library: HTTPS via Caddy (install.sh --domain [--lan-tls]) so the live camera works; real visitor address behind a proxy; camera permission header

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wi3ZSot4XbUViwRFgLpRf

library/install.sh

@@ -5,6 +5,9 @@
 #   sudo ./install.sh --status        # show URLs and container health
 #   sudo ./install.sh --update        # rebuild with the latest Koha and restart
 #   sudo ./install.sh --stop | --start
+#   sudo ./install.sh --domain library.example.com           # HTTPS via Caddy (certificate is automatic)
+#   sudo ./install.sh --domain library.home.lan --lan-tls    # HTTPS for a name only your network knows (own CA)
+#       add --keep-direct to also keep the plain-HTTP ports open on the network
 #
 # Optional environment variables:
 #   LIBRARY_NAME="Smith Family Library"   name shown on the catalogue
@@ -79,6 +82,10 @@ show_status() {
     fi
     dc ps
     echo
+    if [ -n "${DOMAIN:-}" ]; then
+        echo "  Your library (HTTPS): https://$DOMAIN     <- use this one: the live camera scanner needs it"
+        echo "      (Koha's own screens: https://$DOMAIN/cgi-bin/koha/mainpage.pl, or the menu inside)"
+    fi
     echo "  Your library:        http://$ip:$STAFF_PORT"
     echo "      sign in here: find a book, add books (scan an ISBN or use the phone camera), lending, labels, people"
     echo "  Admin login:         $ADMIN_USER  /  $ADMIN_PASSWORD   (also stored in $HERE/.env)"
@@ -90,6 +97,52 @@ show_status() {
     echo
 }
 
+# --- HTTPS (Caddy) options --------------------------------------------------------
+DOMAIN_ARG="" LAN_TLS=0 KEEP_DIRECT=0 ACTION=""
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --domain)      DOMAIN_ARG="${2:-}"; [ -n "$DOMAIN_ARG" ] || { c_err "--domain needs a name"; exit 1; }; shift 2 ;;
+        --lan-tls)     LAN_TLS=1; shift ;;
+        --keep-direct) KEEP_DIRECT=1; shift ;;
+        *)             ACTION="${ACTION:+$ACTION }$1"; shift ;;
+    esac
+done
+set -- $ACTION
+if [ -n "$DOMAIN_ARG" ] && ! printf '%s' "$DOMAIN_ARG" | grep -Eq '^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$'; then
+    c_err "That does not look like a host name: $DOMAIN_ARG"; exit 1
+fi
+
+# Write (or replace) KEY=VALUE in .env
+env_set() { if grep -q "^$1=" .env; then sed -i "s|^$1=.*|$1=$2|" .env; else echo "$1=$2" >> .env; fi; }
+
+configure_caddy() {
+    local name="$DOMAIN_ARG"
+    # Caddy needs 80 and 443 (it is not moved to other ports: browsers expect these).
+    if ! dc ps --status running --services 2>/dev/null | grep -qx caddy; then
+        for p in 80 443; do
+            port_in_use "$p" && { c_err "Port $p is already in use on this machine - Caddy needs it. Stop what is using it, or use your own reverse proxy (see README)."; exit 1; }
+        done
+    fi
+    {
+        echo "# Generated by install.sh --domain - Caddy fetches and renews the certificate by itself."
+        echo "$name {"
+        [ "$LAN_TLS" = 1 ] && echo "	tls internal"
+        echo "	encode zstd gzip"
+        echo "	reverse_proxy koha:8081"
+        echo "}"
+    } > Caddyfile
+    env_set DOMAIN "$name"
+    env_set COMPOSE_PROFILES caddy
+    env_set STAFF_URL "https://$name"
+    [ "$KEEP_DIRECT" = 1 ] || env_set BIND_ADDR 127.0.0.1
+    c_ok "Caddy will serve https://$name"
+    if [ "$LAN_TLS" = 1 ]; then
+        c_info "Own-CA certificate: phones must trust Caddy's root, which is copied to $HERE/caddy-root.crt after start."
+    else
+        c_info "The name must point at this machine (DNS) and ports 80/443 must reach it, or the certificate cannot be issued."
+    fi
+}
+
 case "${1:-}" in
     --status) show_status; exit 0 ;;
     --stop)   dc stop; exit 0 ;;
@@ -152,6 +205,8 @@ else
     fi
 fi
 
+[ -n "$DOMAIN_ARG" ] && configure_caddy
+
 if [ -n "${EXTRA_CA:-}" ]; then
     cp "$EXTRA_CA" koha/certs/extra-ca.crt
     cp "$EXTRA_CA" quickadd/certs/extra-ca.crt
@@ -180,5 +235,12 @@ done
 [ "${READY:-0}" = 1 ] || { c_err "Timed out - see: docker logs -f library-koha"; exit 1; }
 
 c_ok "Your library is running."
+if [ -n "${DOMAIN:-}" ] && grep -q '^	tls internal' Caddyfile 2>/dev/null; then
+    for i in $(seq 1 20); do
+        docker cp library-caddy:/data/caddy/pki/authorities/local/root.crt "$HERE/caddy-root.crt" >/dev/null 2>&1 && break
+        sleep 2
+    done
+    [ -f "$HERE/caddy-root.crt" ] && c_info "Install this certificate on phones/computers that should trust https://$DOMAIN: $HERE/caddy-root.crt"
+fi
 echo
 show_status