1 files changed, 28 insertions, 11 deletions
diff --git a/internal/admin/server.go b/internal/admin/server.go
index 8facc4a..823d7ba 100644
--- a/internal/admin/server.go
+++ b/internal/admin/server.go
@@ -34,6 +34,7 @@ var embedded embed.FS
 
 type AdminServer struct {
 	cfg          *config.Config
+	useTLS       bool
 	accountStore *player.AccountStore
 	world        *world.World
 	itemStore    *item.ItemStore
@@ -46,7 +47,7 @@ type AdminServer struct {
 	cookieSecret []byte
 }
 
-func NewServer(cfg *config.Config, accountStore *player.AccountStore, w *world.World, is *item.ItemStore, os *object.ObjectStore, ms *world.MobStore, dataDir string) (*AdminServer, error) {
+func NewServer(cfg *config.Config, useTLS bool, accountStore *player.AccountStore, w *world.World, is *item.ItemStore, os *object.ObjectStore, ms *world.MobStore, dataDir string) (*AdminServer, error) {
 	secret := make([]byte, 32)
 	if _, err := rand.Read(secret); err != nil {
 		return nil, fmt.Errorf("cookie secret: %w", err)
@@ -62,13 +63,24 @@ func NewServer(cfg *config.Config, accountStore *player.AccountStore, w *world.W
 		return nil, fmt.Errorf("parse templates: %w", err)
 	}
 
-	cert, err := loadOrGenerateCert(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("admin cert: %w", err)
+	var port int
+	if useTLS {
+		port = cfg.AdminHTTPS.Port
+	} else {
+		port = cfg.AdminHTTP.Port
+	}
+
+	var cert tls.Certificate
+	if useTLS {
+		cert, err = loadOrGenerateCert(cfg)
+		if err != nil {
+			return nil, fmt.Errorf("admin cert: %w", err)
+		}
 	}
 
 	s := &AdminServer{
 		cfg:          cfg,
+		useTLS:       useTLS,
 		accountStore: accountStore,
 		world:        w,
 		itemStore:    is,
@@ -159,12 +171,14 @@ func NewServer(cfg *config.Config, accountStore *player.AccountStore, w *world.W
 	})
 
 	s.httpServer = &http.Server{
-		Addr:    fmt.Sprintf(":%d", cfg.AdminHTTPS.Port),
+		Addr:    fmt.Sprintf(":%d", port),
 		Handler: mux,
-		TLSConfig: &tls.Config{
+	}
+	if useTLS {
+		s.httpServer.TLSConfig = &tls.Config{
 			Certificates: []tls.Certificate{cert},
 			MinVersion:   tls.VersionTLS12,
-		},
+		}
 	}
 
 	return s, nil
@@ -175,8 +189,11 @@ func (s *AdminServer) ListenAndServe() error {
 	if err != nil {
 		return fmt.Errorf("admin listen: %w", err)
 	}
-	tlsLn := tls.NewListener(ln, s.httpServer.TLSConfig)
-	return s.httpServer.Serve(tlsLn)
+	if s.useTLS {
+		tlsLn := tls.NewListener(ln, s.httpServer.TLSConfig)
+		return s.httpServer.Serve(tlsLn)
+	}
+	return s.httpServer.Serve(ln)
 }
 
 func (s *AdminServer) authMiddleware(next http.Handler) http.Handler {
@@ -228,7 +245,7 @@ func (s *AdminServer) setAuthCookie(w http.ResponseWriter, account string) {
 		Value:    account + ":" + sig,
 		Path:     "/",
 		HttpOnly: true,
-		Secure:   true,
+		Secure:   s.useTLS,
 		SameSite: http.SameSiteStrictMode,
 		MaxAge:   86400,
 	})
@@ -270,7 +287,7 @@ func (s *AdminServer) handleLogout(w http.ResponseWriter, r *http.Request) {
 		Path:     "/",
 		MaxAge:   -1,
 		HttpOnly: true,
-		Secure:   true,
+		Secure:   s.useTLS,
 	})
 	http.Redirect(w, r, "/login", http.StatusFound)
 }