M41: harden trust boundaries and delivery

deploy/unraid/configure-env.sh

@@ -1,8 +1,13 @@
 #!/bin/sh
 set -eu
 
-public_url="${1:-http://192.168.10.150:1236}"
-n8n_webhook_url="${2:-http://192.168.10.150:5678/webhook/mobilityops-return}"
+public_url="${1:-https://fleetops.itworx.tech}"
+n8n_webhook_url="${2:-https://n8n.itworx.tech/webhook/mobilityops-return}"
+
+case "$public_url" in
+  https://*) ;;
+  *) echo "Production public URL must use HTTPS" >&2; exit 1 ;;
+esac
 
 if [ -e .env ]; then
   echo "Refusing to overwrite existing .env" >&2
@@ -26,6 +31,7 @@ sed -i \
   -e "s|^DATABASE_URL=.*|DATABASE_URL=postgresql+psycopg://mobilityops:${db_password}@db:5432/mobilityops|" \
   -e "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=${db_password}|" \
   -e "s|^APP_SECRET=.*|APP_SECRET=${app_secret}|" \
+  -e "s|^SESSION_COOKIE_SECURE=.*|SESSION_COOKIE_SECURE=true|" \
   -e "s|^N8N_WEBHOOK_URL=.*|N8N_WEBHOOK_URL=${n8n_webhook_url}|" \
   -e "s|^N8N_ENCRYPTION_KEY=.*|N8N_ENCRYPTION_KEY=${n8n_key}|" \
   -e "s|^N8N_BASIC_AUTH_PASSWORD=.*|N8N_BASIC_AUTH_PASSWORD=${n8n_password}|" \