Make Nginx the default public gateway

backend/internal/tlsservice/tlsservice.go

@@ -174,7 +174,7 @@ func configFromEnvironment(dataDir string) (configuration, error) {
 		mode = raw
 	}
 	if mode == "" {
-		mode = "autocert"
+		mode = "nginx"
 	}
 	if mode != "autocert" && mode != "nginx" {
 		return configuration{}, fmt.Errorf("VPN_TLS_MODE 仅支持 autocert 或 nginx")

backend/internal/tlsservice/tlsservice_test.go

@@ -10,6 +10,7 @@ import (
 )
 
 func TestDomainValidationAndRestart(t *testing.T) {
+	t.Setenv("VPN_TLS_MODE", "autocert")
 	for _, domain := range []string{"test-link.appx365.com", "a.b"} {
 		if !ValidDomain(domain) {
 			t.Errorf("valid domain rejected: %s", domain)
@@ -73,6 +74,7 @@ func TestHTTPIPv4PublicEntry(t *testing.T) {
 }
 
 func TestFailedHTTPSBindReleasesHTTPPort(t *testing.T) {
+	t.Setenv("VPN_TLS_MODE", "autocert")
 	t.Setenv("VPN_TLS_DOMAIN", "test-link.appx365.com")
 	occupied, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
@@ -118,6 +120,30 @@ func TestNginxModeDoesNotBindGoListeners(t *testing.T) {
 	}
 }
 
+func TestDefaultModeIsNginxAndExplicitGoModeIsPreserved(t *testing.T) {
+	t.Setenv("VPN_TLS_MODE", "")
+	t.Setenv("VPN_TLS_DOMAIN", "")
+	t.Setenv("VPN_TLS_SCHEME", "")
+	t.Setenv("VPN_TLS_PORT", "")
+	dir := t.TempDir()
+	if err := ConfigurePublicEntry(dir, "https", "vpn.example.com", 443); err != nil {
+		t.Fatal(err)
+	}
+	if err := Start(http.NotFoundHandler(), dir); err != nil {
+		t.Fatal(err)
+	}
+	if got := Status(); got.Mode != "nginx" || got.Enabled || got.ConfiguredPublicBase != "https://vpn.example.com" {
+		t.Fatalf("default must keep the public listener under Nginx control: %+v", got)
+	}
+	if err := writePersisted(dir, "tls-mode", "autocert"); err != nil {
+		t.Fatal(err)
+	}
+	config, err := configFromEnvironment(dir)
+	if err != nil || config.mode != "autocert" {
+		t.Fatalf("explicit legacy mode must be readable: %+v, %v", config, err)
+	}
+}
+
 func TestNginxEntryCanAdoptWithoutRestart(t *testing.T) {
 	t.Setenv("VPN_TLS_MODE", "")
 	t.Setenv("VPN_TLS_DOMAIN", "")