From 08718d072cc081da66c76f3a9be3d5e45573409d Mon Sep 17 00:00:00 2001
From: riccardom <riccardomanfrin@gmail.com>
Date: Mon, 7 Sep 2026 11:38:53 +0200
Subject: [PATCH] [upload-server] Serve TLS when a certificate is configured

The clients refuse a plaintext upload service: they ask it for an upload URL and
then PUT the bundle to whatever comes back, so a plaintext hop exposes both. An
operator pointing their deployment at this server therefore needs it to speak
https, and until now it could only do so behind a separate terminator.

SERVER_CERT_FILE and SERVER_KEY_FILE switch it to ListenAndServeTLS. They must
be set together. Unset keeps the current plaintext listener, for a deployment
that does terminate TLS in front of it.
---
 upload-server/server/server.go | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/upload-server/server/server.go b/upload-server/server/server.go
index 29ef72732..5d057fa05 100644
--- a/upload-server/server/server.go
+++ b/upload-server/server/server.go
@@ -16,10 +16,21 @@ import (
 const (
 	putURLPath = "/upload"
 	bucketVar  = "BUCKET"
+
+	// certFileVar and keyFileVar enable TLS. A client refuses a plaintext
+	// upload service — it asks this server for an upload URL and then PUTs the
+	// bundle to whatever comes back, so a plaintext hop is a place to intercept
+	// both — which leaves an operator running this server needing TLS. Without
+	// these the server stays plaintext, for a deployment that terminates TLS in
+	// front of it.
+	certFileVar = "SERVER_CERT_FILE"
+	keyFileVar  = "SERVER_KEY_FILE"
 )
 
 type Server struct {
-	srv *http.Server
+	srv      *http.Server
+	certFile string
+	keyFile  string
 }
 
 func NewServer() *Server {
@@ -37,12 +48,25 @@ func NewServer() *Server {
 		http.Error(w, "not found", http.StatusNotFound)
 	})
 
+	certFile := os.Getenv(certFileVar)
+	keyFile := os.Getenv(keyFileVar)
+	if (certFile == "") != (keyFile == "") {
+		log.Fatalf("%s and %s must be set together", certFileVar, keyFileVar)
+	}
+
 	return &Server{
-		srv: &http.Server{Addr: address, Handler: mux},
+		srv:      &http.Server{Addr: address, Handler: mux},
+		certFile: certFile,
+		keyFile:  keyFile,
 	}
 }
 
 func (s *Server) Start() error {
+	if s.certFile != "" {
+		log.Infof("Starting upload server on %s with TLS", s.srv.Addr)
+		return s.srv.ListenAndServeTLS(s.certFile, s.keyFile)
+	}
+
 	log.Infof("Starting upload server on %s", s.srv.Addr)
 	return s.srv.ListenAndServe()
 }