`server.https` picked the scheme for every generated link, and it also
decides whether cookies are marked Secure. The two are separate
questions, and a config that said `publicPort = 443` with `https =
false` produced `http://host:443` in every feed `<link>`, `<guid>`, the
OpenSearch template and the unfurl metadata. Nothing serves plain HTTP
on 443, so no such link was ever usable, and nothing warned about it.
Take the scheme from the port when the port is 443 or 80 -- they only
mean one thing -- and from `https` otherwise, so `https://host:8443`
still works. A default port is never appended. The `https` flag keeps
governing cookies, and startup now logs a warning when the port says TLS
and the flag does not, since the cookies are then not Secure.
The logic moves into a small pure function so the combinations can be
tested exhaustively rather than through a loaded config.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
SalastilandClaude Sonnet 5.5
cf5a66cde7