From 51243d8145a7e074631b55598826277596a45bf9 Mon Sep 17 00:00:00 2001
From: unkin-agent <agent@unkin.net>
Date: Thu, 13 Aug 2026 23:16:13 +1000
Subject: [PATCH] ghp: serve plain HTTP behind the gateway (fix redirect loop)

The traefik gateway terminates TLS for ghp.unkin.net and forwards
cleartext to the ghp Service port 80 -> container :8080. But :8080 was
GHP_SERVER_HTTP_LISTEN, ghp's http->https 308 REDIRECT listener, so ghp
bounced every request back to https, which the gateway forwarded to
:8080 again: an infinite ghp.unkin.net -> ghp.unkin.net 308 loop.

Per ghp source (internal/server/server.go Run/serveTLS/servePlain,
redirect.go), the app is served on either GHP_SERVER_LISTEN (plain, full
handler incl. mgmt UI + API) OR GHP_SERVER_HTTPS_LISTEN (own TLS) - it is
strictly either/or: any non-empty https_listen sets hasTLS and runs
serveTLS, in which GHP_SERVER_LISTEN is ignored and http_listen only ever
redirects. To serve cleartext on :8080 behind the TLS-terminating
gateway, ghp must run in plain mode:

- configmap: drop GHP_SERVER_HTTPS_LISTEN + GHP_SERVER_HTTP_LISTEN; set
  GHP_SERVER_LISTEN ":8080" so :8080 SERVES the app; add
  GHP_SERVER_TRUST_PROXY_HEADERS so ghp trusts the gateway's
  X-Forwarded-*/Forwarded for scheme/host.
- deployment + vmservicescrape: the metrics server only wraps TLS when
  hasTLS is true, so in plain mode it is cleartext - switch the /metrics
  probes and the scrape from HTTPS/https to HTTP/http.

Service, HTTPRoute and Gateway are unchanged.
---
 apps/base/ghp/configmap.yaml       | 16 ++++++++++++++--
 apps/base/ghp/deployment.yaml      | 10 ++++++++--
 apps/base/ghp/vmservicescrape.yaml |  8 +++-----
 3 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/apps/base/ghp/configmap.yaml b/apps/base/ghp/configmap.yaml
index ca0ae45..f9c30b1 100644
--- a/apps/base/ghp/configmap.yaml
+++ b/apps/base/ghp/configmap.yaml
@@ -6,9 +6,21 @@ metadata:
   namespace: ghp
 data:
   GHP_DATABASE_DRIVER: postgres
+  # ghp runs in plain-HTTP reverse-proxy mode: the traefik gateway terminates TLS
+  # for ghp.unkin.net and forwards cleartext to container :8080, where ghp SERVES
+  # the full app (mgmt UI + API) via GHP_SERVER_LISTEN.
+  #
+  # Do NOT set GHP_SERVER_HTTPS_LISTEN here. Any non-empty https_listen flips ghp
+  # into TLS-only mode (server.go Run(): hasTLS -> serveTLS): the app is served on
+  # :8443 and http_listen becomes a 308 http->https REDIRECT listener, while
+  # GHP_SERVER_LISTEN is ignored entirely. The gateway forwarding cleartext into
+  # that redirect listener on :8080 was the ghp.unkin.net -> ghp.unkin.net 308 loop.
+  #
   # nonroot cannot bind <1024; listen high and remap in the Service.
-  GHP_SERVER_HTTPS_LISTEN: ":8443"
-  GHP_SERVER_HTTP_LISTEN: ":8080"
+  GHP_SERVER_LISTEN: ":8080"
+  # Behind the TLS-terminating gateway: trust its X-Forwarded-* / Forwarded headers
+  # for scheme/host when generating absolute URLs (GHP_SERVER_BASE_URL is also set).
+  GHP_SERVER_TRUST_PROXY_HEADERS: "true"
   GHP_METRICS_LISTEN: ":9136"
   GHP_METRICS_ENABLED: "true"
   GHP_SERVER_BASE_URL: https://ghp.unkin.net
diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml
index 1a7f5b2..e4619b7 100644
--- a/apps/base/ghp/deployment.yaml
+++ b/apps/base/ghp/deployment.yaml
@@ -102,7 +102,10 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTPS
+              # Plain HTTP: ghp only serves metrics over TLS in TLS mode
+              # (hasTLS). In reverse-proxy/plain mode the metrics server is
+              # cleartext, so probe with HTTP.
+              scheme: HTTP
             initialDelaySeconds: 30
             periodSeconds: 30
             successThreshold: 1
@@ -112,7 +115,10 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTPS
+              # Plain HTTP: ghp only serves metrics over TLS in TLS mode
+              # (hasTLS). In reverse-proxy/plain mode the metrics server is
+              # cleartext, so probe with HTTP.
+              scheme: HTTP
             initialDelaySeconds: 10
             periodSeconds: 5
             successThreshold: 1
diff --git a/apps/base/ghp/vmservicescrape.yaml b/apps/base/ghp/vmservicescrape.yaml
index e5ca485..ea6a7a8 100644
--- a/apps/base/ghp/vmservicescrape.yaml
+++ b/apps/base/ghp/vmservicescrape.yaml
@@ -16,8 +16,6 @@ spec:
   endpoints:
     - port: metrics
       path: /metrics
-      scheme: https
-      # ghp serves metrics over TLS with an internal-CA cert; skip verification
-      # since the scrape targets a pod IP the cert SANs do not cover.
-      tlsConfig:
-        insecureSkipVerify: true
+      # ghp runs in plain reverse-proxy mode (no GHP_SERVER_HTTPS_LISTEN), so the
+      # metrics server is cleartext HTTP rather than TLS. Scrape over http.
+      scheme: http