update installation

internal/app/config.go

@@ -24,6 +24,7 @@ type Config struct {
 	GiteaWriteToken   string
 	AllowedGiteaUsers map[string]struct{}
 	CookieSecret      []byte
+	CookieSecure      bool
 	DefaultDuration   time.Duration
 	DefaultHostLimit  int
 	MaxHostLimit      int
@@ -50,14 +51,21 @@ func LoadConfig() (Config, error) {
 	cfg.GiteaWriteToken = os.Getenv("TAPM_GITEA_PACKAGE_WRITE_TOKEN")
 	cfg.CookieSecret = []byte(os.Getenv("TAPM_COOKIE_SECRET"))
 
-	cfg.PublicURL, err = parseAbsoluteURL("TAPM_PUBLIC_URL")
+	allowInsecureHTTP, err := strconv.ParseBool(
+		envDefault("TAPM_ALLOW_INSECURE_HTTP", "false"),
+	)
+	if err != nil {
+		return cfg, fmt.Errorf("TAPM_ALLOW_INSECURE_HTTP: %w", err)
+	}
+	cfg.PublicURL, err = parseAbsoluteURL("TAPM_PUBLIC_URL", allowInsecureHTTP)
 	if err != nil {
 		return cfg, err
 	}
-	cfg.GiteaURL, err = parseAbsoluteURL("TAPM_GITEA_URL")
+	cfg.GiteaURL, err = parseAbsoluteURL("TAPM_GITEA_URL", allowInsecureHTTP)
 	if err != nil {
 		return cfg, err
 	}
+	cfg.CookieSecure = cfg.PublicURL.Scheme == "https"
 
 	cfg.DefaultDuration, err = time.ParseDuration(
 		envDefault("TAPM_DEFAULT_DURATION", "3h"),
@@ -128,10 +136,17 @@ func LoadConfig() (Config, error) {
 	return cfg, nil
 }
 
-func parseAbsoluteURL(name string) (*url.URL, error) {
+func parseAbsoluteURL(name string, allowInsecureHTTP bool) (*url.URL, error) {
 	raw := os.Getenv(name)
 	parsed, err := url.Parse(raw)
-	if err != nil || parsed.Scheme != "https" || parsed.Host == "" {
+	validScheme := parsed != nil && parsed.Scheme == "https"
+	if allowInsecureHTTP && parsed != nil && parsed.Scheme == "http" {
+		validScheme = true
+	}
+	if err != nil || !validScheme || parsed.Host == "" {
+		if allowInsecureHTTP {
+			return nil, fmt.Errorf("%s must be an absolute HTTP or HTTPS URL", name)
+		}
 		return nil, fmt.Errorf("%s must be an absolute HTTPS URL", name)
 	}
 	return parsed, nil