chore: prepare repository for public release

deploy/unraid/run-dockerman-container.sh

@@ -31,22 +31,23 @@ GEOINTEL_POSTGIS_DATA_PATH="${GEOINTEL_POSTGIS_DATA_PATH:-/mnt/user/appdata/geoi
 GEOINTEL_POSTGRES_DB="${GEOINTEL_POSTGRES_DB:-geointel}"
 GEOINTEL_POSTGRES_USER="${GEOINTEL_POSTGRES_USER:-geointel}"
 GEOINTEL_POSTGRES_PASSWORD="${GEOINTEL_POSTGRES_PASSWORD:-}"
-GEOINTEL_CORS_ORIGINS="${GEOINTEL_CORS_ORIGINS:-http://localhost:${GEOINTEL_FRONTEND_PORT},http://127.0.0.1:${GEOINTEL_FRONTEND_PORT},http://192.168.10.150:${GEOINTEL_FRONTEND_PORT}}"
+GEOINTEL_CORS_ORIGINS="${GEOINTEL_CORS_ORIGINS:-http://localhost:${GEOINTEL_FRONTEND_PORT},http://127.0.0.1:${GEOINTEL_FRONTEND_PORT}}"
 GEOINTEL_MAX_UPLOAD_MB="${GEOINTEL_MAX_UPLOAD_MB:-500}"
 GEOINTEL_MAX_IN_MEMORY_VECTOR_MB="${GEOINTEL_MAX_IN_MEMORY_VECTOR_MB:-64}"
 GEOINTEL_AOI_WORKER_ENABLED="${GEOINTEL_AOI_WORKER_ENABLED:-true}"
 GEOINTEL_AOI_WORKER_POLL_SECONDS="${GEOINTEL_AOI_WORKER_POLL_SECONDS:-2}"
-GEOINTEL_AUTH_ENABLED="${GEOINTEL_AUTH_ENABLED:-false}"
+GEOINTEL_AUTH_ENABLED="${GEOINTEL_AUTH_ENABLED:-true}"
+GEOINTEL_AUTH_REQUIRE_HTTPS="${GEOINTEL_AUTH_REQUIRE_HTTPS:-true}"
 GEOINTEL_AUTH_USERNAME="${GEOINTEL_AUTH_USERNAME:-}"
 GEOINTEL_AUTH_PASSWORD_HASH="${GEOINTEL_AUTH_PASSWORD_HASH:-}"
 GEOINTEL_AUTH_SESSION_SECRET="${GEOINTEL_AUTH_SESSION_SECRET:-}"
 GEOINTEL_AUTH_SESSION_TTL_SECONDS="${GEOINTEL_AUTH_SESSION_TTL_SECONDS:-43200}"
-GEOINTEL_PUBLIC_BASE_URL="${GEOINTEL_PUBLIC_BASE_URL:-http://localhost:${GEOINTEL_FRONTEND_PORT}}"
+GEOINTEL_PUBLIC_BASE_URL="${GEOINTEL_PUBLIC_BASE_URL:-https://geointel.example.com}"
 GEOINTEL_AUTHENTIK_ISSUER="${GEOINTEL_AUTHENTIK_ISSUER:-}"
 GEOINTEL_AUTHENTIK_CLIENT_ID="${GEOINTEL_AUTHENTIK_CLIENT_ID:-}"
 GEOINTEL_AUTHENTIK_CLIENT_SECRET="${GEOINTEL_AUTHENTIK_CLIENT_SECRET:-}"
 GEOINTEL_AUTHENTIK_ALLOWED_EMAIL="${GEOINTEL_AUTHENTIK_ALLOWED_EMAIL:-}"
-GEOINTEL_GUEST_ACCESS_ENABLED="${GEOINTEL_GUEST_ACCESS_ENABLED:-true}"
+GEOINTEL_GUEST_ACCESS_ENABLED="${GEOINTEL_GUEST_ACCESS_ENABLED:-false}"
 GEOINTEL_GUEST_DISPLAY_NAME="${GEOINTEL_GUEST_DISPLAY_NAME:-Gast}"
 GEOINTEL_GUEST_SESSION_TTL_SECONDS="${GEOINTEL_GUEST_SESSION_TTL_SECONDS:-7200}"
 ORTHOPHOTO_ENABLED="${ORTHOPHOTO_ENABLED:-true}"
@@ -213,6 +214,14 @@ validate_runtime_config() {
       return 2
       ;;
   esac
+
+  case "$GEOINTEL_AUTH_REQUIRE_HTTPS" in
+    true|false) ;;
+    *)
+      echo "GEOINTEL_AUTH_REQUIRE_HTTPS must be true or false." >&2
+      return 2
+      ;;
+  esac
   if [ "$GEOINTEL_AUTH_ENABLED" = "true" ]; then
     if [ -z "$GEOINTEL_AUTH_USERNAME" ] \
       || [ -z "$GEOINTEL_AUTH_PASSWORD_HASH" ] \
@@ -227,6 +236,15 @@ validate_runtime_config() {
         return 2
         ;;
     esac
+    if [ "$GEOINTEL_AUTH_REQUIRE_HTTPS" = "true" ]; then
+      case "$GEOINTEL_PUBLIC_BASE_URL" in
+        https://*) ;;
+        *)
+          echo "GEOINTEL_PUBLIC_BASE_URL must use HTTPS when operator login requires HTTPS." >&2
+          return 2
+          ;;
+      esac
+    fi
   fi
 
   local authentik_count=0
@@ -365,6 +383,7 @@ docker run -d \
   -e GEOINTEL_AOI_WORKER_ENABLED="$GEOINTEL_AOI_WORKER_ENABLED" \
   -e GEOINTEL_AOI_WORKER_POLL_SECONDS="$GEOINTEL_AOI_WORKER_POLL_SECONDS" \
   -e GEOINTEL_AUTH_ENABLED="$GEOINTEL_AUTH_ENABLED" \
+  -e GEOINTEL_AUTH_REQUIRE_HTTPS="$GEOINTEL_AUTH_REQUIRE_HTTPS" \
   -e GEOINTEL_AUTH_USERNAME="$GEOINTEL_AUTH_USERNAME" \
   -e GEOINTEL_AUTH_PASSWORD_HASH="$GEOINTEL_AUTH_PASSWORD_HASH" \
   -e GEOINTEL_AUTH_SESSION_SECRET="$GEOINTEL_AUTH_SESSION_SECRET" \