Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

.env.example

@@ -4,8 +4,6 @@
 SITE_NAME=Hideaway Visitor Sign In
 TZ=Australia/Melbourne
 PORT=3000
-# Port published on the docker host.
-HOST_PORT=8088
 
 # Long random string. Generate one with:  openssl rand -hex 32
 # Changing this invalidates admin sessions AND makes stored visitor PINs unreadable.
@@ -37,22 +35,42 @@ AUTO_SIGNOUT_TIME=18:30
 EXPIRY_WARNING_DAYS=28
 
 # ---------------------------------------------------------------- https
-# The browser will not allow camera access over plain http unless the address is
-# localhost. Either terminate TLS at a reverse proxy, or turn this on and run
-# scripts/gen-cert.sh to create a self-signed certificate.
-HTTPS_ENABLED=false
+# Browsers block the camera on plain http unless the address is localhost, so the
+# kiosk needs https. Leave this on and the container creates its own certificate
+# authority and server certificate at first start, then renews the server
+# certificate on its own before it lapses.
+HTTPS_ENABLED=true
+SECURE_COOKIES=true
+
+# Every name and address staff might type. These go into the certificate, so a
+# missing one means a browser warning. Re-issues automatically when this changes.
+HTTPS_HOSTNAMES=visitors.local,192.168.1.50
+
+# Ports published on the docker host.
+HOST_PORT=8443
+HOST_HTTP_PORT=8080
+# Must match HOST_PORT: used to build the http -> https redirect.
+HTTPS_PUBLIC_PORT=8443
+# The in-container http helper. 0 turns it off.
+HTTP_REDIRECT_PORT=3001
+
+# Where the certificates live. Leave these alone unless you are supplying your own.
 HTTPS_KEY=/data/certs/server.key
 HTTPS_CERT=/data/certs/server.crt
 
-# Set both of these to true when running behind an HTTPS reverse proxy.
+# Set TRUST_PROXY=true instead if you terminate TLS at a reverse proxy and turn
+# HTTPS_ENABLED off.
 TRUST_PROXY=false
-SECURE_COOKIES=false
 
 # --------------------------------------------------------- google sheets
 SHEETS_ENABLED=false
 # The long id from the sheet URL: docs.google.com/spreadsheets/d/<THIS PART>/edit
 SHEETS_SPREADSHEET_ID=
-SHEETS_TAB_NAME=Visitor log
+# Append-only history of every sign in and sign out.
+SHEETS_LOG_TAB=Visitor log
+# Rewritten on every change: only the people currently on site. Open this one
+# during an evacuation. Both tabs are created automatically if missing.
+SHEETS_ONSITE_TAB=On site now
 # Point at the mounted service account json...
 GOOGLE_CREDENTIALS_PATH=/secrets/google-service-account.json
 # ...or paste it base64 encoded instead (base64 -w0 key.json). One or the other.