Add built-in TLS (self-signed autogen, CA pinning) and optional closed registration

coordinator/internal/infra/config.go

@@ -55,6 +55,14 @@ type Config struct {
 	// Directory of the built MkDocs site (site/) served at /ui/docs/. Empty
 	// disables the docs route; the UI shows a hint page instead.
 	DocsDir string
+	// TLSCertFile and TLSKeyFile enable HTTPS when both are set. Self-signed
+	// certificates are fine for a trusted LAN; workers then need
+	// SCIMESH_CA_CERT or SCIMESH_INSECURE_SKIP_VERIFY to connect.
+	TLSCertFile string
+	TLSKeyFile  string
+	// DisableRegistration forbids new UI accounts; the bootstrap admin still
+	// works. Existing accounts and worker keys are unaffected.
+	DisableRegistration bool
 	// Upper bound on an uploaded dataset or artifact body, in bytes.
 	MaxUploadBytes int64
 
@@ -123,6 +131,9 @@ func LoadConfig() (Config, error) {
 		LogFile:              os.Getenv("LOG_FILE"),
 		StorageDir:           getEnv("COORDINATOR_STORAGE_DIR", "./data"),
 		DocsDir:              os.Getenv("SCIMESH_DOCS_DIR"),
+		TLSCertFile:          os.Getenv("SCIMESH_TLS_CERT"),
+		TLSKeyFile:           os.Getenv("SCIMESH_TLS_KEY"),
+		DisableRegistration:  os.Getenv("SCIMESH_DISABLE_REGISTRATION") == "1",
 		MaxUploadBytes:       1 << 30, // 1 GiB
 		DBMaxConns:           10,
 		DBConnectTimeout:     30 * time.Second,

coordinator/internal/infra/server.go

@@ -13,17 +13,25 @@ import (
 const shutdownGrace = 15 * time.Second
 
 // Run serves handler until ctx is cancelled, then drains in-flight requests.
-func RunServer(ctx context.Context, log *slog.Logger, addr string, handler http.Handler) error {
+func RunServer(ctx context.Context, log *slog.Logger, addr string, handler http.Handler, tls ...TLSConfig) error {
 	srv := &http.Server{
 		Addr:              addr,
 		Handler:           handler,
 		ReadHeaderTimeout: 5 * time.Second,
 	}
+	secure := len(tls) > 0 && tls[0].CertFile != "" && tls[0].KeyFile != ""
 
 	// Buffered so this goroutine can exit even when nobody reads the channel
 	// (the ctx.Done branch below) — an unbuffered send would leak it forever.
 	errCh := make(chan error, 1)
 	go func() {
+		if secure {
+			log.Info("coordinator listening (https)", "addr", addr)
+			if err := srv.ListenAndServeTLS(tls[0].CertFile, tls[0].KeyFile); err != nil && !errors.Is(err, http.ErrServerClosed) {
+				errCh <- err
+			}
+			return
+		}
 		log.Info("coordinator listening", "addr", addr)
 		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 			errCh <- err
@@ -72,3 +80,9 @@ func RunPeriodic(ctx context.Context, log *slog.Logger, name string, interval ti
 		}
 	}
 }
+
+// TLSConfig enables HTTPS for the coordinator server.
+type TLSConfig struct {
+	CertFile string
+	KeyFile  string
+}