Add HTTPS mode to setup wizard #957
Conversation
philipliu
temporarily deployed
to
Receiver Registration - E2E Integration Tests (Stellar)
GitHub Actions
Inactive
philipliu
temporarily deployed
to
Internal SEP Tests
GitHub Actions
Inactive
|
stellar-disbursement-platform-backend-preview is available here: |
philipliu
force-pushed
the
philip/https-wizard
branch
from
1ce8a46 to
52b4015
Compare
philipliu
temporarily deployed
to
Internal SEP Tests
GitHub Actions
Inactive
philipliu
temporarily deployed
to
Receiver Registration - E2E Integration Tests (Stellar)
GitHub Actions
Inactive
|
stellar-disbursement-platform-backend-preview is available here: |
philipliu
force-pushed
the
philip/https-wizard
branch
from
52b4015 to
ae43199
Compare
philipliu
temporarily deployed
to
Receiver Registration - E2E Integration Tests (Stellar)
GitHub Actions
Inactive
philipliu
temporarily deployed
to
Internal SEP Tests
GitHub Actions
Inactive
|
stellar-disbursement-platform-backend-preview is available here: |
There was a problem hiding this comment.
Pull request overview
This PR adds HTTPS support to the setup wizard for the Stellar Disbursement Platform. The feature enables developers to run the dashboard over HTTPS, which is required for WebAuthn/passkeys functionality in multi-tenant deployments. The HTTPS mode is configured at the .env file level, meaning once a profile is created with HTTPS, it cannot be switched to HTTP (and vice versa) without regenerating the configuration.
Key changes:
- Adds an HTTPS selection phase to the setup wizard workflow
- Configures docker-compose to conditionally include an nginx HTTPS proxy
- Updates configuration management to track HTTPS state and generate appropriate URLs
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/sdp-setup/internal/workflow/setup_workflow.go | Adds new phase for HTTPS selection in setup wizard, prompts user to choose between HTTP and HTTPS |
| tools/sdp-setup/internal/tenant/service.go | Updates tenant creation and login hints to use dynamic frontend URLs based on HTTPS configuration |
| tools/sdp-setup/internal/docker/service.go | Adds HTTPS certificate validation and conditionally includes HTTPS compose file when starting stack |
| tools/sdp-setup/internal/config/env.go | Adds USE_HTTPS config field, FrontendProtocol/Port tracking, and FrontendBaseURL helper method |
| dev/nginx-https.conf | New nginx reverse proxy configuration for HTTPS with TLS termination and HTTP->HTTPS redirect |
| dev/docker-compose-https-frontend.yml | New compose file that adds nginx proxy service listening on port 3443 for HTTPS access |
| dev/README.md | Documents HTTPS setup prerequisites including mkcert installation and certificate generation |
| CHANGELOG.md | Documents the new HTTPS mode feature in the Unreleased section |
| .gitignore | Ignores dev/certs/ directory containing locally generated TLS certificates |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
philipliu
force-pushed
the
philip/https-wizard
branch
from
ae43199 to
63ecb2d
Compare
philipliu
temporarily deployed
to
Receiver Registration - E2E Integration Tests (Stellar)
GitHub Actions
Inactive
philipliu
temporarily deployed
to
Internal SEP Tests
GitHub Actions
Inactive
|
stellar-disbursement-platform-backend-preview is available here: |
marwen-abid
left a comment
marwen-abid
left a comment
There was a problem hiding this comment.
LGTM! Tested successfully
🎉🎉🎉🎉 SUCCESS! 🎉🎉🎉🎉
Single tenant mode - Login URL:
🔗Default tenant: https://localhost:3443
username: [email protected] password: Password123!
| mkcert -key-file dev/certs/stellar.local-key.pem -cert-file dev/certs/stellar.local.pem \ | ||
| "*.stellar.local" localhost 127.0.0.1 ::1 | ||
| ``` | ||
| 3. When the setup wizard asks, choose HTTPS. |
What
This adds an HTTPS mode to the setup wizard. The protocol is set at the .env level, meaning a profile created with HTTPS cannot be used over HTTP later, and vice versa.
Why
HTTPS is required to work with passkeys in a multitenant setup. It's been implemented in the
feature/c-accountsbranch in thedev/main.shscript, but needs to be ported to the setup wizard.Known limitations
N/A
Checklist
SDP-1234: Add new featureorChore: Refactor package xyzformat. The Jira ticket code was included if available.CHANGELOG.mdis updated (if applicable)