Luke Childsandlukechilds 9584da827e Refactor authentication into umbreld ...

Replace JWT-based authentication and the separate app-auth/app-proxy
containers with opaque, server-side sessions managed by umbreld.
Centralizing authentication reduces moving parts and secret sharing
while enabling reliable revocation, session management, and cleaner
future multi-user authorization.

- Issue separate credentials for the dashboard API, browser HTTP
endpoints, and app gateways, plus short-lived one-time app handoffs and
WebSocket tickets. Only credential hashes are persisted, and active
credentials remain stable when sessions renew.
- Move app authentication and proxying into umbreld while preserving LAN
and Tor access, HTTP and HTTPS, existing `app_proxy` configuration,
public path rules, WebSockets, and branded app startup errors.
- Protect file, media, log, upload, and dashboard API requests with
paired, session-bound credentials so leaking either a URL token, cookie,
or bearer token is insufficient on its own.
- Update the dashboard login, renewal, and logout flows; transparently
authenticate app launches; and add Active Sessions to Advanced Settings
with signed-in/last-seen details and controls to revoke one, other, or
all sessions.
- Consolidate app authentication into the shared UI build and remove the
legacy JWT, auth-server, app-proxy containers, and their dependencies.

Existing JWTs are intentionally not migrated, so users sign in once
after the OTA. New sessions then persist across umbreld restarts and
future updates.

---------

Co-authored-by: lukechilds <[email protected]>

2026-09-02 21:55:42 +07:00

..

tor

Update Tor to 0.4.9.11

2026-09-02 21:55:42 +07:00