Serve HTTPS by default with a local CA

The installer generates a CA and a 397-day certificate into $COBBLE_HOME/certs (in the app image, with the host's addresses), mounts the certificate, key and CA into the container and serves TLS from Bun on the published port. --no-https opts out; --https-cert/--https-key use a real certificate, --https-host adds names and --https-regen replaces the CA. The installer and the image health check use curl -k when TLS is on. The CA is served at /ca.crt and as an iOS/macOS profile at /ca.mobileconfig for one-tap install. Development picks up certs/ automatically, `bun run dev:phone` generates and starts, and a plain-HTTP listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale dev server fails instead of silently answering on the same port.
2026-10-20 10:20:01 +01:00
parent 535adb6e16
commit e859bab294
26 changed files with 1582 additions and 40 deletions
@@ -0,0 +1,45 @@
+import buildHttpsRedirectUrl from "@/src/utils/build-https-redirect-url";
+
+type Params = {
+    /**
+     * The port the app serves HTTPS on.
+     */
+    https_port: string | number;
+};
+
+/**
+ * Development convenience: a plain-HTTP listener on the port above the
+ * HTTPS one, which sends the browser to the same page over HTTPS.
+ *
+ * A port that speaks TLS cannot answer plain HTTP, so this cannot sit on
+ * the HTTPS port itself: `http://<host>:<port>` still fails, but
+ * `http://<host>:<port + 1>` lands on the right page. `DEV_HTTP_PORT`
+ * picks another port. Production does not start it (only one port is
+ * published, and it is HTTPS).
+ */
+export default function startHttpRedirect({ https_port }: Params) {
+    const base = Number(https_port);
+    const configured = Number(process.env.DEV_HTTP_PORT);
+    const redirect_port =
+        Number.isInteger(configured) && configured > 0
+            ? configured
+            : Number.isInteger(base) && base > 0
+              ? base + 1
+              : 7228;
+
+    if (redirect_port == base) return undefined;
+
+    return Bun.serve({
+        port: redirect_port,
+        reusePort: false,
+        fetch(req) {
+            return Response.redirect(
+                buildHttpsRedirectUrl({
+                    request_url: new URL(req.url),
+                    https_port,
+                }),
+                308,
+            );
+        },
+    });
+}