feat(tls): add optional nginx setup and gateway preview

backend/internal/tlsservice/tlsservice_test.go

@@ -70,3 +70,17 @@ func TestFailedHTTPSBindReleasesHTTPPort(t *testing.T) {
 		t.Fatal("failed start reported active TLS")
 	}
 }
+
+func TestNginxModeDoesNotBindGoListeners(t *testing.T) {
+	t.Setenv("VPN_TLS_MODE", "nginx")
+	t.Setenv("VPN_TLS_DOMAIN", "test-link.appx365.com")
+	t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
+	t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
+	if err := Start(http.NotFoundHandler(), t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+	status := Status()
+	if status.Mode != "nginx" || status.Enabled || status.Domain != "" || status.ConfiguredDomain != "test-link.appx365.com" {
+		t.Fatalf("proxy mode must not claim Go listens: %+v", status)
+	}
+}