gate dashboard with Basic Auth (admin:DW2024!) before public agentabrams.com exposure; /healthz stays open for tunnel probe

eaa3d5097fbc57e78e54c00e3c4eb91948b74be2 · 2026-08-06 12:19:07 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit eaa3d5097fbc57e78e54c00e3c4eb91948b74be2
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Aug 6 12:19:07 2026 -0700

    gate dashboard with Basic Auth (admin:DW2024!) before public agentabrams.com exposure; /healthz stays open for tunnel probe
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 6e722e2..5b18e05 100755
--- a/server.js
+++ b/server.js
@@ -90,8 +90,16 @@ function postWin(m) {
   });
 }
 
+// Whole-site Basic Auth — required before any public (agentabrams.com) exposure so the
+// dashboard + discovery internals aren't world-readable. /healthz stays open for the
+// CF-tunnel health probe. Creds env-overridable (COV_USER/COV_PASS); house default.
+const AUTH = 'Basic ' + Buffer.from((process.env.COV_USER || 'admin') + ':' + (process.env.COV_PASS || 'DW2024!')).toString('base64');
 const server = http.createServer((req, res) => {
   if (req.url === '/healthz') { res.end('ok'); return; }
+  if ((req.headers.authorization || '') !== AUTH) {
+    res.statusCode = 401; res.setHeader('WWW-Authenticate', 'Basic realm="RE Coverage", charset="UTF-8"');
+    res.end('Authentication required'); return;
+  }
   if (req.url === '/api/coverage') { res.setHeader('Content-Type', 'application/json'); res.end(JSON.stringify(coverage())); return; }
   if (req.url === '/api/wins') { res.setHeader('Content-Type', 'application/json'); res.end(JSON.stringify({ wins: readMilestones().reverse() })); return; }
   const file = req.url === '/' ? '/index.html' : req.url.split('?')[0];

← c3a3a70 add launchd plists (dashboard + filler) for reboot-durabilit · back to Re Coverage Dashboard · add HomesOnSpec gauge group (builder-site/listing/phone cove bbec632 →