furtka/furtka
Daniel Maksymilian Syrnicki 2468cb3ded fix(https): redirect only the certificate's hostnames, with 302
The force-HTTPS snippet was 'redir https://{host}{uri} permanent':
- every Host was redirected, including a bare IP that the tls-internal
  block has no certificate for — devices reaching the box by IP (no mDNS
  on Android / older Windows, the console IP fallback) couldn't load the
  UI at all
- 301 is cached by browsers, so switching HTTPS off kept bouncing them to
  a dead :443

Now a host matcher limits the redirect to <hostname>.local and <hostname>
and it's a 302. Self-update rewrites the old snippet if it is still the
untouched legacy content. Browsers that already cached the old 301 keep it
until their cache is cleared.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wq1hzUp4ZmCKHDuLKCnu73
2026-09-28 14:21:14 +02:00
..
__init__.py feat(furtka): resource-manager skeleton — manifest, scanner, CLI 2026-04-15 09:59:41 +02:00
_release_common.py fix(install,catalog): recover from interrupted installs, don't strand sync on network/disk errors 2026-09-28 13:15:10 +02:00
api.py fix(install,catalog): recover from interrupted installs, don't strand sync on network/disk errors 2026-09-28 13:15:10 +02:00
auth.py fix(updater,auth): atomic symlink flip, roll back on any failure, fail closed on a damaged users.json 2026-09-28 13:11:42 +02:00
catalog.py fix(install,catalog): recover from interrupted installs, don't strand sync on network/disk errors 2026-09-28 13:15:10 +02:00
cli.py fix(cli): fire on_install hooks on named CLI installs 2026-06-28 13:03:33 +02:00
deps.py chore: ruff format 2026-05-11 20:10:04 +02:00
dockerops.py chore: ruff format 2026-05-11 20:10:04 +02:00
https.py fix(https): redirect only the certificate's hostnames, with 302 2026-09-28 14:21:14 +02:00
install_runner.py fix(install,catalog): recover from interrupted installs, don't strand sync on network/disk errors 2026-09-28 13:15:10 +02:00
installer.py fix(api): refuse path-like app names, validate settings before writing .env, harden the HTTP server 2026-09-28 13:04:09 +02:00
manifest.py fix(api): refuse path-like app names, validate settings before writing .env, harden the HTTP server 2026-09-28 13:04:09 +02:00
passwd.py fix: unbreak upgrade path + install-lock race 2026-04-21 17:03:28 +02:00
paths.py fix: auth-guard / and /settings, add Logout link to static navs 2026-04-21 18:16:42 +02:00
reconciler.py fix(deps): give on_start hooks the consumer's stored credentials 2026-05-28 23:45:42 +02:00
scanner.py fix(furtka): audit follow-ups — placeholder secrets, isolate reconcile, .env perms 2026-04-15 10:17:00 +02:00
sources.py feat(catalog): on-box apps catalog synced independently of core version 2026-04-20 14:16:02 +02:00
updater.py fix(https): redirect only the certificate's hostnames, with 302 2026-09-28 14:21:14 +02:00