feat: add secure responsive config UI and repository activity

Add one-time owner registration, form login, expiring sessions and password-confirmed account and storage changes. Introduce a guided black-and-white config interface with light and dark themes, mobile layouts, optional Kuma settings and the latest 250 repository results. Harden forms, secret handling and browser security headers; update deployment documentation and tests.

Author: drhdev

.env.example

@@ -1,13 +1,13 @@
 # Deployment target: Ubuntu 24.04+ x86_64; compose.yaml fixes linux/amd64.
 # Required values must be available to Coolify Compose build-time interpolation AND runtime.
 # Automatic GitHub App setup (default): no App ID, PEM, or Base64 to copy.
-# REQUIRED for browser setup: the exact HTTPS origin assigned to github-setup in Coolify.
+# REQUIRED for browser configuration: the exact HTTPS origin assigned to github-config in Coolify.
 # Example: https://github-backup.example.com (no path, no trailing slash).
-GITHUB_SETUP_URL=
-# REQUIRED for browser setup: create a unique random password with: openssl rand -hex 32
-# Login username is admin. Keep this value masked and independent of GitHub credentials.
-GITHUB_SETUP_PASSWORD=
-# Everything else needed for GitHub/Spaces is entered in the protected setup page.
+GITHUB_CONFIG_URL=
+# First visit: register a username and password with the one-time code retrieved in
+# the github-config service terminal: python -m github_backup.config_auth registration-code
+# No password environment variable. Registration closes permanently after first use.
+# GitHub/Spaces and optional Uptime Kuma are configured in the protected config page.
 # Setup defaults: Spaces region=fra1, root folder=github-backup.
 # OPTIONAL: scheduler, retention, capacity and monitoring defaults.
 BACKUP_INTERVAL_HOURS=1
@@ -28,15 +28,16 @@ BACKUP_MEMORY_LIMIT=512m
 # Optional comma-separated numeric IDs of intentionally deleted repos; never purges data.
 ACKNOWLEDGED_MISSING_REPOSITORIES=
 
-# OPTIONAL: disabled when empty. Copy a Push monitor's secret URL from Uptime Kuma.
+# OPTIONAL legacy Kuma fallback: prefer the config-page form. Saved settings take precedence.
+# Disabled when empty; paste a Push monitor's secret URL if using the env alternative.
 UPTIME_KUMA_PUSH_URL=
 # Enable only for Kuma reached over a trusted private HTTP network.
 UPTIME_KUMA_ALLOW_HTTP=false
 UPTIME_KUMA_TIMEOUT_SECONDS=5
 # 0 = automatic: 2 * BACKUP_INTERVAL_HOURS + 1 (3 hours with default hourly checks).
 UPTIME_KUMA_MAX_SUCCESS_AGE_HOURS=0
 
-# OPTIONAL manual alternative: leave all three empty for browser setup.
+# OPTIONAL manual alternative: leave all three empty for browser configuration.
 # GitHub App General > App ID; install on All repositories for each listed login.
 # Private keys > Generate a private key; base64 < app-private-key.pem | tr -d '\n'
 # Manual settings take precedence over saved browser credentials; use one mode.

.github/workflows/ci.yml

@@ -73,21 +73,21 @@ jobs:
             github-backup:ci --version
           docker run --rm --platform linux/amd64 --read-only --cap-drop=ALL --security-opt=no-new-privileges \
             github-backup:ci help run
-      - name: Smoke-test protected setup server
+      - name: Smoke-test protected config server
         run: |
-          docker run --detach --name github-backup-setup-ci --platform linux/amd64 \
+          docker run --detach --name github-backup-config-ci --platform linux/amd64 \
             --read-only --cap-drop=ALL --security-opt=no-new-privileges \
             --tmpfs /tmp:rw,noexec,nosuid,size=16m \
             --entrypoint gunicorn github-backup:ci \
             --bind 0.0.0.0:8080 --workers 1 --threads 2 --worker-tmp-dir /tmp \
-            github_backup.onboarding:application
-          trap 'docker rm --force github-backup-setup-ci' EXIT
+            github_backup.config_web:application
+          trap 'docker rm --force github-backup-config-ci' EXIT
           for attempt in $(seq 1 20); do
-            if docker exec github-backup-setup-ci python -c \
+            if docker exec github-backup-config-ci python -c \
               "import urllib.request; assert urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=2).read() == b'OK'"; then
               exit 0
             fi
             sleep 1
           done
-          docker logs github-backup-setup-ci
+          docker logs github-backup-config-ci
           exit 1

README.md

@@ -37,26 +37,40 @@ issues, Actions artifacts, secrets, or submodule contents from other repositorie
 1. Add `https://github.com/drhdev/github-backup` using the **Docker Compose** build strategy.
    Set Base Directory to `/` and Docker Compose Location to `/compose.yaml`.
 2. Keep one replica of each service and the persistent `backup-cache` volume.
-3. Assign an **HTTPS domain to `github-setup`, target port 8080**. If Coolify encodes
+3. Assign an **HTTPS domain to `github-config`, target port 8080**. If Coolify encodes
    the target port in its domain field, use `https://github-backup.example.com:8080`.
    The external URL remains `https://github-backup.example.com` on port 443.
    Leave `github-backup` without a domain or published port.
 4. **Disable automatic deployments, previews, and overlapping/rolling replacements.**
-5. Set just these two required environment variables, keep the password masked, and deploy:
+5. Set the required config URL and deploy:
 
 ```dotenv
-GITHUB_SETUP_URL=https://github-backup.example.com
-GITHUB_SETUP_PASSWORD=REPLACE_WITH_OUTPUT_OF_OPENSSL_RAND_HEX_32
+GITHUB_CONFIG_URL=https://github-backup.example.com
 ```
 
-Generate the password with `openssl rand -hex 32`. The URL must be the exact external HTTPS
-origin without a path or internal `:8080` suffix. Enable Buildtime and Runtime for supplied
-values in Coolify. No Spaces credentials, bucket settings, GitHub App IDs or PEMs need to
-be entered in the environment. See [the deployment guide](docs/COOLIFY.md).
+The URL is the exact external HTTPS origin without a path or internal `:8080` suffix.
+Enable Buildtime and Runtime in Coolify. No password, Spaces credentials, App IDs or PEMs
+need to be entered in the environment.
 
-### 2. Configure DigitalOcean Spaces in the setup page
+On the first visit, the page shows **Create your config account**. In Coolify, open the
+**`github-config` service Terminal** and retrieve its one-time registration code:
 
-Open the setup URL and log in as **admin** with your setup password. Enter:
+```bash
+python -m github_backup.config_auth registration-code
+```
+
+Enter that code, choose your username and a unique **16-128 character password/passphrase**,
+confirm it, and save the credentials in your password manager. Then use the login form.
+The code prevents someone else from claiming an unregistered deployment. Registration closes
+permanently after the first account is created; later visits show login, with a logout button
+inside setup. **There is no password-reset or second-registration feature.** Forgotten
+credentials require a fresh deployment with a new persistent volume; existing S3 backups
+are preserved. Missing/corrupt authentication files block access instead of reopening registration.
+See [authentication and recovery](docs/GITHUB_APP.md#config-account-and-recovery).
+
+### 2. Configure DigitalOcean Spaces in the config page
+
+After registering and logging in with your chosen username, enter:
 
 | Setup field | Where to get it |
 |---|---|
@@ -102,6 +116,22 @@ Optional scheduling, capacity, retention and monitoring settings retain the defa
 [.env.example](.env.example). Existing manual environment deployments remain supported;
 saved browser Spaces settings take precedence over their legacy Spaces variables.
 
+### Edit configuration and review activity
+
+The **Config** page follows three steps: **1. Storage → 2. GitHub connections → 3. Repository scope**.
+Configured sections collapse; click their heading to reopen and edit. Saved secrets are never
+shown or prefilled. Editing saved storage requires your current password. Use **Monitoring** for optional Kuma settings. The interface uses a neutral
+black-and-white design, automatic light/dark mode and a theme selector, with mobile touch targets.
+
+Open **Account** to change your username or password. Confirm your current password; changing
+either signs out all browsers without affecting backups or reopening registration.
+
+Open **Activity** to view/search the last **250 completed repository checks**, including status,
+completion time and duration, in pages of 25. Times adapt to the browser's time zone; UTC remains
+available in the timestamp title. Unchanged successful checks are included. History starts when
+this feature is deployed; older remote manifests are not imported. This local bounded log contains
+no credentials, raw exception messages or Git URLs and never blocks backups if history storage fails.
+
 ### 4. Verify the first backup
 
 Open the Coolify logs. A successful run emits `backup_finished` with `exit_code: 0`.
@@ -139,7 +169,7 @@ it cannot fit a new artifact, it fails visibly rather than delete protected reco
 
 ## Docker logs and monitoring
 
-Application diagnostics are JSON on **stderr**; scheduler/run events are JSON on **stdout**.
+Backup diagnostics are JSON on **stderr**; scheduler/run events are JSON on **stdout**.
 Docker and Coolify collect both streams. No application log files or log-volume mounts are required.
 Compose rotates Docker logs at **10 MB × 3 files**. Locally:
 
@@ -152,18 +182,17 @@ repositories, or stale checks become unhealthy. Docker's restart policy does not
 container solely for being unhealthy; configure notifications and inspect the logs.
 
 **Optional Uptime Kuma:** create a **Push** monitor with a **180-second heartbeat interval**,
-**0 retries** and your notification channel. Copy its generated Push URL into:
-
-```dotenv
-UPTIME_KUMA_PUSH_URL=https://kuma.example.com/api/push/REPLACE_WITH_PUSH_TOKEN
-```
+**0 retries** and your notification channel. In the config page's **Uptime Kuma** section,
+enter its generated secret Push URL, check **Enable Push monitoring**, and save. Changes
+apply within 30 seconds without a restart. The URL is never displayed again; leave it blank
+to keep the saved value. Uncheck monitoring and save to disable it.
 
 The worker pushes at most every 60 seconds, plus status changes. It reports failure or
 overdue successful checks even while the container is running; if the worker disappears,
 Kuma detects the missing heartbeat. The URL is secret. No Docker socket or inbound worker
 port is required. See [the monitoring guide](docs/MONITORING.md) for startup behavior,
 freshness thresholds, private-network HTTP, notification tests, and all optional variables.
-Leave the URL empty to disable it completely.
+Legacy monitoring environment variables remain a fallback until settings are saved in the page.
 
 ## Documentation
 

compose.yaml

@@ -57,15 +57,15 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
-  github-setup:
+  github-config:
     platform: linux/amd64
     build:
       context: .
       platforms: [linux/amd64]
     entrypoint: ["gunicorn"]
     command: ["--bind", "0.0.0.0:8080", "--workers", "1", "--threads", "2",
               "--timeout", "120", "--graceful-timeout", "20",
-              "--worker-tmp-dir", "/tmp", "github_backup.onboarding:application"]
+              "--worker-tmp-dir", "/tmp", "github_backup.config_web:application"]
     restart: unless-stopped
     init: true
     read_only: true
@@ -80,8 +80,7 @@ services:
       - backup-cache:/cache
     expose: ["8080"]
     environment:
-      GITHUB_SETUP_URL: ${GITHUB_SETUP_URL:-}
-      GITHUB_SETUP_PASSWORD: ${GITHUB_SETUP_PASSWORD:-}
+      GITHUB_CONFIG_URL: ${GITHUB_CONFIG_URL:-${GITHUB_SETUP_URL:-}}
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=5)"]
       interval: 60s