HGS FLOOD2D — RUN ON THE SYNOLOGY NAS (recommended, one-time)
============================================================
Why: the portal is served over HTTPS. Browsers block an HTTPS page from
calling a plain http://<PC-ip>:8822 address (mixed-content security). Running
the server on the NAS behind a reverse proxy gives it an HTTPS address on the
SAME domain as the portal — the tool then auto-detects it and users do nothing.

Result after this one-time setup:
  Team member opens the portal -> Watershed tool -> Report tab ->
  "Run Simulation on Server" just works. No URL, no install, no firewall.

------------------------------------------------------------
STEP 1 — Run the server on the NAS (Container Manager / Docker)
------------------------------------------------------------
Container Manager is the easiest. Create a project with this docker-compose:

  services:
    flood2d:
      image: python:3.12-slim
      container_name: hgs-flood2d
      working_dir: /app
      volumes:
        - /volume1/flood2d:/app          # put the .py files here
        - /volume1/flood2d/jobs:/app/server_jobs
      ports:
        - "8822:8822"
      command: >
        bash -lc "pip install --no-cache-dir numpy pandas scipy matplotlib
        pillow requests pyproj xlsxwriter openpyxl h5py rasterio geopandas
        shapely python-docx fastapi uvicorn &&
        python hgs_flood2d_server.py"
      restart: unless-stopped

  Copy hgs_flood2d.py, hgs_flood_report.py, hgs_flood2d_server.py and
  hgs_ras2d_postprocessor.py into /volume1/flood2d first. Start the project.
  (First start downloads packages — a few minutes. It stays up after that.)

  Optional: put your Cartosat/survey DEM on the NAS and, in the tool's manual
  server field, no change is needed — server-side DEM can be wired later.

------------------------------------------------------------
STEP 2 — Reverse proxy so it shares the portal's HTTPS domain
------------------------------------------------------------
DSM -> Control Panel -> Login Portal -> Advanced -> Reverse Proxy -> Create:

  Source:      Protocol HTTPS
               Hostname portal.hydrogeosolutions.synology.me
               Port     443
               (Enable "URL path" and set path to  /flood2d )
  Destination: Protocol HTTP
               Hostname localhost
               Port     8822

  In "Custom Header" tab, click "Create -> WebSocket" (harmless, future-proof).
  Save.

  This maps  https://portal.hydrogeosolutions.synology.me/flood2d  ->  the
  container on 8822. The tool probes exactly this path first, so it connects
  automatically with zero user input.

------------------------------------------------------------
STEP 3 — Confirm
------------------------------------------------------------
In a browser open:
  https://portal.hydrogeosolutions.synology.me/flood2d/health
You should see {"ok":true,...}. Done — the tool will now auto-connect for
everyone.

If your DSM cannot add a path-based reverse proxy, use a subdomain instead
(e.g. flood2d.hydrogeosolutions.synology.me -> localhost:8822) and enter that
URL once under the tool's "Server address" override; it is then saved.
