Basking: sign in with Authentik only, pages that nest and link

Sign-in is now OpenID Connect against Authentik (authorization code flow
with PKCE, state and nonce). The password, API tokens and the add command
are gone; each person who signs in gets a private notebook in a folder
named from a hash of who they are. An optional allowed list is checked on
every request.

Notes become pages with titles, a tree of subpages, [[links]] with
backlinks that follow renames, a Ctrl+K finder, slash commands, list
continuation, and Write and Read modes. Autosave keeps the text through a
dropped connection or an expired session. Export opens as an Obsidian vault.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/install.sh

@@ -137,8 +137,25 @@ fi
 if [ ! -f "$ENV_FILE" ]; then
 	cat > "$ENV_FILE" <<EOF
 # Environment for the basking service. Restart it after editing:  systemctl restart basking
+#
+# Basking has no passwords. You sign in with Authentik, so fill in the four lines below.
+# In Authentik: Applications > Providers > Create > OAuth2/OpenID Provider (client type
+# Confidential, scopes openid, profile and email), allow the redirect URI
+#     <BASKING_PUBLIC_URL>/auth/callback
+# then create an Application that uses it. Check the result with:  basking check
 
-# Where the settings file is (it holds the password hash and API tokens).
+# Where you open Basking in a browser, such as https://notes.example.com (no path).
+BASKING_PUBLIC_URL=
+# The provider's issuer, such as https://auth.example.com/application/o/basking/
+BASKING_OIDC_ISSUER=
+BASKING_OIDC_CLIENT_ID=
+BASKING_OIDC_CLIENT_SECRET=
+
+# Optional. Only these people may sign in (emails or usernames, separated by commas). Left empty,
+# everyone Authentik lets into the application gets a private notebook of their own.
+#BASKING_ALLOWED=you@example.com
+
+# Where the settings file is (it holds the signing secret).
 BASKING_CONFIG=$CONF_FILE
 
 # Optional. These override what the settings file says.
@@ -158,7 +175,7 @@ fi
 
 cat > "$UNIT" <<EOF
 [Unit]
-Description=Basking, a place to dump your thoughts
+Description=Basking, a private notebook
 After=network-online.target
 Wants=network-online.target
 
@@ -169,6 +186,8 @@ WorkingDirectory=$DATA_DIR
 ExecStart=$BIN serve
 Restart=on-failure
 RestartSec=5
+# Settings that need fixing by hand exit with status 2; do not loop on those.
+RestartPreventExitStatus=2
 
 # Basking only needs the network and its own folders.
 NoNewPrivileges=true
@@ -194,18 +213,17 @@ if [ "$START" -eq 1 ] || systemctl is-active --quiet basking; then
 	if systemctl is-active --quiet basking; then
 		say "Basking is running."
 	else
-		say "Basking did not start. Look at:  journalctl -u basking -n 50"
+		say "Basking did not start. If you have not filled in the Authentik settings in $ENV_FILE yet, that is why."
+		say "Look at:  journalctl -u basking -n 50"
 		exit 1
 	fi
 fi
 
 say "Installed $("$BIN" version)."
 say "Next:"
-say "  1. sudoedit $ENV_FILE        (optional: the address to listen on and where notes are kept)"
+say "  1. sudoedit $ENV_FILE        (fill in the Authentik settings at the top)"
 say "  2. systemctl start basking      (or run this again with --start)"
-say "  3. journalctl -u basking -f     to watch it; a first install prints the password here, once"
+say "  3. journalctl -u basking -f     to watch it; it says at once if a setting is missing or wrong"
 say ""
-say "The dashboard is at http://$LISTEN"
-case $LISTEN in
-127.*|localhost*|[::1]*) say "It only listens on this machine. To reach it elsewhere, put an HTTPS reverse proxy (or Hammerhead) in front of it." ;;
-esac
+say "Basking listens on $LISTEN. Put an HTTPS reverse proxy (or Hammerhead) in front of it and open the"
+say "address you set as BASKING_PUBLIC_URL; Authentik will not send people back to plain http."