feat: add auth and dual-stack tls management

README.md

@@ -9,6 +9,7 @@ Thin `Node.js + Express` metadata service for Duplicati restores. The backend ow
 - A single uploaded `Duplicati-server.sqlite` can be stored separately and used to map friendly task names onto task database files.
 - Directory browsing and file metadata APIs are now `sourceId`-scoped.
 - The frontend is now split into three pages:
+  - `/login.html` for first-run setup and sign-in
   - `/` for source management
   - `/source.html?sourceId=...` for a source workbench
   - `/file.html?sourceId=...&id=...` for video preview and browser-direct downloads
@@ -24,6 +25,14 @@ Thin `Node.js + Express` metadata service for Duplicati restores. The backend ow
 - `GET /api/sources`
 - `GET /api/sources/:sourceId`
 - `POST /api/sources/upload`
+- `GET /api/auth/state`
+- `POST /api/auth/setup`
+- `POST /api/auth/login`
+- `POST /api/auth/logout`
+- `GET /api/system/tls`
+- `PUT /api/system/tls`
+- `POST /api/system/tls/upload`
+- `DELETE /api/system/tls/custom-certificate`
 - `GET /api/server-db`
 - `POST /api/server-db/upload`
 - `PUT /api/sources/:sourceId/secrets`
@@ -51,9 +60,62 @@ npm start
 Environment variables:
 
 - `PORT`: HTTP port, default `3000`
+- `HTTPS_PORT`: HTTPS port, default `3443`
 - `APP_DB_PATH`: service-owned SQLite path, default `./data/app.sqlite`
 - `UPLOAD_DIR`: source storage root, default `./data/sources`
+- `TLS_DIR`: certificate storage root, default `./data/tls`
 - `PREVIEW_MAX_BYTES`: max file size flagged as safe for in-memory preview, default `16777216`
+- `AUTH_SESSION_TTL_DAYS`: login session lifetime in days, default `30`
+
+## Authentication
+
+The system now requires username/password login before any source-management or restore API can be used.
+
+- On first run, open `/login.html` and create the initial administrator account.
+- After setup, the protected pages `/`, `/source.html`, and `/file.html` redirect unauthenticated users back to the login page.
+- API routes return:
+  - `401 AUTH_SETUP_REQUIRED` when no administrator exists yet
+  - `401 AUTH_REQUIRED` when there is no valid session
+  - `401 SESSION_EXPIRED` when a saved session has expired
+
+Implementation notes:
+
+- credentials are stored in the service-owned `app.sqlite`
+- passwords are hashed with Node's built-in `scrypt`
+- sessions are stored server-side in SQLite and issued as `HttpOnly` cookies
+- the same cookie is intentionally usable over both HTTP and HTTPS, so it is not forced to `Secure`
+- `/healthz` stays public so Docker/Jenkins health checks do not need to log in
+
+## HTTPS and certificates
+
+The service now starts both listeners at the same time:
+
+- HTTP on `PORT`
+- HTTPS on `HTTPS_PORT`
+
+There is no forced redirect. You can open either protocol directly.
+
+TLS behavior:
+
+- if no custom certificate is configured, the app automatically generates and keeps a self-signed certificate so HTTPS always works
+- the self-signed certificate is regenerated from the configured primary domain and SAN list when you save self-signed TLS settings
+- custom certificates can be configured from the homepage either by pasting PEM text or by uploading PEM files
+- deleting the custom certificate switches the service back to the generated self-signed certificate immediately
+
+Certificate files are stored under `TLS_DIR`, while certificate metadata and the active mode are stored in `app.sqlite`.
+
+## Docker deployment note
+
+Expose both ports when running the container:
+
+- `3000` for HTTP
+- `3443` for HTTPS
+
+Example:
+
+```bash
+docker run --rm -p 3000:3000 -p 3443:3443 duplicati-preview
+```
 
 ## Multi-source model