Make Nginx the default public gateway

backend/internal/api/tls.go

@@ -27,7 +27,7 @@ func (s *Server) nginxSetupStatus(c *gin.Context) {
 func (s *Server) activateNginx(c *gin.Context) {
 	status := tlsservice.Status()
 	if status.Mode != "nginx" || status.ConfiguredMode != "nginx" || status.ConfiguredDomain == "" {
-		c.JSON(http.StatusPreconditionFailed, gin.H{"error": "请先启用 Nginx 模式并保存公网入口；切换入口模式需重启 opsx-vpn"})
+		c.JSON(http.StatusPreconditionFailed, gin.H{"error": "请先完成旧入口迁移并保存 Nginx 公网入口"})
 		return
 	}
 	scheme := status.ConfiguredScheme
@@ -127,27 +127,10 @@ func (s *Server) nginxPreview(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{
 		"http_site": httpSite, "https_site": httpsSite,
 		"public_base": status.ConfiguredPublicBase,
-		"warning":     "仅预览：保存并重启后按协议启用入口；认证域名须单独配置。",
+		"warning":     "仅预览：首次启用站点需手动执行，已启用的 Nginx 入口保存后热重载。",
 	})
 }
 
-func (s *Server) setTLSMode(c *gin.Context) {
-	var req struct {
-		Mode string `json:"mode"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "请输入入口模式"})
-		return
-	}
-	if err := tlsservice.ConfigureMode(service.BaseDir(), req.Mode); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	store.Audit(c.GetString("username"), "tls_mode_configured", req.Mode, "需检查外部入口后重启")
-	status := tlsservice.Status()
-	c.JSON(http.StatusOK, gin.H{"status": status, "restart_required": status.RestartRequired})
-}
-
 func (s *Server) setTLSDomain(c *gin.Context) {
 	var req struct {
 		Domain string `json:"domain"`
@@ -167,6 +150,10 @@ func (s *Server) setTLSDomain(c *gin.Context) {
 		port = *req.Port
 	}
 	status := tlsservice.Status()
+	if status.Mode != "nginx" || status.ConfiguredMode != "nginx" {
+		c.JSON(http.StatusConflict, gin.H{"error": "当前使用旧 Go 直监听入口，请按部署文档迁移至 Nginx 后再修改公网入口"})
+		return
+	}
 	newBase := tlsservice.PublicBaseURL(scheme, strings.ToLower(strings.TrimSpace(req.Domain)), port)
 	if newBase == "" || port < 0 || port > 65535 {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "公网地址、协议或端口无效；IPv4 地址仅支持 HTTP"})