Serve HTTPS by default with a local CA

The installer generates a CA and a 397-day certificate into
$COBBLE_HOME/certs (in the app image, with the host's addresses), mounts
the certificate, key and CA into the container and serves TLS from Bun on
the published port. --no-https opts out; --https-cert/--https-key use a
real certificate, --https-host adds names and --https-regen replaces the
CA. The installer and the image health check use curl -k when TLS is on.

The CA is served at /ca.crt and as an iOS/macOS profile at
/ca.mobileconfig for one-tap install. Development picks up certs/
automatically, `bun run dev:phone` generates and starts, and a plain-HTTP
listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale
dev server fails instead of silently answering on the same port.

src/functions/server/serve-local-ca.ts

@@ -0,0 +1,60 @@
+import { AppData } from "@/src/data/app-data";
+import { SiteData } from "@/src/data/site-data";
+import buildCaProfile from "@/src/utils/build-ca-profile";
+
+type Params = {
+    pathname: string;
+};
+
+/**
+ * Serves the local CA that signed the app's certificate
+ * (`TLS_CA_FILE`), so a device can trust it without copying files across
+ * the network: the certificate itself, and an iOS/macOS profile that
+ * installs it in one tap.
+ *
+ * A certificate is public information; the key never leaves
+ * `$COBBLE_HOME/certs`. Returns `null` for every other path, and for an
+ * install using its own certificate, which has no local CA.
+ */
+export default async function serveLocalCa({
+    pathname,
+}: Params): Promise<Response | null> {
+    const certificate_path = pathname == AppData["TlsCaPath"];
+    const profile_path = pathname == AppData["TlsCaProfilePath"];
+
+    if (!certificate_path && !profile_path) return null;
+
+    const ca_file = process.env.TLS_CA_FILE?.trim();
+
+    if (!ca_file) return null;
+
+    const file = Bun.file(ca_file);
+
+    if (!(await file.exists())) return new Response("Not Found", { status: 404 });
+
+    if (certificate_path) {
+        return new Response(file, {
+            headers: new Headers({
+                "Content-Type": "application/x-x509-ca-cert",
+                "Content-Disposition": `attachment; filename="${AppData["TlsCaFilename"]}"`,
+                "Cache-Control": "no-store, max-age=0, must-revalidate",
+                "X-Content-Type-Options": "nosniff",
+            }),
+        });
+    }
+
+    const profile = buildCaProfile({
+        certificate_pem: await file.text(),
+        display_name: `${SiteData["SiteName"]} local CA`,
+        identifier: `org.${SiteData["SiteSlug"]}.ca`,
+    });
+
+    return new Response(profile, {
+        headers: new Headers({
+            "Content-Type": "application/x-apple-aspen-config",
+            "Content-Disposition": `attachment; filename="${AppData["TlsCaProfileFilename"]}"`,
+            "Cache-Control": "no-store, max-age=0, must-revalidate",
+            "X-Content-Type-Options": "nosniff",
+        }),
+    });
+}

src/functions/server/start-http-redirect.ts

@@ -0,0 +1,45 @@
+import buildHttpsRedirectUrl from "@/src/utils/build-https-redirect-url";
+
+type Params = {
+    /**
+     * The port the app serves HTTPS on.
+     */
+    https_port: string | number;
+};
+
+/**
+ * Development convenience: a plain-HTTP listener on the port above the
+ * HTTPS one, which sends the browser to the same page over HTTPS.
+ *
+ * A port that speaks TLS cannot answer plain HTTP, so this cannot sit on
+ * the HTTPS port itself: `http://<host>:<port>` still fails, but
+ * `http://<host>:<port + 1>` lands on the right page. `DEV_HTTP_PORT`
+ * picks another port. Production does not start it (only one port is
+ * published, and it is HTTPS).
+ */
+export default function startHttpRedirect({ https_port }: Params) {
+    const base = Number(https_port);
+    const configured = Number(process.env.DEV_HTTP_PORT);
+    const redirect_port =
+        Number.isInteger(configured) && configured > 0
+            ? configured
+            : Number.isInteger(base) && base > 0
+              ? base + 1
+              : 7228;
+
+    if (redirect_port == base) return undefined;
+
+    return Bun.serve({
+        port: redirect_port,
+        reusePort: false,
+        fetch(req) {
+            return Response.redirect(
+                buildHttpsRedirectUrl({
+                    request_url: new URL(req.url),
+                    https_port,
+                }),
+                308,
+            );
+        },
+    });
+}