RC-9

.env.example

@@ -15,7 +15,8 @@ JWT_SECRET=replace-with-at-least-32-random-characters
 ADMIN_USER=admin
 ADMIN_PASSWORD=replace-with-a-strong-unique-password
 # Admin session cookies are Secure by default. Set false only for local HTTP dev.
-ADMIN_COOKIE_SECURE=true
+# Public/proxied HTTPS: true. VPN-only direct HTTP admin: auto.
+ADMIN_COOKIE_SECURE=auto
 # ALLOW_INSECURE_DEV_DEFAULTS=1
 
 # WebSocket hardening. Same-origin browser WebSockets work automatically. Add
@@ -115,7 +116,11 @@ CS_HTTP_ADDR=:8090
 CS_ADMIN_HTTP_ADDR=:8091
 CS_INTERNAL_ADDR=:8092
 CS_PUBLIC_BASE_URL=https://customers.example.com
+# Public customer portal stays HTTPS-only.
 CS_COOKIE_SECURE=true
+# Private Customer-Service admin (:8091): auto uses Secure over HTTPS and
+# non-Secure when accessed directly over an encrypted VPN via HTTP.
+CS_ADMIN_COOKIE_SECURE=auto
 CS_SESSION_TTL=24h
 CS_ADMIN_USER=admin
 CS_ADMIN_PASSWORD=replace-with-another-strong-unique-password