feat: configure HTTP/HTTPS public entry and managed certificates

backend/internal/nginxconfig/nginxconfig_test.go

@@ -91,3 +91,39 @@ func TestRenderIdentityAndSingleAuthPort(t *testing.T) {
 		t.Fatal("auth component exposed without a configured port")
 	}
 }
+
+func TestRenderHTTPCustomPort(t *testing.T) {
+	routes := gin.RoutesInfo{{Method: "GET", Path: "/api/health"}}
+	httpSite, httpsSite, err := RenderWithOptions(RenderOptions{Domain: "vpn.example.com", Scheme: "http", Port: 8080}, routes, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if httpsSite != "" {
+		t.Fatalf("http scheme must not render https site, got %d bytes", len(httpsSite))
+	}
+	for _, fragment := range []string{"listen 8080;", "server_name vpn.example.com;", "X-Forwarded-Proto http;", "location = /api/health"} {
+		if !strings.Contains(httpSite, fragment) {
+			t.Errorf("missing HTTP rule %q in:\n%s", fragment, httpSite)
+		}
+	}
+	if strings.Contains(httpSite, "acme-challenge") {
+		t.Fatal("http entry must not include ACME challenge location")
+	}
+}
+
+func TestRenderHTTPSCustomPort(t *testing.T) {
+	routes := gin.RoutesInfo{{Method: "GET", Path: "/api/health"}}
+	httpSite, httpsSite, err := RenderWithOptions(RenderOptions{Domain: "vpn.example.com", Scheme: "https", Port: 8443}, routes, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(httpSite, "listen 80;") || !strings.Contains(httpSite, "acme-challenge") {
+		t.Fatalf("https custom port must keep :80 ACME http site:\n%s", httpSite)
+	}
+	if !strings.Contains(httpsSite, "listen 8443 ssl;") {
+		t.Fatalf("https custom port listen missing:\n%s", httpsSite)
+	}
+	if !strings.Contains(httpsSite, "X-Forwarded-Proto https;") {
+		t.Fatal("missing forwarded proto https")
+	}
+}