fix: decouple session cookie 'secure' flag from NODE_ENV

Cookie was silently never set because NODE_ENV=production forced
secure=true while the app is served over plain HTTP on the LAN (TLS
terminates at a reverse proxy later, not here). Add explicit
COOKIE_SECURE env var, default false.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -16,6 +16,11 @@ ADMIN_PASSWORD=
 # local | oidc (oidc not implemented yet, see issue #12)
 AUTH_MODE=local
 
+# Set to true only once a TLS-terminating reverse proxy sits in front (see
+# issue #13). Leave false for plain-HTTP LAN access, otherwise the session
+# cookie won't be set at all.
+COOKIE_SECURE=false
+
 PORT=3000
 POLL_INTERVAL_SECONDS=30
 SNAPSHOT_RETENTION_HOURS=24

apps/api/src/config/index.ts

@@ -15,6 +15,9 @@ export interface AppConfig {
   snapshotRetentionHours: number;
   authMode: "local" | "oidc";
   sessionSecret: string;
+  // Only set once a TLS-terminating reverse proxy sits in front (see issue #13) —
+  // browsers silently drop `secure` cookies over plain HTTP.
+  cookieSecure: boolean;
   adminUsername: string;
   adminPassword: string | undefined;
   proxmox: {
@@ -42,6 +45,7 @@ export function loadConfig(hostsConfigPath: string): AppConfig {
     snapshotRetentionHours: Number(process.env.SNAPSHOT_RETENTION_HOURS ?? 24),
     authMode: (process.env.AUTH_MODE as "local" | "oidc") ?? "local",
     sessionSecret: required("SESSION_SECRET"),
+    cookieSecure: process.env.COOKIE_SECURE === "true",
     adminUsername: process.env.ADMIN_USERNAME ?? "admin",
     adminPassword: process.env.ADMIN_PASSWORD,
     proxmox: {

apps/api/src/index.ts

@@ -46,7 +46,7 @@ async function main() {
   await app.register(fastifyCookie);
   await app.register(fastifySession, {
     secret: cfg.sessionSecret,
-    cookie: { secure: process.env.NODE_ENV === "production", maxAge: 1000 * 60 * 60 * 12 },
+    cookie: { secure: cfg.cookieSecure, maxAge: 1000 * 60 * 60 * 12 },
   });
 
   registerAuthRoutes(app, db);