Protect Tabularium with persistent authenticator-code login

scripts/deploy.py

@@ -9,7 +9,6 @@ import socket
 import subprocess
 import urllib.request
 from ci import APP, ROOT, fingerprint, run
-from smoke import verify
 
 DEPLOY_ROOT = Path("/opt/endorphin-tabularium-docs")
 CONFIG = Path("/etc/endorphin-tabularium-docs/production.env")
@@ -101,6 +100,16 @@ def main() -> None:
         if not 1024 <= port <= 65535:
             raise ValueError("Invalid port")
         check_port(port)
+        auth_dir = DEPLOY_ROOT / "private-auth"
+        auth_dir.mkdir(mode=0o700, exist_ok=True)
+        auth_dir.chmod(0o700)
+        os.chown(auth_dir, 1000, 1000)
+        # Initialize once; normal updates must preserve the authenticator key.
+        run("docker", "run", "--rm", "--network", "none", "--mount",
+            f"type=bind,src={auth_dir},dst=/auth", actual,
+            "node", "apps/docs/auth-cli.cjs", "init")
+        shutil.copyfile(ROOT / "scripts/auth-admin.sh", DEPLOY_ROOT / "auth")
+        (DEPLOY_ROOT / "auth").chmod(0o750)
         current = DEPLOY_ROOT / "current"
         previous = current.resolve() if current.is_symlink() else None
         release = DEPLOY_ROOT / "releases" / sha
@@ -109,7 +118,9 @@ def main() -> None:
         (release / "release.env").write_text(f"TABULARIUM_IMAGE={actual}\n")
         try:
             compose(release, "up", "-d", "--no-build", "--wait", "--wait-timeout", "120")
-            verify(f"http://127.0.0.1:{port}")
+            container = run("docker", "ps", "-q", "--filter", f"label=com.docker.compose.project={APP}",
+                            "--filter", "label=com.docker.compose.service=docs", capture=True)
+            run("docker", "exec", container, "node", "apps/docs/auth-cli.cjs", "verify")
         except Exception:
             if previous is not None:
                 print("Deployment failed; restoring previous verified release", flush=True)