opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: enable TLS when WebAppURL is manually configured as HTTPS

Browse source 
The TLS certificate fetch was coupled inside the auto-detection block,
so a manually configured https:// WebAppURL would skip cert loading
entirely, causing the server to serve plain HTTP while Telegram
expected HTTPS — resulting in a blank Mini App.

Split URL resolution and TLS setup into separate steps so that any
https:// URL (auto-detected or configured) triggers cert loading.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
dj-oyu 2026-03-14 19:58:03 +09:00
parent dd8c3db2cf
commit dbd9599913
1 changed files with 15 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
cmd/picoclaw/internal/gateway/helpers.go
View file

@ -274,7 +274,7 @@ func setupAndStartServices(
if cfg.Channels.Telegram.Enabled {
webAppURL := cfg.Channels.Telegram.WebAppURL
if webAppURL == "" {
// Auto-detect Tailscale hostname and fetch TLS cert
// Auto-detect Tailscale hostname and build the WebAppURL
hostname, tsErr := tailscale.DetectHostname()
if tsErr != nil {
logger.InfoCF(
@ -282,15 +282,26 @@ func setupAndStartServices(
"Tailscale not available, Mini App disabled",
map[string]any{"error": tsErr.Error()},
)
} else {
hostPort := net.JoinHostPort(hostname, strconv.Itoa(cfg.Gateway.Port))
webAppURL = "https://" + hostPort + "/miniapp"
cfg.Channels.Telegram.WebAppURL = webAppURL
}
}
// When the URL is HTTPS, fetch a TLS certificate from Tailscale so
// the server can actually serve over TLS. This covers both the
// auto-detected case above and a manually configured https:// URL.
if strings.HasPrefix(webAppURL, "https://") {
hostname, tsErr := tailscale.DetectHostname()
if tsErr != nil {
logger.ErrorCF("miniapp", "HTTPS URL configured but Tailscale not available", map[string]any{"error": tsErr.Error()})
} else {
certDir := filepath.Join(cfg.WorkspacePath(), "state", "certs")
certFile, keyFile, certErr := tailscale.FetchCert(hostname, certDir)
if certErr != nil {
logger.ErrorCF("miniapp", "Failed to fetch TLS cert", map[string]any{"error": certErr.Error()})
} else {
hostPort := net.JoinHostPort(hostname, strconv.Itoa(cfg.Gateway.Port))
webAppURL = "https://" + hostPort + "/miniapp"
cfg.Channels.Telegram.WebAppURL = webAppURL
tlsCert, tlsKey = certFile, keyFile
useTLS = true
}