Add Ubuntu deployment: scripts, SSL, systemd and setup.sh

internal/auth/session.go

@@ -58,27 +58,36 @@ func (s *Session) Validate(token string) (string, bool) {
 	return email, true
 }
 
-func (s *Session) SetCookie(w http.ResponseWriter, token string) {
+func (s *Session) SetCookie(w http.ResponseWriter, r *http.Request, token string) {
 	http.SetCookie(w, &http.Cookie{
 		Name:     cookieName,
 		Value:    token,
 		Path:     "/admin",
 		HttpOnly: true,
+		Secure:   s.isSecure(r),
 		SameSite: http.SameSiteLaxMode,
 		MaxAge:   int(sessionTTL.Seconds()),
 	})
 }
 
-func (s *Session) ClearCookie(w http.ResponseWriter) {
+func (s *Session) ClearCookie(w http.ResponseWriter, r *http.Request) {
 	http.SetCookie(w, &http.Cookie{
 		Name:     cookieName,
 		Value:    "",
 		Path:     "/admin",
 		HttpOnly: true,
+		Secure:   s.isSecure(r),
 		MaxAge:   -1,
 	})
 }
 
+func (s *Session) isSecure(r *http.Request) bool {
+	if r.TLS != nil {
+		return true
+	}
+	return strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
+}
+
 func (s *Session) FromRequest(r *http.Request) (string, bool) {
 	c, err := r.Cookie(cookieName)
 	if err != nil {

internal/handlers/admin.go

@@ -81,12 +81,12 @@ func (h *AdminHandler) Login(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	h.session.SetCookie(w, token)
+	h.session.SetCookie(w, r, token)
 	http.Redirect(w, r, "/admin/", http.StatusSeeOther)
 }
 
 func (h *AdminHandler) Logout(w http.ResponseWriter, r *http.Request) {
-	h.session.ClearCookie(w)
+	h.session.ClearCookie(w, r)
 	http.Redirect(w, r, "/admin/login", http.StatusSeeOther)
 }
 

internal/middleware/proxy.go

@@ -0,0 +1,19 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+)
+
+// TrustProxy восстанавливает схему HTTPS за Caddy/nginx.
+func TrustProxy(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if proto := r.Header.Get("X-Forwarded-Proto"); strings.EqualFold(proto, "https") {
+			r.URL.Scheme = "https"
+		}
+		if host := r.Header.Get("X-Forwarded-Host"); host != "" {
+			r.Host = host
+		}
+		next.ServeHTTP(w, r)
+	})
+}