feat: configure HTTP/HTTPS public entry and managed certificates

backend/internal/tlsservice/tlsservice_test.go

@@ -88,3 +88,84 @@ func TestNginxModeDoesNotBindGoListeners(t *testing.T) {
 		t.Fatal("loopback management listener must not be marked public")
 	}
 }
+
+func TestPublicBaseURL(t *testing.T) {
+	cases := []struct {
+		scheme, host string
+		port         int
+		want         string
+	}{
+		{"https", "vpn.example.com", 0, "https://vpn.example.com"},
+		{"https", "vpn.example.com", 443, "https://vpn.example.com"},
+		{"https", "vpn.example.com", 8443, "https://vpn.example.com:8443"},
+		{"http", "vpn.example.com", 0, "http://vpn.example.com"},
+		{"http", "vpn.example.com", 80, "http://vpn.example.com"},
+		{"http", "vpn.example.com", 8080, "http://vpn.example.com:8080"},
+		{"HTTP", "VPN.Example.Com", 8080, "http://vpn.example.com:8080"},
+		{"https", "", 443, ""},
+		{"ftp", "vpn.example.com", 0, ""},
+	}
+	for _, tc := range cases {
+		got := PublicBaseURL(tc.scheme, tc.host, tc.port)
+		if got != tc.want {
+			t.Fatalf("PublicBaseURL(%q,%q,%d)=%q want %q", tc.scheme, tc.host, tc.port, got, tc.want)
+		}
+	}
+}
+
+func TestConfigurePublicEntryHTTPAndCustomPort(t *testing.T) {
+	t.Setenv("VPN_TLS_DOMAIN", "")
+	t.Setenv("VPN_TLS_SCHEME", "")
+	t.Setenv("VPN_TLS_PORT", "")
+	t.Setenv("VPN_TLS_MODE", "")
+	dir := t.TempDir()
+	if err := ConfigureMode(dir, "nginx"); err != nil {
+		t.Fatal(err)
+	}
+	if err := ConfigurePublicEntry(dir, "http", "vpn.example.com", 8080); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
+	t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
+	if err := Start(http.NotFoundHandler(), dir); err != nil {
+		t.Fatal(err)
+	}
+	status := Status()
+	if status.Scheme != "http" || status.Domain != "vpn.example.com" || status.Port != 8080 {
+		t.Fatalf("unexpected status fields: %+v", status)
+	}
+	if status.PublicBase != "http://vpn.example.com:8080" {
+		t.Fatalf("public_base = %q", status.PublicBase)
+	}
+	if status.Valid {
+		t.Fatal("http entry must not require certificate Valid")
+	}
+	if status.ConfiguredPublicBase != "http://vpn.example.com:8080" {
+		t.Fatalf("configured_public_base = %q", status.ConfiguredPublicBase)
+	}
+}
+
+func TestConfigurePublicEntryHTTPSOmitsDefaultPort(t *testing.T) {
+	t.Setenv("VPN_TLS_DOMAIN", "")
+	t.Setenv("VPN_TLS_SCHEME", "")
+	t.Setenv("VPN_TLS_PORT", "")
+	t.Setenv("VPN_TLS_MODE", "nginx")
+	dir := t.TempDir()
+	if err := ConfigurePublicEntry(dir, "https", "vpn.example.com", 443); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
+	t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
+	if err := Start(http.NotFoundHandler(), dir); err != nil {
+		t.Fatal(err)
+	}
+	// Without a leaf cert, https nginx Domain stays empty; configured base still omits :443.
+	status := Status()
+	if status.ConfiguredPublicBase != "https://vpn.example.com" {
+		t.Fatalf("configured_public_base = %q", status.ConfiguredPublicBase)
+	}
+	if status.ConfiguredPort != 443 && status.ConfiguredPort != 0 {
+		// persisted 443 is fine; EffectivePort still omits in PublicBaseURL
+		t.Logf("configured port = %d", status.ConfiguredPort)
+	}
+}