Release v2.20.1: migrate authentication to Better Auth

docker-compose/.env.example

@@ -4,6 +4,8 @@ PULSE_SIGNAGE_PLAYER_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-player:lat
 
 # Shared security
 PULSE_SIGNAGE_SHARED_SECRET=""
+AUTH_SECRET="REPLACE_WITH_A_RANDOM_SECRET_OF_AT_LEAST_32_CHARACTERS"
+AUTH_TRUSTED_ORIGINS="http://localhost:8080,http://127.0.0.1:8080"
 
 # Database
 DB_HOST="mysql"

docker-compose/.env.remote.example

@@ -13,7 +13,5 @@ WEB_PUBLIC_URL="https://signage.example.com"
 # Optional URL used by the kiosk launcher when the remote player is directly reachable
 PLAYER_PUBLIC_URL="http://remote-player.example.com:8081"
 
-PLAYER_AGENT_RECONNECT_DELAY_MS=5000
-
 # Remote bridge connectivity
 BRIDGE_PUBLIC_URL="http://player-bridge.example.com:8090"

docker-compose/README.md

@@ -60,6 +60,8 @@ Key configuration:
 
 - `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, `DB_PASSWORD`
 - `PULSE_SIGNAGE_SHARED_SECRET`
+- `AUTH_SECRET` (generate with `openssl rand -base64 32` and keep stable across restarts)
+- `AUTH_TRUSTED_ORIGINS` (comma-separated extra browser origins, such as local `localhost` URLs)
 - `WEB_PUBLIC_URL`
 - `BRIDGE_INTERNAL_URL`
 - `DEFAULT_ADMIN_USERNAME`
@@ -129,6 +131,8 @@ Key configuration:
 
 The example files are templates. Copy the appropriate file, review its defaults, and replace secrets or placeholder URLs before deploying.
 
+The local development Compose file reads `docker-compose/.local.env`; set `AUTH_SECRET` there as well. Generate one with `openssl rand -base64 32` and keep it stable across restarts.
+
 ### Public stack: `.env.example`
 
 Use this file as a starting point for the public Compose stack.
@@ -140,6 +144,7 @@ Important values:
 | `PULSE_SIGNAGE_WEB_IMAGE` | Image for the web app and bridge services. | `git.lzstealth.com/lzstealth/pulse-signage-web:latest` |
 | `PULSE_SIGNAGE_PLAYER_IMAGE` | Image for the player services. | `git.lzstealth.com/lzstealth/pulse-signage-player:latest` |
 | `PULSE_SIGNAGE_SHARED_SECRET` | Shared request-signing secret. | Blank; set this for a secured deployment. |
+| `AUTH_SECRET` | Signing/encryption secret for authentication sessions. | Generate with `openssl rand -base64 32`; keep stable across restarts. |
 | `DB_HOST` | MySQL host name. | `mysql` |
 | `DB_PORT` | MySQL port. | `3306` |
 | `DB_NAME` | MySQL database name. | `pulse-signage` |

docker-compose/docker-compose.yml

@@ -15,6 +15,8 @@ services:
       DB_USER: ${DB_USER:-pulse-signage}
       DB_PASSWORD: ${DB_PASSWORD:-signage_password}
       PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
+      AUTH_SECRET: ${AUTH_SECRET:?Set a random AUTH_SECRET in .env}
+      AUTH_TRUSTED_ORIGINS: ${AUTH_TRUSTED_ORIGINS:-}
       WEB_PUBLIC_URL: ${WEB_PUBLIC_URL:-http://localhost:8080}
       BRIDGE_INTERNAL_URL: ${BRIDGE_INTERNAL_URL:-http://player-bridge:8090}
       DEFAULT_ADMIN_USERNAME: ${DEFAULT_ADMIN_USERNAME:-admin}