Default="" Mode="" Description="Random secret of at least 32 characters used only to sign browser sessions." Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
   <Config Name="Operator Session TTL" Target="GEOINTEL_AUTH_SESSION_TTL_SECONDS" Default="43200" Mode="" Description="Session lifetime in seconds (900-604800)." Type="Variable" Display="advanced" Required="true" Mask="false">43200</Config>
+  <Config Name="Guest Demo Enabled" Target="GEOINTEL_GUEST_ACCESS_ENABLED" Default="true" Mode="" Description="Show a guest button that opens only the seeded, restricted demo workspace. Enabled by default when operator login is active; set false on non-demo instances." Type="Variable" Display="advanced" Required="true" Mask="false">true</Config>
+  <Config Name="Guest Display Name" Target="GEOINTEL_GUEST_DISPLAY_NAME" Default="Gast" Mode="" Description="Label shown for the temporary guest session." Type="Variable" Display="advanced" Required="true" Mask="false">Gast</Config>
+  <Config Name="Guest Session TTL" Target="GEOINTEL_GUEST_SESSION_TTL_SECONDS" Default="7200" Mode="" Description="Temporary guest session lifetime in seconds (900-86400)." Type="Variable" Display="advanced" Required="true" Mask="false">7200</Config>
   <Config Name="Official Orthophoto Acquisition" Target="ORTHOPHOTO_ENABLED" Default="true" Mode="" Description="Allow explicit bounded map selections to request the official Digitaal Vlaanderen orthophoto WMS." Type="Variable" Display="advanced" Required="true" Mask="false">true</Config>
   <Config Name="Orthophoto WMS URL" Target="ORTHOPHOTO_WMS_URL" Default="https://geo.api.vlaanderen.be/OMWRGBMRVL/wms" Mode="" Description="Official Digitaal Vlaanderen most-recent winter orthophoto WMS endpoint." Type="Variable" Display="advanced" Required="true" Mask="false">https://geo.api.vlaanderen.be/OMWRGBMRVL/wms</Config>
   <Config Name="SPW Orthophoto WMS URL" Target="SPW_ORTHOPHOTO_WMS_URL" Default="https://geoservices.wallonie.be/arcgis/services/IMAGERIE/ORTHO_LAST/MapServer/WMSServer" Mode="" Description="Official SPW latest Walloon orthophoto WMS endpoint." Type="Variable" Display="advanced" Required="true" Mask="false">https://geoservices.wallonie.be/arcgis/services/IMAGERIE/ORTHO_LAST/MapServer/WMSServer</Config>

deploy/unraid/geointel.env.example

@@ -40,6 +40,13 @@ GEOINTEL_AUTH_PASSWORD_HASH=
 GEOINTEL_AUTH_SESSION_SECRET=
 GEOINTEL_AUTH_SESSION_TTL_SECONDS=43200
 
+# Guest access is enabled by default whenever operator authentication is active.
+# It opens the seeded GeoIntel demo in a temporary, API-enforced restricted
+# session. Set this to false on installations containing private project data.
+GEOINTEL_GUEST_ACCESS_ENABLED=true
+GEOINTEL_GUEST_DISPLAY_NAME=Gast
+GEOINTEL_GUEST_SESSION_TTL_SECONDS=7200
+
 # Explicit, bounded acquisition from the official Digitaal Vlaanderen WMS.
 ORTHOPHOTO_ENABLED=true
 ORTHOPHOTO_WMS_URL=https://geo.api.vlaanderen.be/OMWRGBMRVL/wms

deploy/unraid/run-dockerman-container.sh

@@ -40,6 +40,9 @@ GEOINTEL_AUTH_USERNAME="${GEOINTEL_AUTH_USERNAME:-}"
 GEOINTEL_AUTH_PASSWORD_HASH="${GEOINTEL_AUTH_PASSWORD_HASH:-}"
 GEOINTEL_AUTH_SESSION_SECRET="${GEOINTEL_AUTH_SESSION_SECRET:-}"
 GEOINTEL_AUTH_SESSION_TTL_SECONDS="${GEOINTEL_AUTH_SESSION_TTL_SECONDS:-43200}"
+GEOINTEL_GUEST_ACCESS_ENABLED="${GEOINTEL_GUEST_ACCESS_ENABLED:-true}"
+GEOINTEL_GUEST_DISPLAY_NAME="${GEOINTEL_GUEST_DISPLAY_NAME:-Gast}"
+GEOINTEL_GUEST_SESSION_TTL_SECONDS="${GEOINTEL_GUEST_SESSION_TTL_SECONDS:-7200}"
 ORTHOPHOTO_ENABLED="${ORTHOPHOTO_ENABLED:-true}"
 ORTHOPHOTO_WMS_URL="${ORTHOPHOTO_WMS_URL:-https://geo.api.vlaanderen.be/OMWRGBMRVL/wms}"
 SPW_ORTHOPHOTO_WMS_URL="${SPW_ORTHOPHOTO_WMS_URL:-https://geoservices.wallonie.be/arcgis/services/IMAGERIE/ORTHO_LAST/MapServer/WMSServer}"
@@ -207,6 +210,28 @@ validate_runtime_config() {
     esac
   fi
 
+  case "$GEOINTEL_GUEST_ACCESS_ENABLED" in
+    true|false) ;;
+    *)
+      echo "GEOINTEL_GUEST_ACCESS_ENABLED must be true or false." >&2
+      return 2
+      ;;
+  esac
+  if [ -z "${GEOINTEL_GUEST_DISPLAY_NAME// }" ]; then
+    echo "GEOINTEL_GUEST_DISPLAY_NAME must not be blank." >&2
+    return 2
+  fi
+  case "$GEOINTEL_GUEST_SESSION_TTL_SECONDS" in
+    ''|*[!0-9]*)
+      echo "GEOINTEL_GUEST_SESSION_TTL_SECONDS must be an integer." >&2
+      return 2
+      ;;
+  esac
+  if [ "$GEOINTEL_GUEST_SESSION_TTL_SECONDS" -lt 900 ] || [ "$GEOINTEL_GUEST_SESSION_TTL_SECONDS" -gt 86400 ]; then
+    echo "GEOINTEL_GUEST_SESSION_TTL_SECONDS must be between 900 and 86400." >&2
+    return 2
+  fi
+
   case "$GEOINTEL_POSTGRES_PASSWORD" in
     ''|geointel|postgres|password|changeme|change-me-before-shared-use)
       echo "Refusing deployment with an empty or known-default PostGIS password." >&2
@@ -285,6 +310,9 @@ docker run -d \
   -e GEOINTEL_AUTH_PASSWORD_HASH="$GEOINTEL_AUTH_PASSWORD_HASH" \
   -e GEOINTEL_AUTH_SESSION_SECRET="$GEOINTEL_AUTH_SESSION_SECRET" \
   -e GEOINTEL_AUTH_SESSION_TTL_SECONDS="$GEOINTEL_AUTH_SESSION_TTL_SECONDS" \
+  -e GEOINTEL_GUEST_ACCESS_ENABLED="$GEOINTEL_GUEST_ACCESS_ENABLED" \
+  -e GEOINTEL_GUEST_DISPLAY_NAME="$GEOINTEL_GUEST_DISPLAY_NAME" \
+  -e GEOINTEL_GUEST_SESSION_TTL_SECONDS="$GEOINTEL_GUEST_SESSION_TTL_SECONDS" \
   -e ORTHOPHOTO_ENABLED="$ORTHOPHOTO_ENABLED" \
   -e ORTHOPHOTO_WMS_URL="$ORTHOPHOTO_WMS_URL" \
   -e SPW_ORTHOPHOTO_WMS_URL="$SPW_ORTHOPHOTO_WMS_URL" \