feat: configure HTTP/HTTPS public entry and managed certificates

backend/internal/identityprovider/provider.go

@@ -96,8 +96,15 @@ func SecureGateway() gin.HandlerFunc {
 			return
 		}
 		peer, _, err := net.SplitHostPort(c.Request.RemoteAddr)
-		if err == nil && net.ParseIP(peer) != nil && net.ParseIP(peer).IsLoopback() && c.GetHeader("X-Forwarded-Proto") == "https" {
-			return
+		if err == nil && net.ParseIP(peer) != nil && net.ParseIP(peer).IsLoopback() {
+			proto := c.GetHeader("X-Forwarded-Proto")
+			scheme := tlsservice.Status().Scheme
+			if scheme == "" {
+				scheme = "https"
+			}
+			if proto == scheme {
+				return
+			}
 		}
 		c.AbortWithStatus(http.StatusForbidden)
 	}
@@ -116,10 +123,17 @@ func init() {
 
 func issuer() (string, error) {
 	status := tlsservice.Status()
-	if !status.Valid || status.RestartRequired || status.Domain == "" {
+	if status.RestartRequired || status.Domain == "" || status.PublicBase == "" {
+		return "", errors.New("需要先配置并启用公网入口")
+	}
+	scheme := status.Scheme
+	if scheme == "" {
+		scheme = "https"
+	}
+	if scheme == "https" && !status.Valid {
 		return "", errors.New("需要先启用并验证公网 HTTPS 域名")
 	}
-	return "https://" + status.Domain + "/id", nil
+	return status.PublicBase + "/id", nil
 }
 
 func current() (model.IdentityProvider, error) {
@@ -250,8 +264,9 @@ func signingKey() (*rsa.PrivateKey, string, error) {
 	return key, base64.RawURLEncoding.EncodeToString(sum[:8]), nil
 }
 
-func validateRedirect(raw, domain string) bool {
-	return raw == "https://"+domain+"/oauth2/callback"
+func validateRedirect(raw, publicBase string) bool {
+	publicBase = strings.TrimRight(strings.TrimSpace(publicBase), "/")
+	return publicBase != "" && raw == publicBase+"/oauth2/callback"
 }
 
 func validTenant(value string) bool {