some notes on https support

Author: CamDavidsonPilon

packaging/README.md

@@ -15,3 +15,9 @@ This directory contains files used to build or install Pioreactor outside the no
 ## Ownership Boundary
 
 The Pioreactor repo owns these files because they describe the Pioreactor application runtime contract. CustoPiZer consumes selected files from here when building Raspberry Pi images, but CustoPiZer still owns Raspberry Pi image-specific boot, hardware, networking, service ordering, and firstboot behavior.
+
+## WIP Local HTTPS Support
+
+The runtime lighttpd assets include early, disabled support for serving the browser UI over local HTTPS. `runtime-files/lighttpd/10-pioreactor-https.conf` is copied into image and installer inputs, but it is not enabled by default. It expects a generated local certificate bundle at `/etc/pioreactor/tls/local-ui.lighttpd.pem` and proxies `/mqtt` to the existing Mosquitto websocket listener on `127.0.0.1:9001` so an HTTPS-loaded browser can use same-origin WSS.
+
+This is infrastructure for a future opt-in setup flow, not production HTTPS-by-default. Do not change `config.example.ini` to `wss` / `443`, enable the lighttpd HTTPS config, add HTTP-to-HTTPS redirects, or add HSTS until the local CA generation, browser trust onboarding, certificate regeneration, and rollback behavior are productized.

packaging/linux-leader/install.sh

@@ -122,9 +122,11 @@ install_apt_dependencies() {
     git \
     jq \
     lighttpd \
+    lighttpd-mod-openssl \
     logrotate \
     mosquitto \
     mosquitto-clients \
+    openssl \
     openssh-client \
     python3 \
     python3-dev \
@@ -265,6 +267,7 @@ install_system_files() {
   install -d -o root -g root -m 0755 /etc/lighttpd/conf-available
   install -m 0644 "$RUNTIME_FILES_DIR/lighttpd/lighttpd.conf" /etc/lighttpd/lighttpd.conf
   sed -i "s/server.port                 = 80/server.port                 = $UI_PORT/" /etc/lighttpd/lighttpd.conf
+  install -m 0644 "$RUNTIME_FILES_DIR/lighttpd"/10-pioreactor-https.conf /etc/lighttpd/conf-available/
   install -m 0644 "$RUNTIME_FILES_DIR/lighttpd"/10-expire.conf /etc/lighttpd/conf-available/
   install -m 0644 "$RUNTIME_FILES_DIR/lighttpd"/50-pioreactorui.conf /etc/lighttpd/conf-available/
   install -m 0644 "$RUNTIME_FILES_DIR/lighttpd"/51-cors.conf /etc/lighttpd/conf-available/

packaging/runtime-files/lighttpd/10-pioreactor-https.conf

@@ -0,0 +1,18 @@
+# Optional local HTTPS listener for Pioreactor UI.
+#
+# This file is intentionally not enabled by default. Generate
+# /etc/pioreactor/tls/local-ui.lighttpd.pem before enabling this config.
+
+server.modules += ( "mod_openssl" )
+ssl.pemfile = "/etc/pioreactor/tls/local-ui.lighttpd.pem"
+
+$SERVER["socket"] == "0.0.0.0:443" {
+  ssl.engine = "enable"
+}
+include_shell "/usr/share/lighttpd/use-ipv6.pl 443"
+
+# Keep browser MQTT same-origin when the UI is loaded over HTTPS.
+$HTTP["url"] =~ "^/mqtt" {
+  proxy.header = ( "upgrade" => "enable" )
+  proxy.server = ( "" => ( ( "host" => "127.0.0.1", "port" => 9001 ) ) )
+}

packaging/runtime-files/lighttpd/lighttpd.conf

@@ -5,6 +5,7 @@ server.modules = (
     "mod_alias",
     "mod_redirect",
     "mod_fastcgi",
+    "mod_proxy",
     "mod_staticfile",
 )