Moduletrace/cobble
2
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases 8 Wiki Activity

Use the certs/ fallback in every environment

Browse Source 
TLS no longer depends on NODE_ENV: the TLS_* variables win, else certs/
is used whenever it exists (the container's /app/certs mount lands there
too), and TLS_DISABLED=1 is the only way to serve plain HTTP with a
certificate present. The plain-HTTP redirect listener now starts whenever
TLS is on, not only in development, and HTTP_REDIRECT_PORT replaces
DEV_HTTP_PORT. The installer writes TLS_DISABLED=1 for --no-https, and the
health check follows the same rule.
This commit is contained in:
tben
2026-10-20 10:29:37 +01:00
parent 8c20c9a7ed
commit 459eebf73d
10 changed files with 222 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9 -6
View File
@@ -210,20 +210,23 @@ bun run dev:phone -- --host cobble-laptop.tailnet-name.ts.net
```
That generates `certs/` and starts the dev server with it, with no `.env`
edits. Afterwards a plain `bun run dev` reuses the certificate whenever
`certs/server.crt` and `certs/server.key` exist (production never does).
`bun run gen:certs` on its own regenerates them if you need to add a name.
edits. Afterwards any server, `bun run dev` or `bun run start`, reuses the
certificate whenever `certs/server.crt` and `certs/server.key` exist; set
`TLS_DISABLED=1` to serve plain HTTP instead. `bun run gen:certs` on its own
regenerates them if you need to add a name.
Open `https://<the name you passed>:7227` on the phone and install the CA
from `https://<the name you passed>:7227/ca.mobileconfig` first. On the
laptop, trust the same `certs/ca.crt` once, so `https://localhost:7227`
stops warning.
With `certs/` present the dev server also listens one port above (`7228`)
for plain HTTP and redirects to the HTTPS page, so a stray
With a certificate the server also listens one port above (`7228`) for
plain HTTP and redirects to the HTTPS page, so a stray
`http://localhost:7228/...` link still lands. The HTTPS port itself cannot
answer plain HTTP, so `http://localhost:7227` still fails; use
`DEV_HTTP_PORT` to move the redirect.
`HTTP_REDIRECT_PORT` to move the redirect. The container publishes only the
HTTPS port, so the redirect is reachable there only if that second port is
published.
| Command | Purpose |
| -------------------- | ------------------------------------ |