feat: add HTTPS support with auto-generated self-signed certificates #13

Merged

addison merged 20 commits from feat/add-https into main 2025-12-03 16:17:23 -05:00

Conversation 0 Commits 20 Files changed 12 +594 -29

addison commented 2025-11-29 13:05:39 -05:00

Owner

Copy link

• Server listens on port 443 (HTTPS) in production, port 8080 (HTTP) in dev
• Auto-generate TLS certificates during deployment based on TLS_DOMAIN config
• Certificates stored at /opt/kwila-office-automations/tls-{cert,key}.pem
• Dev mode auto-generates localhost certificate on first run
• Add export-cert justfile recipe for pulling cert to distribute to network admin
• Update ARCHITECTURE.md with TLS strategy
• Mark HTTPS task complete in MVP spec

- Server listens on port 443 (HTTPS) in production, port 8080 (HTTP) in dev - Auto-generate TLS certificates during deployment based on TLS_DOMAIN config - Certificates stored at /opt/kwila-office-automations/tls-{cert,key}.pem - Dev mode auto-generates localhost certificate on first run - Add export-cert justfile recipe for pulling cert to distribute to network admin - Update ARCHITECTURE.md with TLS strategy - Mark HTTPS task complete in MVP spec

addison added 1 commit 2025-11-29 13:05:39 -05:00

feat: add HTTPS support with auto-generated self-signed certificates ... 14f74c0238

- Server listens on port 443 (HTTPS) in production, port 8080 (HTTP) in dev
- Auto-generate TLS certificates during deployment based on TLS_DOMAIN config
- Certificates stored at /opt/kwila-office-automations/tls-{cert,key}.pem
- Dev mode auto-generates localhost certificate on first run
- Add export-cert justfile recipe for pulling cert to distribute to network admin
- Update ARCHITECTURE.md with TLS strategy
- Mark HTTPS task complete in MVP spec

addison changed title from feat: add HTTPS support with auto-generated self-signed certificates to WIP: feat: add HTTPS support with auto-generated self-signed certificates 2025-11-29 13:05:47 -05:00

addison added 1 commit 2025-11-29 17:36:45 -05:00

fix: address critical HTTPS implementation issues ... b2461272f5

- Fix dev mode certificate paths: use backend/.tls-* with TLS_CERT_PATH env var
- Make dev mode use HTTPS (port 8080) for dev/prod parity with clipboard API
- Add TLS_DOMAIN validation: required for production HTTPS deployments
- Add error handling for openssl certificate generation in deploy.sh and justfile
- Document port 443 requirements: service runs as root or needs CAP_NET_BIND_SERVICE
- Document service user permissions: certificates readable by root
- Update ARCHITECTURE.md: accurately describe dev/prod TLS behavior, explain port 443 requirements
- Fix justfile dev target to set TLS_CERT_PATH/TLS_KEY_PATH env vars

addison added 2 commits 2025-12-01 08:36:16 -05:00

chore: more review 22f11e4de2

chore: Merge branch 'main' into feat/add-https 88cff81305

addison added 4 commits 2025-12-01 08:37:46 -05:00

fix: resolve blocking HTTPS issues for production ... 147c3dd249

- Fix health checks to use HTTPS in deploy.sh and rollback.sh with -k flag
- Update .env.example to clarify TLS_DOMAIN is REQUIRED for deployments

improve: add HTTP server timeouts and explicit TLS configuration ... 2d27861936

- Add ReadTimeout (15s), WriteTimeout (15s), IdleTimeout (60s) to prevent DoS
- Set explicit TLS MinVersion to TLS 1.2 for security

improve: validate TLS certificate files exist at startup ... 187485707a

- Check certificate and key files exist before starting server
- Fail early with clear error if certificates are missing
- Prevents confusing failures from ListenAndServeTLS

docs: add comprehensive operations guide for certificate management ... dabf054286

- Document first deployment and certificate distribution
- Add certificate rotation procedures for compromised certs
- Explain domain changes and certificate expiration
- Include debugging guide for common HTTPS issues
- Document port 443 binding and setcap alternative
- Add development HTTPS testing instructions
- Include log monitoring and performance tuning info

addison added 1 commit 2025-12-03 15:24:10 -05:00

fix: ignore dev cert edfa7f2629

addison added 1 commit 2025-12-03 15:37:18 -05:00

chore: Merge branch 'main' into feat/add-https e9ac96e164

addison added 2 commits 2025-12-03 15:43:23 -05:00

chore: clean up 5ff6a28db6

feat: implement automatic HTTP to HTTPS redirect ... d7c4fc9589

- Add HTTP redirect server on port 80 for production HTTPS
- Automatically redirects all HTTP requests to HTTPS with 301 permanent redirect
- Only enabled in production (not in dev mode)
- Transparent upgrade path for users accessing via http://
- Update ARCHITECTURE.md to document redirect behavior

addison added 1 commit 2025-12-03 15:45:10 -05:00

refactor: improve HTTP redirect server error handling and cleanup ... 0bbcffe702

- Buffer error channel for both servers so no error is lost
- Redirect server errors now propagate to main error handling
- Consolidate shutdown logic into helper function
- Fix potential issue where redirect server errors were silently logged
- Document that both port 80 and 443 require root/CAP_NET_BIND_SERVICE

addison added 1 commit 2025-12-03 15:46:23 -05:00

refactor: use constants for default TLS certificate paths ... 0b68b0374f

- Define DefaultTLSCertPath and DefaultTLSKeyPath as constants
- Remove hardcoded paths from config loading and validation
- Single source of truth for production certificate locations

addison added 1 commit 2025-12-03 15:48:06 -05:00

fix: validate TLS_DOMAIN in deploy script before proceeding ... 607ff47ae3

- Exit early if TLS_DOMAIN is not set in .env file
- Prevents silent certificate generation failures
- Provides clear error message with remediation steps

addison added 1 commit 2025-12-03 15:51:34 -05:00

fix: improve deploy script validation and error messages ... ee2eee5d63

- Check that .env file exists before trying to read it
- Always extract TLS_DOMAIN (don't skip if missing)
- Use variable for env file path to avoid repetition
- Provide clear error messages for each failure case

addison added 1 commit 2025-12-03 15:53:43 -05:00

fix: handle grep failure when TLS_DOMAIN is missing ... 72c966d78e

- Use || echo "" to prevent grep exit code from killing the script
- Allows validation check below to catch the missing value gracefully

addison changed title from WIP: feat: add HTTPS support with auto-generated self-signed certificates to feat: add HTTPS support with auto-generated self-signed certificates 2025-12-03 16:07:06 -05:00

addison added 1 commit 2025-12-03 16:07:50 -05:00

chore: fix formatting bf131dc316

addison added 1 commit 2025-12-03 16:13:39 -05:00

fix: export-cert recipe now uses sudo to read certificate ... c9fd9cc2fd

- Certificate file is owned by root with 600 permissions
- Use ssh + sudo cat instead of scp to read the file
- Redirect output to local file instead of copying directly

addison added 1 commit 2025-12-03 16:15:11 -05:00

docs: clarify certificate export security and Windows installation ... 1d456422f8

- Emphasize that only public certificate is exported, never the private key
- Add detailed Windows certificate installation steps
- Clarify Local Machine vs Current User scope for domain-wide trust

addison merged commit d2ecded78c into main 2025-12-03 16:17:23 -05:00

addison deleted branch feat/add-https 2025-12-03 16:17:23 -05:00

addison referenced this pull request from a commit 2025-12-03 16:17:24 -05:00

feat: add HTTPS support with auto-generated self-signed certificates (#13)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

kwila/office-automations!13

No description provided.