feat: configure HTTP/HTTPS public entry and managed certificates

backend/internal/service/openvpn/openvpn_test.go

@@ -144,7 +144,7 @@ func TestOIDCRejectsUnsafeURLs(t *testing.T) {
 		"auth_mode": "oidc", "oidc_issuer": "https://idp.example.com/realms/a",
 		"oidc_base_url": "https://login.example.com", "oidc_client_id": "vpn",
 	}
-	for _, value := range []string{"http://login.example.com", "https://login.example.com/extra", "https://user@login.example.com", "https://login.example.com/?code=abc"} {
+	for _, value := range []string{"https://login.example.com/extra", "https://user@login.example.com", "https://login.example.com/?code=abc", "ftp://login.example.com"} {
 		cfg := service.CloneConfig(base)
 		cfg["oidc_base_url"] = value
 		if _, err := New().Validate(cfg); err == nil {
@@ -154,6 +154,12 @@ func TestOIDCRejectsUnsafeURLs(t *testing.T) {
 	if _, err := New().Validate(base); err != nil {
 		t.Fatal(err)
 	}
+	httpBase := service.CloneConfig(base)
+	httpBase["oidc_base_url"] = "http://login.example.com:8080"
+	httpBase["oidc_issuer"] = "http://login.example.com:8080/id"
+	if _, err := New().Validate(httpBase); err != nil {
+		t.Fatalf("http public base must be allowed: %v", err)
+	}
 	base["auth_mode"] = "password"
 	base["oidc_client_secret"] = "must-not-survive"
 	cfg, err := New().Validate(base)