From aef46cb9a4793a16b0cb69703538d1f5aaa3e63b Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Fri, 16 Oct 2026 09:51:47 -0700
Subject: Redirect HTTP to HTTPS

---
 roseh.moe.go | 60 +++++++++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 45 insertions(+), 15 deletions(-)

diff --git a/roseh.moe.go b/roseh.moe.go
index 9a0d548..6ad701f 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -63,15 +63,16 @@ import (
 )
 
 var (
-	selfURL     = urlFlag("url", "http://localhost:42069", "base URL of the server")
-	secretsFile = flag.String("secrets", "secrets.xml", "secrets file")
-	configFile  = flag.String("config", "config.xml", "configuration file (XML, baby!!)")
-	https       = flag.String("https", "", "directory containing cert.pem and key.pem, or empty string to use unencrypted http")
-	holeTempDir = flag.String("hole-temp-dir", "/tmp/hole", "directory to store temporary files for the wormhole")
-	nezuko      = flag.String("nezuko", "/mnt/nezuko", "nezuko partition")
-	cgit        = flag.String("cgit", "", "directory containing cgit.cgi")
-	cgitConfig  = flag.String("cgit-config", "", "cgit config file")
-	v           = flag.Bool("v", true, "verbose")
+	selfURL      = urlFlag("url", "http://localhost:42069", "base URL of the server")
+	secretsFile  = flag.String("secrets", "secrets.xml", "secrets file")
+	configFile   = flag.String("config", "config.xml", "configuration file (XML, baby!!)")
+	https        = flag.String("https", "", "directory containing cert.pem and key.pem, or empty string to use unencrypted http")
+	httpRedirect = flag.String("http-redirect", "", "port to serve HTTP redirect")
+	holeTempDir  = flag.String("hole-temp-dir", "/tmp/hole", "directory to store temporary files for the wormhole")
+	nezuko       = flag.String("nezuko", "/mnt/nezuko", "nezuko partition")
+	cgit         = flag.String("cgit", "", "directory containing cgit.cgi")
+	cgitConfig   = flag.String("cgit-config", "", "cgit config file")
+	v            = flag.Bool("v", true, "verbose")
 )
 
 type urlValue struct {
@@ -1137,7 +1138,9 @@ type loggingHandler struct {
 }
 
 func (h *loggingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	log.Printf("%q from %q", r.Method+" "+r.Host+r.URL.String(), r.RemoteAddr)
+	if *v {
+		log.Printf("%q from %q", r.Method+" "+r.Host+r.URL.String(), r.RemoteAddr)
+	}
 	h.h.ServeHTTP(w, r)
 }
 
@@ -1245,17 +1248,44 @@ func main() {
 	cgitCGI.PathLocationHandler = cgitCGI
 	codeMux.Handle("/", &timeoutHandler{h: cgitCGI, timeout: 5 * time.Minute})
 	serverMux.Handle("code."+selfURL.Hostname()+"/", &gzipHandler{codeMux})
-	var handler http.Handler = serverMux
-	if *v {
-		handler = &loggingHandler{serverMux}
-	}
 	server := &http.Server{
-		Handler: handler,
+		Handler: &loggingHandler{serverMux},
 
 		ReadHeaderTimeout: 5 * time.Minute,
 		IdleTimeout:       10 * time.Minute,
 	}
 
+	if *httpRedirect != "" {
+		go func() {
+			mux := http.NewServeMux()
+			mux.Handle("GET /.well-known/acme-challenge/", &timeoutHandler{
+				h:       http.FileServer(http.Dir("/var/lib/acme/acme-challenge")),
+				timeout: 5 * time.Minute,
+			})
+			mux.Handle("/", &timeoutHandler{
+				h: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					u := *r.URL
+					u.Scheme = selfURL.Scheme
+					u.Host, _, _ = strings.Cut(r.Host, ":")
+					if port := selfURL.Port(); port != "" {
+						u.Host += ":" + port
+					}
+					http.Redirect(w, r, u.String(), http.StatusMovedPermanently)
+				}),
+				timeout: time.Minute,
+			})
+			httpSrv := &http.Server{
+				Addr:              ":" + *httpRedirect,
+				Handler:           &loggingHandler{mux},
+				ReadHeaderTimeout: 5 * time.Minute,
+				IdleTimeout:       10 * time.Minute,
+			}
+			log.Printf("Serving HTTP redirect on %q", httpSrv.Addr)
+			err := httpSrv.ListenAndServe()
+			log.Printf("Error: HTTP redirect failed: %s", err)
+		}()
+	}
+
 	port := selfURL.Port()
 	if port == "" {
 		port = "80"
-- 
cgit v1.3.1