Make Nginx the default public gateway

backend/internal/api/tls_test.go

@@ -1,12 +1,14 @@
 package api
 
 import (
+	"bytes"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
 	"github.com/gin-gonic/gin"
+	"vpn-platform/backend/internal/tlsservice"
 )
 
 func TestTLSStatusRequiresAdmin(t *testing.T) {
@@ -47,3 +49,21 @@ func TestTLSStatusRequiresAdmin(t *testing.T) {
 		}
 	}
 }
+
+func TestLegacyGoGatewayRejectsPublicEntryChanges(t *testing.T) {
+	t.Setenv("VPN_TLS_MODE", "autocert")
+	t.Setenv("VPN_TLS_DOMAIN", "")
+	if err := tlsservice.Start(http.NotFoundHandler(), t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.PUT("/api/system/tls/domain", (&Server{}).setTLSDomain)
+	request := httptest.NewRequest(http.MethodPut, "/api/system/tls/domain", bytes.NewBufferString(`{"domain":"other.example.com","scheme":"https","port":443}`))
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	if response.Code != http.StatusConflict {
+		t.Fatalf("legacy Go mode should require manual migration: %d %s", response.Code, response.Body.String())
+	}
+}