# CLAUDE.md

Project context for Claude Code. See `PLANNING.md` for the full roadmap.

## What this is
A lightweight web GUI to manage file shares on a single home server (Proxmox
LXC/VM) — a minimal NAS control panel. Manages **SMB shares**, **NFS exports**,
**WebDAV shares**, and **system users** by editing host config files and reloading
daemons. Home/LAN use only.

## File layout
- `app.py` — Flask backend: all API routes, auth, business logic.
- `templates/index.html` — main SPA shell (Jinja2); no inline JS or CSS.
- `templates/login.html` — login form.
- `templates/setup.html` — first-time setup form (shown when no credentials exist).
- `static/css/app.css` — custom dark theme (GitHub-palette CSS variables).
- `static/img/favicon.svg` — app icon (drive bays with green LEDs).
- `static/js/utils.js` — shared helpers: `esc()`, `showToast()`, `apiFetch()`.
- `static/js/dashboard.js` — status dots, IPs, shares overview, active SMB connections, restart buttons.
- `static/js/shares.js` — SMB/NFS/WebDAV CRUD. Edit modal is async (fetches users+groups for dropdowns).
- `static/js/users.js` — user CRUD + password modal + group management + admin credential change modal.
- `static/js/main.js` — page init and 30 s auto-refresh.
- `micronas.service` — systemd unit (gunicorn `-w 1`, reads `/etc/micronas/micronas.env`).

## How it runs
Directly on the LXC/VM as a `systemd` service, Flask behind `gunicorn -w 1`.
Single worker is required — credential updates mutate `_creds` in-process.
**Not** in Docker for production — the app manipulates host services directly.

Auth uses **Flask sessions**. Credentials stored hashed (PBKDF2-HMAC-SHA256)
in `/etc/micronas/micronas.env`. First run redirects to `/setup`.
WebDAV htpasswd at `/etc/micronas/webdav.passwd` (group `www-data`, mode 640).
Config directory `/etc/micronas/` must be mode 750, owned `root:www-data`.

## Conventions & constraints
- **Keep it simple.** No database, no auth framework, dependency-light.
  Config files (`/etc/samba/smb.conf`, `/etc/exports`) are the source of truth.
- **Security basics are non-negotiable even for home use:**
  - Never use `subprocess.run(..., shell=True)` with user input. Use argument lists.
  - Validate all input: names `^[A-Za-z0-9_-]+$`; paths must resolve under `/srv`.
  - All routes require a valid session (`require_auth` decorator).
- **Config edits are safe:** parse into blocks, rewrite whole file — never
  blindly append for edit/delete/toggle operations.
- WebDAV config uses `<Location>` blocks for `DAV On` (not `<Directory>`) —
  required for Alias-mapped paths in Apache 2.4.
- LAN-only. Do not add internet-facing features.

## Out of scope
Backups, multi-user roles, databases, internet exposure, multi-host management,
disk quotas (ZFS-backed LXC doesn't support `setquota`).