update installation

internal/app/auth.go

@@ -39,7 +39,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		Path:     "/auth",
 		MaxAge:   600,
 		HttpOnly: true,
-		Secure:   true,
+		Secure:   s.cfg.CookieSecure,
 		SameSite: http.SameSiteLaxMode,
 	})
 
@@ -78,7 +78,7 @@ func (s *Server) handleCallback(w http.ResponseWriter, r *http.Request) {
 		Path:     "/auth",
 		MaxAge:   -1,
 		HttpOnly: true,
-		Secure:   true,
+		Secure:   s.cfg.CookieSecure,
 		SameSite: http.SameSiteLaxMode,
 	})
 
@@ -134,7 +134,7 @@ func (s *Server) handleCallback(w http.ResponseWriter, r *http.Request) {
 		Expires:  expiresAt,
 		MaxAge:   int(time.Until(expiresAt).Seconds()),
 		HttpOnly: true,
-		Secure:   true,
+		Secure:   s.cfg.CookieSecure,
 		SameSite: http.SameSiteLaxMode,
 	})
 	_ = s.audit(r.Context(), "login_succeeded", user.Login, nil, "", "", s.clientIP(r), "")
@@ -280,7 +280,7 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 		Path:     "/",
 		MaxAge:   -1,
 		HttpOnly: true,
-		Secure:   true,
+		Secure:   s.cfg.CookieSecure,
 		SameSite: http.SameSiteLaxMode,
 	})
 	http.Redirect(w, r, "/", http.StatusSeeOther)

internal/app/config.go

@@ -24,6 +24,7 @@ type Config struct {
 	GiteaWriteToken   string
 	AllowedGiteaUsers map[string]struct{}
 	CookieSecret      []byte
+	CookieSecure      bool
 	DefaultDuration   time.Duration
 	DefaultHostLimit  int
 	MaxHostLimit      int
@@ -50,14 +51,21 @@ func LoadConfig() (Config, error) {
 	cfg.GiteaWriteToken = os.Getenv("TAPM_GITEA_PACKAGE_WRITE_TOKEN")
 	cfg.CookieSecret = []byte(os.Getenv("TAPM_COOKIE_SECRET"))
 
-	cfg.PublicURL, err = parseAbsoluteURL("TAPM_PUBLIC_URL")
+	allowInsecureHTTP, err := strconv.ParseBool(
+		envDefault("TAPM_ALLOW_INSECURE_HTTP", "false"),
+	)
+	if err != nil {
+		return cfg, fmt.Errorf("TAPM_ALLOW_INSECURE_HTTP: %w", err)
+	}
+	cfg.PublicURL, err = parseAbsoluteURL("TAPM_PUBLIC_URL", allowInsecureHTTP)
 	if err != nil {
 		return cfg, err
 	}
-	cfg.GiteaURL, err = parseAbsoluteURL("TAPM_GITEA_URL")
+	cfg.GiteaURL, err = parseAbsoluteURL("TAPM_GITEA_URL", allowInsecureHTTP)
 	if err != nil {
 		return cfg, err
 	}
+	cfg.CookieSecure = cfg.PublicURL.Scheme == "https"
 
 	cfg.DefaultDuration, err = time.ParseDuration(
 		envDefault("TAPM_DEFAULT_DURATION", "3h"),
@@ -128,10 +136,17 @@ func LoadConfig() (Config, error) {
 	return cfg, nil
 }
 
-func parseAbsoluteURL(name string) (*url.URL, error) {
+func parseAbsoluteURL(name string, allowInsecureHTTP bool) (*url.URL, error) {
 	raw := os.Getenv(name)
 	parsed, err := url.Parse(raw)
-	if err != nil || parsed.Scheme != "https" || parsed.Host == "" {
+	validScheme := parsed != nil && parsed.Scheme == "https"
+	if allowInsecureHTTP && parsed != nil && parsed.Scheme == "http" {
+		validScheme = true
+	}
+	if err != nil || !validScheme || parsed.Host == "" {
+		if allowInsecureHTTP {
+			return nil, fmt.Errorf("%s must be an absolute HTTP or HTTPS URL", name)
+		}
 		return nil, fmt.Errorf("%s must be an absolute HTTPS URL", name)
 	}
 	return parsed, nil

internal/app/config_test.go

@@ -0,0 +1,50 @@
+package app
+
+import (
+	"strings"
+	"testing"
+)
+
+func setRequiredConfigEnvironment(t *testing.T, scheme string) {
+	t.Helper()
+	t.Setenv("TAPM_PUBLIC_URL", scheme+"://broker.example.com")
+	t.Setenv("TAPM_GITEA_URL", scheme+"://git.example.com")
+	t.Setenv("TAPM_GITEA_CLIENT_ID", "client-id")
+	t.Setenv("TAPM_GITEA_CLIENT_SECRET", "client-secret")
+	t.Setenv("TAPM_GITEA_PACKAGE_USERNAME", "reader")
+	t.Setenv("TAPM_GITEA_PACKAGE_TOKEN", "reader-token")
+	t.Setenv("TAPM_GITEA_PACKAGE_WRITE_USERNAME", "writer")
+	t.Setenv("TAPM_GITEA_PACKAGE_WRITE_TOKEN", "writer-token")
+	t.Setenv("TAPM_COOKIE_SECRET", "0123456789abcdef0123456789abcdef")
+}
+
+func TestConfigRejectsHTTPByDefault(t *testing.T) {
+	setRequiredConfigEnvironment(t, "http")
+	_, err := LoadConfig()
+	if err == nil || !strings.Contains(err.Error(), "absolute HTTPS URL") {
+		t.Fatalf("LoadConfig() error = %v, want HTTPS requirement", err)
+	}
+}
+
+func TestConfigAllowsExplicitHTTPTestingMode(t *testing.T) {
+	setRequiredConfigEnvironment(t, "http")
+	t.Setenv("TAPM_ALLOW_INSECURE_HTTP", "true")
+	cfg, err := LoadConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.CookieSecure {
+		t.Fatal("HTTP testing mode unexpectedly enabled secure cookies")
+	}
+}
+
+func TestHTTPSConfigUsesSecureCookies(t *testing.T) {
+	setRequiredConfigEnvironment(t, "https")
+	cfg, err := LoadConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !cfg.CookieSecure {
+		t.Fatal("HTTPS mode did not enable secure cookies")
+	}
+}