[brenster]

Problem

lrsql.system.webserver/service-map passes :ssl? true to Jetty unconditionally, so SQL LRS always opens the SSL port (LRSQL_SSL_PORT, default 8443). When TLS ends at a proxy or load balancer, that is a second, unused listener, usually with a generated self-signed certificate.

LRSQL_ENABLE_HTTP=false already gives an HTTPS-only server. There is no matching way to get an HTTP-only one; #242 asked for this, and the answer was to ignore the port.

Fix

• LRSQL_ENABLE_HTTPS (enableHttps), default true. With true, nothing changes. With false, :ssl? is false, :ssl-port is nil and :h2? is false. Pedestal creates the SSL connector when any of those three is set, so all three are gated. HTTP/2 cleartext (h2c) on the HTTP port still follows LRSQL_ENABLE_HTTP2.
• Not both off. The webserver spec refuses a configuration with both enable-http and enable-https false, rather than starting a server with no listener.
• Startup log. The startup line says Starting new webserver at host … and HTTP port … (HTTPS disabled) instead of printing a nil SSL port.
• Configuration. enable-https is optional in the spec (absent means true) and present in both default webserver.edn files.

The keystore is still loaded or generated as before, because its private key signs admin tokens unless LRSQL_JWT_COMMON_SECRET is set.

Tests

• lrsql.https-disabled-test/https-disabled-test starts a system with [:webserver :enable-https] false. It checks that /health answers 200 on HTTP, that a connection to 8443 is refused (curl exit 7), and that the service map has no SSL connector options.
• lrsql.util.https-setting-test/https-setting-config-test checks the spec: the default with the key absent, HTTP only, HTTPS only, both off refused, and a non-boolean refused. It is a separate namespace without the database fixture, because that fixture truncates tables a pure spec test never creates.

	main (587f7995) with only the tests added	With the fix
https-disabled-test, SQLite	1 test, 5 assertions, 4 failures (8443 still answers)	0 failures
https-setting-config-test	1 test, 5 assertions, 2 failures	0 failures
Both, on PostgreSQL 11, MySQL 8.0.44 and MariaDB 11.7.2		2 tests, 10 assertions, 0 failures each

Test runs

Run	Tests	Assertions	Failures	Errors
Full suite, SQLite, this branch	137	1,363	0	0
Full suite, SQLite, main for comparison	135	1,353	0	0

The existing lrsql.https-test (HTTPS on by default) passes unchanged. clj-kondo 2025.10.23: 0 errors, 0 warnings.

Documentation

• doc/env_vars.md: a new LRSQL_ENABLE_HTTPS row. The LRSQL_ENABLE_HTTP row no longer says HTTPS "is always enabled".
• doc/https.md: how to serve HTTP only behind a TLS-terminating proxy, and the note about the keystore.

Upgrade notes

• Default behavior is unchanged.
• The spec rule. A configuration that set enableHttp: false keeps working. Only the new combination of both false is refused, at startup.
• CORS defaults. The built-in default allowed origins still include the https://…:<sslPort> entries when HTTPS is off. They are harmless, and LRSQL_ALLOWED_ORIGINS overrides them as before.

Other pull requests touching the same files

• src/main/lrsql/system/webserver.clj is also edited by "Send the configured security headers on every response", "Log authentication events" and "Add a token ID to admin JWTs…". The changes are in different places and merge cleanly with each of them; this was checked by merging all of them together.
• doc/env_vars.md is also edited by the security-header, token and authentication-logging pull requests, in other sections.
• Suggested order: independent; early in the series.

🤖 Generated with Claude Code