Security:
- PBKDF2-HMAC-SHA256 password hashing (260k iterations, random salt per password)
- Legacy MICRONAS_PASS plaintext still works for existing installs
- MICRONAS_PASS_HASH replaces plaintext in env file after first setup/change
- Timing-safe comparison via hmac.compare_digest
First-login setup:
- /setup route: shown when no credentials configured (fresh install)
- Replaces editing /etc/micronas.env manually
- setup.html dark-themed form matching login.html
Admin credential change:
- POST /api/admin/credentials (requires current password to confirm)
- Settings button in topbar opens modal for username + password change
- Session cleared after change → redirected to login
User management:
- PATCH /api/users/<name>: rename Linux user (usermod -l)
SMB + WebDAV entries removed, password reset required after rename
- Rename button in users table, modal with yellow warning
WebDAV:
- Options Indexes: directories now browsable in a regular web browser
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
