docs: document self-hosting the web UI and community projects

Documents the daemon-served web UI from #1635: enabling it, reverse proxy, TLS, tunnels, and the auth/exposure model. Adds a community projects page for community-built self-hosting tooling.
2026-06-26 11:35:36 +07:00
parent a49c658d1f
commit c5c2ace698
6 changed files with 247 additions and 1 deletions
@@ -93,6 +93,8 @@ By default, anyone who can reach the daemon's listening address can connect. On

 When a password is configured, all HTTP requests must include an `Authorization: Bearer <password>` header and all WebSocket connections must authenticate via subprotocol. Unauthenticated requests receive a `401 Unauthorized` response. Only the `/api/health` liveness endpoint is exempt, so that process supervisors and load balancers can probe without credentials.

+If you enable the [bundled web UI](/docs/web-ui), its static files are also served without the password so the login screen can render. This is by design, the API and WebSocket still require authentication before any agent data is returned or any command runs. Set a password before binding the daemon to a network so the data behind the page stays protected.
+
 The password is stored as a bcrypt hash in `config.json`, the daemon never stores it in plaintext. See [Configuration](/docs/configuration#password-authentication) for setup instructions.

 ### What password auth does and does not do