block new accounts, deprecation notice

config-example.php

@@ -8,6 +8,12 @@ return array(
         'changeme',
     ),
 
+    // Set to false to prevent any new accounts from being created.
+    // Useful once you have set up your accounts and want to lock the server down.
+    // The createkey below provides lighter-weight protection; this disables account
+    // creation entirely regardless of what key is provided.
+    'allow_new_users' => true,
+
     // Key required to create new accounts. Leave empty to allow anyone to register.
     // For a private household server, set this to something only you know.
     // Use only lowercase letters and numbers.

docker-compose.yml

@@ -13,6 +13,7 @@ services:
       # Optional overrides. If not set, random values are generated on first run
       # and saved to data/.credentials. Run 'docker logs <container>' to see them.
       #
+      # ALLOW_NEW_USERS: set to "false" to disable new account creation entirely
       # CLIENT_ID: key the app must send with every request (like an API key)
       # CREATE_KEY: key required to create new user accounts in the app
       # READONLY_KEY: internal key, should be long and random, not shared
@@ -21,6 +22,7 @@ services:
       # ADMIN_CONTACT: email shown to users when a create key is required
       # SITE_NAME: shown on the web landing page
       # WELCOME_MESSAGE: shown on the web landing page
+      - ALLOW_NEW_USERS=${ALLOW_NEW_USERS:-true}
       - CLIENT_ID=${CLIENT_ID:-}
       - CREATE_KEY=${CREATE_KEY:-}
       - READONLY_KEY=${READONLY_KEY:-}

docker-entrypoint.sh

@@ -45,11 +45,20 @@ if [ "$FIRST_RUN" = true ]; then
         > "$CREDS_FILE"
 fi
 
+# Convert ALLOW_NEW_USERS env var to a PHP boolean for config.php
+# Accepts "false" or "0" to disable; anything else (including unset) leaves it enabled
+if [ "${ALLOW_NEW_USERS:-true}" = "false" ] || [ "${ALLOW_NEW_USERS:-true}" = "0" ]; then
+    PHP_ALLOW_NEW_USERS="false"
+else
+    PHP_ALLOW_NEW_USERS="true"
+fi
+
 # Write config.php from current values (regenerated each start so env var
 # overrides are always picked up without manual file edits)
 cat > "$CONFIG_FILE" << PHPEOF
 <?php
 return array(
+    'allow_new_users' => ${PHP_ALLOW_NEW_USERS},
     'clientids' => array('${CLIENT_ID}'),
     'createkey' => '${CREATE_KEY}',
     'readonlykey' => '${READONLY_KEY}',

index.php

@@ -32,6 +32,13 @@
 </head>
 <body class="login">
 <div class="login-header"><a href="web-login.php">Login</a>&nbsp;</div>
+<?php if ($isCommunityService) { ?>
+<div style="background-color:#cc6600; color:white; padding:10px; text-align:center; font-size:small;">
+    <b>Notice:</b> This service will be shut down later in 2026, please begin migrating to self-hosting. New accounts on this service are no longer permitted.
+    Visit <a href="https://github.com/webosarchive/sharing-service" style="color:white;">GitHub</a>
+    to learn how to self-host Share Space on your own hardware.
+</div>
+<?php } ?>
 
 <table width="100%" height="95%" style="padding-bottom: 20px;"><tr><td width="100%" align="center" valign="middle">
 <div style="max-width: 520px; margin-bottom: 20px; margin-top: 10px; padding-left: 24px; padding-right: 24px;">

new-user.php

@@ -11,6 +11,10 @@ if (array_key_exists('client-id', $request_headers) && in_array($request_headers
     gracefuldeath_json("no allowed client-id in request headers");
 }
 
+if (isset($config['allow_new_users']) && $config['allow_new_users'] === false) {
+    gracefuldeath_json("new account creation is disabled on this server");
+}
+
 //Make sure we can get the input
 $postjson = file_get_contents('php://input'); 
 try {

web-agreement.php

@@ -1,6 +1,10 @@
 <?php
     setcookie("credential", "", time() - 3600, "/");
     include("common.php");
+    if (isset($config['allow_new_users']) && $config['allow_new_users'] === false) {
+        gracefuldeath_html("New account creation is disabled on this server.");
+        die;
+    }
 ?>
 
 <html>

web-new-user.php

@@ -2,6 +2,11 @@
     include("common.php");
     include("functions.php");
 
+    if (isset($config['allow_new_users']) && $config['allow_new_users'] === false) {
+        gracefuldeath_html("New account creation is disabled on this server.");
+        die;
+    }
+
     if (isset($_POST["txtUsername"]) && isset($_POST["txtCredential"]) && isset($_POST["txtPassword"]))
     {
         $create_result = @create_new_user($_POST["txtUsername"], $_POST["txtCredential"], $_POST["txtPassword"], $_POST["txtCreateKey"], 'gracefuldeath_later');