From c58dab0a89109ede0f4bb7d5b34262e2e0cf1b36 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Sun, 23 Aug 2026 21:08:21 -0700
Subject: [PATCH] Homepage: give the user page its own login (dankuser)

The homepage user page + shared data now use a dedicated CADDY_HOMEPAGE_HASH
(username dankuser), separate from the shared family password (CADDY_BASICAUTH_HASH,
username dank, still used by the other vhosts) and the operator password
(CADDY_ADMIN_HASH, username frank, the /admin/ page). This lets the homepage be
re-logged independently without touching the other sites. deploy.sh renders the
new placeholder; the .env.example documents all three hashes.
---
 dankclaw/.env.example     | 11 +++++++++--
 dankclaw/Caddyfile        |  6 +++---
 scripts/deploy.sh         |  4 +++-
 tests/homepage_caddy.bats |  6 +++---
 4 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/dankclaw/.env.example b/dankclaw/.env.example
index 397433f..6b709db 100644
--- a/dankclaw/.env.example
+++ b/dankclaw/.env.example
@@ -25,9 +25,16 @@ GRAFANA_ADMIN_USER=admin
 GRAFANA_ADMIN_PASSWORD=changeme
 
 # Caddy (the homelab's single reverse proxy, on this host)
-# bcrypt hash of the homepage/protected-vhost password (caddy hash-password).
-# deploy.sh renders it into /home/dank/Containers/caddy/Caddyfile.
+# bcrypt hashes (caddy hash-password). deploy.sh renders them into
+# /home/dank/Containers/caddy/Caddyfile.
+# CADDY_BASICAUTH_HASH: the shared family password (the other vhosts: gitea,
+#   grafana, search, ...). Username: dank.
 CADDY_BASICAUTH_HASH=changeme
+# CADDY_ADMIN_HASH: the operator-only password (the homepage /admin/ page).
+#   Username: frank.
+CADDY_ADMIN_HASH=changeme
+# CADDY_HOMEPAGE_HASH: the homepage user-page password. Username: dankuser.
+CADDY_HOMEPAGE_HASH=changeme
 
 # Hermes -> Signal (signal-cli daemon on the host, port 8080)
 # E.164 number of the linked Signal account (your primary number, for Note-to-Self).
diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 0f36be7..1ca05a7 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -67,16 +67,16 @@ dankclaw.franksdank.cloud {
 	@data path /services.json /status.json /app.js /style.css /deployed.js
 	handle @data {
 		basicauth {
-			dank REPLACE_WITH_HASH
+			dankuser REPLACE_WITH_HOMEPAGE_HASH
 			frank REPLACE_WITH_ADMIN_HASH
 		}
 		file_server
 	}
 
-	# Everything else (the user page): the family (Q18).
+	# Everything else (the user page): the homepage login (dankuser).
 	handle {
 		basicauth {
-			dank REPLACE_WITH_HASH
+			dankuser REPLACE_WITH_HOMEPAGE_HASH
 		}
 		try_files /index.html
 		file_server
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 21b1cd9..5d7fb44 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -166,11 +166,13 @@ if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
   # '|| true' so a missing hash warns below instead of aborting under set -e.
   CADDY_BASICAUTH_HASH=\"\$(grep -E '^CADDY_BASICAUTH_HASH=' .env 2>/dev/null | tail -1 | cut -d= -f2- || true)\"
   CADDY_ADMIN_HASH=\"\$(grep -E '^CADDY_ADMIN_HASH=' .env 2>/dev/null | tail -1 | cut -d= -f2- || true)\"
-  if [ -n \"\${CADDY_BASICAUTH_HASH}\" ] && [ -n \"\${CADDY_ADMIN_HASH}\" ]; then
+  CADDY_HOMEPAGE_HASH=\"\$(grep -E '^CADDY_HOMEPAGE_HASH=' .env 2>/dev/null | tail -1 | cut -d= -f2- || true)\"
+  if [ -n \"\${CADDY_BASICAUTH_HASH}\" ] && [ -n \"\${CADDY_ADMIN_HASH}\" ] && [ -n \"\${CADDY_HOMEPAGE_HASH}\" ]; then
     # '|' delimiter: the bcrypt hash contains '/' characters.
     mkdir -p /home/dank/Containers/caddy
     sed -e \"s|REPLACE_WITH_HASH|\${CADDY_BASICAUTH_HASH}|g\" \\
         -e \"s|REPLACE_WITH_ADMIN_HASH|\${CADDY_ADMIN_HASH}|g\" \\
+        -e \"s|REPLACE_WITH_HOMEPAGE_HASH|\${CADDY_HOMEPAGE_HASH}|g\" \\
       dankclaw/Caddyfile > /home/dank/Containers/caddy/Caddyfile
   else
     echo '  WARN: a Caddy hash is not set in .env; keeping the placeholder(s)'
diff --git a/tests/homepage_caddy.bats b/tests/homepage_caddy.bats
index 1f871d7..4920eb4 100644
--- a/tests/homepage_caddy.bats
+++ b/tests/homepage_caddy.bats
@@ -10,8 +10,8 @@ setup() {
     CADDY="$REPO_ROOT/dankclaw/Caddyfile"
 }
 
-@test "the homepage has a root hash and a distinct admin hash (Q18/Q38)" {
-    grep -q "REPLACE_WITH_HASH" "$CADDY"
+@test "the homepage has its own hash and a distinct admin hash" {
+    grep -q "REPLACE_WITH_HOMEPAGE_HASH" "$CADDY"
     grep -q "REPLACE_WITH_ADMIN_HASH" "$CADDY"
 }
 
@@ -43,5 +43,5 @@ setup() {
     # page's credential for these, so the block must accept both users.
     grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
     grep -qE "handle[[:space:]]+@data" "$CADDY"
-    grep -qE "dank[[:space:]]+REPLACE_WITH_HASH" "$CADDY"
+    grep -qE "dankuser[[:space:]]+REPLACE_WITH_HOMEPAGE_HASH" "$CADDY"
 }