Add single-user local authentication

README.md

@@ -58,7 +58,9 @@ Environment variables set the configuration. **Restart the container after a cha
 | `CALIBRE_DB_PATH` | The calibre `metadata.db`, for book ids. See "How books reach the library". | None |
 | `UPDATE_INTERVAL_HOURS` | Hours between checks for new chapters. `0` turns them off. | `24` |
 | `DEFAULT_LOCKED_FIELDS` | Fields that new stories lock: `title`, `authors`, `comments`, `tags`, `series`, `pubdate`, `languages` | `title` |
-| `AUTH_METHOD` | `none`, `cwa` or `proxy`. See "Logins". | `none` |
+| `AUTH_METHOD` | `none`, `local`, `cwa` or `proxy`. See "Logins". | `none` |
+| `BINDERY_USERNAME` | The user name for `AUTH_METHOD=local`. Case-sensitive. | None |
+| `BINDERY_PASSWORD_HASH` | The password hash for `AUTH_METHOD=local`. See "Local login". | None |
 | `CWA_ALLOWED_USERS` | The CWA users that can log in. Empty allows every CWA user. | Empty |
 | `PROXY_AUTH_USER_HEADER` | The header in which a reverse proxy sends the user name | `X-Remote-User` |
 | `PROXY_AUTH_LOGOUT_URL` | Where the Log out button goes in proxy mode | None |
@@ -79,6 +81,7 @@ Separate the values in a list with commas.
 
 - `none`: Bindery asks for no login. Use this only on a private network, or behind a proxy that does
   the login.
+- `local`: One user logs in with a user name and password that you set. See "Local login".
 - `cwa`: Users log in with their CWA user name and password. See "CWA logins".
 - `proxy`: A reverse proxy, such as [Rauthy](https://github.com/sebadob/rauthy),
   [Authelia](https://github.com/authelia/authelia) or
@@ -90,6 +93,47 @@ Separate the values in a list with commas.
 **If the login settings are incomplete or wrong, Bindery refuses every request**, also with the API
 key, and shows the reason.
 
+#### Local login
+
+`AUTH_METHOD=local` gives one Bindery account without CWA. You must set `BINDERY_USERNAME` and
+`BINDERY_PASSWORD_HASH`. The hash is a one-way form of the password.
+
+1. In the folder with your `docker-compose.yaml` file, run this command to make the hash. The command hides the
+   password as you type it. Use a password that is not empty.
+
+   ```bash
+   docker compose run --rm --no-deps bindery python -c 'from getpass import getpass; from werkzeug.security import generate_password_hash; print(generate_password_hash(getpass("Password: ")))'
+   ```
+
+   In a source checkout, you can use:
+
+    ```bash
+    uv run python -c 'from getpass import getpass; from werkzeug.security import generate_password_hash; print(generate_password_hash(getpass("Password: ")))'
+    ```
+
+2. Make a `.env` file beside the `docker-compose.yaml` file, with your user name and the hash:
+
+   ```dotenv
+   BINDERY_USERNAME=reader
+   BINDERY_PASSWORD_HASH='paste-the-generated-hash-here'
+   ```
+
+   **Keep the single quotes around the hash.** They stop Docker from reading its `$` characters as
+   variables. Keep `.env` private, and do not commit it.
+
+   If you put the hash in `docker-compose.yml` instead, **write each `$` as `$$`**, for example
+   `'scrypt:32768:8:1$$salt$$digest'`. In the Compose file, quotes do not stop Compose from reading
+   `$` as the start of a variable. Bindery then gets a shortened hash, and it reports that the hash
+   is not valid.
+
+3. In the Compose file, set `AUTH_METHOD: local`, and uncomment `BINDERY_USERNAME` and
+   `BINDERY_PASSWORD_HASH`. Restart the container.
+
+4. Log in with the user name and the password, not the hash.
+
+To change the account, change the user name or make a new hash, and restart Bindery. This ends the
+open sessions.
+
 #### CWA logins
 
 `AUTH_METHOD=cwa` needs `CWA_URL`, `CWA_DB_PATH` or both. Without `CWA_DB_PATH`, Bindery sends the
@@ -113,7 +157,7 @@ authentication do not apply. If they must apply, use the `proxy` mode.
 
 #### Lockouts and sessions
 
-The `cwa` mode locks out password guesses:
+The `local` and `cwa` modes lock out password guesses:
 
 - After 5 wrong passwords for one user name from one address in 15 minutes, Bindery locks that user
   name for 15 minutes, for that address only. The real user can still log in from another address.
@@ -137,7 +181,7 @@ restart Bindery.
 
 Scripts can use the JSON API of the web interface.
 
-- In the `cwa` and `proxy` login modes, a script needs the API key. Make a long random key,
+- In the `local`, `cwa` and `proxy` login modes, a script needs the API key. Make a long random key,
   for example with `openssl rand -hex 32`, and set it in `BINDERY_API_KEY`. Send it with each
   request as `Authorization: Bearer <key>` or `X-Api-Key: <key>`.
 - In the `none` login mode, a script needs no key, but it must send `X-Requested-With: bindery` with