8 Commits

Include renames

Author	SHA1	Message	Date
tben	8c20c9a7ed	Ask about HTTPS on a fresh install ... A fresh install asks whether to serve HTTPS, with the reasons, before touching anything. --yes keeps the default, --no-https answers it, and an update keeps the saved mode. The prompt reads /dev/tty so `curl | bash` still works; without a terminal the default is explained instead. Also state why a production process is serving plain HTTP (no TLS vars), instead of only giving that hint in development.	2026-10-20 10:24:38 +01:00
tben	e859bab294	Serve HTTPS by default with a local CA ... The installer generates a CA and a 397-day certificate into $COBBLE_HOME/certs (in the app image, with the host's addresses), mounts the certificate, key and CA into the container and serves TLS from Bun on the published port. --no-https opts out; --https-cert/--https-key use a real certificate, --https-host adds names and --https-regen replaces the CA. The installer and the image health check use curl -k when TLS is on. The CA is served at /ca.crt and as an iOS/macOS profile at /ca.mobileconfig for one-tap install. Development picks up certs/ automatically, `bun run dev:phone` generates and starts, and a plain-HTTP listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale dev server fails instead of silently answering on the same port.	2026-10-20 10:20:01 +01:00
tben	6c57fae444	Use short install URL in installer and docs	2026-10-20 08:35:36 +01:00
tben	e73eab3d41	Require the current container init setting on update	2026-10-20 07:45:06 +01:00
tben	f20f20f8a2	Document the release and launch checklist	2026-10-20 07:43:55 +01:00
tben	d0798a93a5	Add the self-hosted installer and release workflows	2026-10-20 07:02:58 +01:00
tbenandClaude Opus 5.5	694c83346f	Make Cobble a local install: setup flow, bots-first admin, settings ... Local, password-only auth: - No public pages; everything outside /admin and /auth redirects in - First run (no users) sends every page to /auth/signup, which creates the super admin (user #1) once and then locks - Login is email/username + password; removed the emailed-code flow, /auth/sso and email password reset - Google login kept for existing accounts only, never creates them - seed-super-admin now requires SEED_SUPER_ADMIN_PASSWORD Bots-first admin: - /admin and closed sections (people, logs, backups) redirect to /admin/bots; only bots and settings are live (AdminSections) - Removed the old admin layout; every /admin page uses the bots rail - Coordinator bot created at signup/seed and by /admin/bots (ensureCoordinatorBot), which redirects to its chat - bots.system_prompt (markdown) with a default coordinator prompt - seed-bots reuses the existing coordinator Settings: - Sub pages general (default), profile, change-password, listed in the rail with a back link; unknown settings paths redirect to general - Redesigned settings UI: pane header, grouped rows, sticky save bar - General: System/Light/Dark theme, saved per device Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-18 17:49:25 +01:00
tben	81e4a8aecc	First Commit. Duplicate bunext-sqlite preset	2026-10-18 16:47:11 +01:00