From d94ffafb1bc63b3fe1be186af6f0063fceaff01f Mon Sep 17 00:00:00 2001
From: Pascal Iske <info@pascaliske.dev>
Date: Thu, 10 Sep 2026 15:55:18 +0200
Subject: [PATCH] fix: error out if certs are present but base url is non-https

Signed-off-by: Pascal Iske <info@pascaliske.dev>
---
 nginx/files/01-listen.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/nginx/files/01-listen.sh b/nginx/files/01-listen.sh
index 6a219887..51168a8f 100755
--- a/nginx/files/01-listen.sh
+++ b/nginx/files/01-listen.sh
@@ -8,6 +8,16 @@ CONF="${NGINX_INCLUDE_DIR}/listen.conf"
 # ensure include file exists
 mkdir -p "${NGINX_INCLUDE_DIR}" && : > "$CONF"
 
+# error out if certs are present but base url is not https based
+if [ -f "/etc/nginx/certs/cert.pem" ] && [ -f "/etc/nginx/certs/key.pem" ]; then
+    case "$BASE_URL" in
+    http://*)
+        echo "BASE_URL starts with http://, but SSL certificate is present. Please update your env variables!"
+        exit 1
+        ;;
+    esac
+fi
+
 if [ -f "/etc/nginx/certs/cert.pem" ] && [ -f "/etc/nginx/certs/key.pem" ]; then
     # ipv4-ssl
     printf 'listen %s ssl;\n' "${NGINX_INTERNAL_HTTPS_PORT}" >> "$CONF"