Serve plain HTTP only and drop the local certificate tooling

The app never terminates TLS: a reverse proxy or tunnel does, and isSecureRequest still reads X-Forwarded-Proto so cookies stay Secure. Removes the cert generator, TLS resolution and HTTP redirect, the local CA download, and the TLS envs, and trims the installer, Dockerfile health check and docs to match. Also softens the composer's loading row.
2026-10-21 15:35:27 +01:00
parent f13fa863c5
commit 8bf6bedec5
29 changed files with 114 additions and 1751 deletions
@@ -1,60 +0,0 @@
-import { AppData } from "@/src/data/app-data";
-import { SiteData } from "@/src/data/site-data";
-import buildCaProfile from "@/src/utils/build-ca-profile";
-
-type Params = {
-    pathname: string;
-};
-
-/**
- * Serves the local CA that signed the app's certificate
- * (`TLS_CA_FILE`), so a device can trust it without copying files across
- * the network: the certificate itself, and an iOS/macOS profile that
- * installs it in one tap.
- *
- * A certificate is public information; the key never leaves
- * `$COBBLE_HOME/certs`. Returns `null` for every other path, and for an
- * install using its own certificate, which has no local CA.
- */
-export default async function serveLocalCa({
-    pathname,
-}: Params): Promise<Response | null> {
-    const certificate_path = pathname == AppData["TlsCaPath"];
-    const profile_path = pathname == AppData["TlsCaProfilePath"];
-
-    if (!certificate_path && !profile_path) return null;
-
-    const ca_file = process.env.TLS_CA_FILE?.trim();
-
-    if (!ca_file) return null;
-
-    const file = Bun.file(ca_file);
-
-    if (!(await file.exists())) return new Response("Not Found", { status: 404 });
-
-    if (certificate_path) {
-        return new Response(file, {
-            headers: new Headers({
-                "Content-Type": "application/x-x509-ca-cert",
-                "Content-Disposition": `attachment; filename="${AppData["TlsCaFilename"]}"`,
-                "Cache-Control": "no-store, max-age=0, must-revalidate",
-                "X-Content-Type-Options": "nosniff",
-            }),
-        });
-    }
-
-    const profile = buildCaProfile({
-        certificate_pem: await file.text(),
-        display_name: `${SiteData["SiteName"]} local CA`,
-        identifier: `org.${SiteData["SiteSlug"]}.ca`,
-    });
-
-    return new Response(profile, {
-        headers: new Headers({
-            "Content-Type": "application/x-apple-aspen-config",
-            "Content-Disposition": `attachment; filename="${AppData["TlsCaProfileFilename"]}"`,
-            "Cache-Control": "no-store, max-age=0, must-revalidate",
-            "X-Content-Type-Options": "nosniff",
-        }),
-    });
-}
@@ -1,46 +0,0 @@
-import buildHttpsRedirectUrl from "@/src/utils/build-https-redirect-url";
-
-type Params = {
-    /**
-     * The port the app serves HTTPS on.
-     */
-    https_port: string | number;
-};
-
-/**
- * A plain-HTTP listener on the port above the HTTPS one, which sends the
- * browser to the same page over HTTPS.
- *
- * A port that speaks TLS cannot answer plain HTTP, so this cannot sit on
- * the HTTPS port itself: `http://<host>:<port>` still fails, but
- * `http://<host>:<port + 1>` lands on the right page. `HTTP_REDIRECT_PORT`
- * picks another port. Every environment starts it; the container publishes
- * only the HTTPS port, so there it is reachable only if that second port is
- * published too.
- */
-export default function startHttpRedirect({ https_port }: Params) {
-    const base = Number(https_port);
-    const configured = Number(process.env.HTTP_REDIRECT_PORT);
-    const redirect_port =
-        Number.isInteger(configured) && configured > 0
-            ? configured
-            : Number.isInteger(base) && base > 0
-              ? base + 1
-              : 7228;
-
-    if (redirect_port == base) return undefined;
-
-    return Bun.serve({
-        port: redirect_port,
-        reusePort: false,
-        fetch(req) {
-            return Response.redirect(
-                buildHttpsRedirectUrl({
-                    request_url: new URL(req.url),
-                    https_port,
-                }),
-                308,
-            );
-        },
-    });
-}