Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

scripts/gen-cert.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Creates a self-signed certificate so the kiosk can use the camera over https.
+# Give it the address staff will actually type, e.g.  ./gen-cert.sh visitors.local 192.168.1.50
+set -euo pipefail
+
+OUT_DIR="${OUT_DIR:-./data/certs}"
+PRIMARY="${1:-visitors.local}"
+shift || true
+
+mkdir -p "$OUT_DIR"
+
+ALT="DNS:${PRIMARY}"
+INDEX=1
+for extra in "$@"; do
+  if [[ "$extra" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    ALT="${ALT},IP:${extra}"
+  else
+    ALT="${ALT},DNS:${extra}"
+  fi
+  INDEX=$((INDEX + 1))
+done
+ALT="${ALT},DNS:localhost,IP:127.0.0.1"
+
+openssl req -x509 -nodes -newkey rsa:2048 -days 1095 \
+  -keyout "${OUT_DIR}/server.key" \
+  -out "${OUT_DIR}/server.crt" \
+  -subj "/C=AU/ST=Victoria/L=Melbourne/O=Visitor Sign In/CN=${PRIMARY}" \
+  -addext "subjectAltName=${ALT}" \
+  -addext "basicConstraints=CA:FALSE" \
+  -addext "keyUsage=digitalSignature,keyEncipherment" \
+  -addext "extendedKeyUsage=serverAuth"
+
+chmod 600 "${OUT_DIR}/server.key"
+
+echo
+echo "Certificate written to ${OUT_DIR}"
+echo "Names covered: ${ALT}"
+echo
+echo "Next: set HTTPS_ENABLED=true in .env, then restart the container."
+echo "Install ${OUT_DIR}/server.crt as a trusted root on each kiosk device to stop the warning."

scripts/healthcheck.mjs

@@ -0,0 +1,13 @@
+// Container healthcheck. Works whether the app is serving http or self-signed https.
+const secure = ['1', 'true', 'yes', 'on'].includes(String(process.env.HTTPS_ENABLED).toLowerCase());
+const port = process.env.PORT || 3000;
+const url = `${secure ? 'https' : 'http'}://127.0.0.1:${port}/healthz`;
+
+if (secure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+
+try {
+  const res = await fetch(url, { signal: AbortSignal.timeout(4000) });
+  process.exit(res.ok ? 0 : 1);
+} catch {
+  process.exit(1);
+}