feat: configure HTTP/HTTPS public entry and managed certificates

backend/internal/api/openvpn_oidc_readiness.go

@@ -39,12 +39,25 @@ func (s *Server) openvpnOIDCReadiness(c *gin.Context) {
 	}
 	tls := tlsservice.Status()
 	builtInIssuer, builtInClientID, builtInEnabled := identityprovider.PublicClient()
-	port, _ := authGatewayPort(tls.Domain)
+	port, _ := authGatewayPort(tls.PublicBase)
 	issuerRoute, callbackRoute := nginxgateway.AuthRouteReady(port)
+	scheme := tls.Scheme
+	if scheme == "" {
+		scheme = "https"
+	}
+	stage := nginxgateway.Stage()
+	managementReady := tls.Mode == "nginx" && tls.PublicBase != "" && tls.Domain != ""
+	if scheme == "https" {
+		managementReady = managementReady && tls.Valid && stage == "https"
+	} else {
+		managementReady = managementReady && stage != "none"
+	}
 	c.JSON(http.StatusOK, gin.H{
 		"component_installed": path != "", "component_version": version,
-		"https_management_ready":     tls.Mode == "nginx" && tls.Valid && nginxgateway.Stage() == "https",
+		"https_management_ready":     managementReady, // kept key for UI compat; true for ready http/https entry
+		"management_ready":           managementReady,
 		"management_domain":          tls.Domain,
+		"management_public_base":     tls.PublicBase,
 		"authentication_entry_ready": port > 0 && callbackRoute,
 		"built_in_issuer":            builtInIssuer, "built_in_client_id": builtInClientID,
 		"built_in_enabled": builtInEnabled, "built_in_gateway_ready": issuerRoute,