[idea] Docker 10/14: Password and allowed hosts #2110

Which part? Desktop app

What would you like?

Step 10 of 14 of #2100: running SurfSense in Docker. Depends on #2109; start once it is merged.

Reach the app from other machines, behind a password.

Design: Docker proposal, Caddy and access

What to change

• docker/local/caddy/access-password.caddy: basic_auth, answering the hosts in SURFSENSE_ALLOWED_HOSTS, or any when it is empty.
• The headless entry hashes SURFSENSE_PASSWORD with caddy hash-password at start and picks the access file: password set means access-password, otherwise access-local.
• Compose and .env.example gain SURFSENSE_PASSWORD, SURFSENSE_ALLOWED_HOSTS and SURFSENSE_BIND.

Done when

• With a password and SURFSENSE_BIND=0.0.0.0, another machine on the LAN gets a login prompt, and after it the app, chat streaming and live updates work.
• Without a password, the same request is refused.
• The password never appears in logs or in the generated config on disk.

Scope: code and tests only. Don't edit docs/ or AGENTS.md, except to fix a link this change breaks; the maintainers update the docs when the Docker work ships.

Why would it help?

Each step leaves something that runs, so the Docker image is built and reviewed one piece at a time.