chore: prepare repository for public release

deploy/unraid/geointel.env.example

@@ -6,7 +6,7 @@
 # development stack in docker-compose.yml.
 COMPOSE_FILE=docker-compose.unraid.yml
 
-# Browser URL: http://<unraid-ip>:<GEOINTEL_FRONTEND_PORT>
+# Browser URL: configure the HTTPS reverse-proxy origin below.
 GEOINTEL_FRONTEND_PORT=1202
 
 # Persisted application artifacts: uploads, tiles, masks, reports and exports.
@@ -30,7 +30,7 @@ GEOINTEL_POSTGRES_PASSWORD=change-me-before-shared-use
 
 # Browser origins allowed when directly calling the backend API.
 # Neem hier ook de publieke hostname op zodra Nginx Proxy Manager ervoor staat.
-GEOINTEL_CORS_ORIGINS=https://geointel.itworx.tech,http://geointel.itworx.tech,http://localhost:1202,http://127.0.0.1:1202,http://192.168.10.150:1202
+GEOINTEL_CORS_ORIGINS=https://geointel.example.com,http://localhost:1202,http://127.0.0.1:1202
 
 # Upload guard in MiB. The same 1-2048 limit is applied by nginx and FastAPI.
 GEOINTEL_MAX_UPLOAD_MB=500
@@ -42,7 +42,8 @@ GEOINTEL_AOI_WORKER_POLL_SECONDS=2
 # Optional single-operator access gate. Never store a plaintext password here.
 # Generate the password hash with AuthService.hash_password and use a unique,
 # random session secret of at least 32 characters.
-GEOINTEL_AUTH_ENABLED=false
+GEOINTEL_AUTH_ENABLED=true
+GEOINTEL_AUTH_REQUIRE_HTTPS=true
 GEOINTEL_AUTH_USERNAME=
 GEOINTEL_AUTH_PASSWORD_HASH=
 GEOINTEL_AUTH_SESSION_SECRET=
@@ -50,18 +51,17 @@ GEOINTEL_AUTH_SESSION_TTL_SECONDS=43200
 
 # Optional additive Authentik OIDC login. Configure all fields together. The
 # local operator credentials above remain the recovery login.
-GEOINTEL_PUBLIC_BASE_URL=http://localhost:1202
+GEOINTEL_PUBLIC_BASE_URL=https://geointel.example.com
 GEOINTEL_AUTHENTIK_ISSUER=
 GEOINTEL_AUTHENTIK_CLIENT_ID=
 GEOINTEL_AUTHENTIK_CLIENT_SECRET=
 GEOINTEL_AUTHENTIK_ALLOWED_EMAIL=
 
-# Guest access is enabled by default whenever operator authentication is active.
-# It opens the seeded GeoIntel demo in a temporary, API-enforced restricted
-# session. Set this to false on installations containing private project data.
+# Guest access is opt-in. It opens the seeded GeoIntel demo in a temporary,
+# API-enforced restricted session and belongs only on a dedicated demo install.
 # LET OP: scripts/configure_operator_login.sh zet dit op false tenzij je
 # expliciet --guest-access true meegeeft.
-GEOINTEL_GUEST_ACCESS_ENABLED=true
+GEOINTEL_GUEST_ACCESS_ENABLED=false
 GEOINTEL_GUEST_DISPLAY_NAME=Gast
 GEOINTEL_GUEST_SESSION_TTL_SECONDS=7200