29 lines
1.7 KiB
Markdown
29 lines
1.7 KiB
Markdown
# Eternity Project web server
|
|
|
|
A Dockerized publishing service for eternityproject.fi. It provides local accounts, password hashing, authenticated publishing, and owner-only post editing. Content is persisted to SQLite in a named Docker volume.
|
|
|
|
## Run it
|
|
|
|
1. Copy `.env.example` to `.env` and replace `SECRET_KEY` with a long random string.
|
|
2. Build and start the service:
|
|
|
|
```sh
|
|
docker compose up --build -d
|
|
```
|
|
|
|
Open `http://localhost:8000`, create the first account, and publish a field note. The first request initializes the database automatically.
|
|
|
|
## Accounts and MFA
|
|
|
|
The initial administrator account is `admin` with password `admin`, as requested for first-run access. Sign in, scan the displayed QR code with any iPhone or Android TOTP authenticator, and change this password before exposing the service to the internet. New registrations are held for approval in **Accounts**; accepted users must enroll a TOTP authenticator before they can publish.
|
|
|
|
## Email and password recovery
|
|
|
|
Registration now requires an email address. Members can change their password from the navigation. The sign-in page provides an email-based recovery link; it expires after one hour and can only be used once. Administrators can send the same recovery email to any approved member from **Accounts**.
|
|
|
|
Set `PUBLIC_URL` and the `MAIL_*` values in `.env` to send recovery emails. The SMTP account must support STARTTLS on the configured port. Review [TODO.md](TODO.md) before production deployment.
|
|
|
|
## Production notes
|
|
|
|
Put this service behind a TLS reverse proxy for `eternityproject.fi` (for example Caddy or Nginx). Set a strong unique `SECRET_KEY`; the Compose file intentionally refuses to start without it. Back up the `eternity_data` Docker volume, which contains accounts and posts.
|