fix #547: secure VM deployment behind HTTPS proxy

src/main/java/com/cloudhandson/vpdbackoffice/config/BackofficeProperties.java

@@ -11,7 +11,7 @@ public record BackofficeProperties(
     Ai ai
 ) {
 
-  public record Security(String adminUser, String adminPassword) {
+  public record Security(String adminUser, String adminPassword, boolean requireHttps) {
   }
 
   public record Token(int maxDays) {

src/main/java/com/cloudhandson/vpdbackoffice/config/SecurityConfig.java

@@ -14,9 +14,19 @@ import org.springframework.security.web.SecurityFilterChain;
 public class SecurityConfig {
 
   @Bean
-  SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+  SecurityFilterChain securityFilterChain(
+      HttpSecurity http,
+      BackofficeProperties properties
+  ) throws Exception {
+    if (properties.security().requireHttps()) {
+      http.requiresChannel(channel -> channel.anyRequest().requiresSecure());
+    }
+
     return http
         .csrf(csrf -> csrf.ignoringRequestMatchers("/mcp/messages", "/mcp/*/messages"))
+        .headers(headers -> headers.httpStrictTransportSecurity(hsts -> hsts
+            .includeSubDomains(true)
+            .maxAgeInSeconds(31_536_000)))
         .authorizeHttpRequests(auth -> auth
             .requestMatchers("/css/**", "/js/**", "/webjars/**").permitAll()
             .anyRequest().authenticated())

src/main/resources/application.yml

@@ -22,12 +22,21 @@ mybatis:
     map-underscore-to-camel-case: true
 
 server:
+  address: ${BACKOFFICE_BIND_ADDRESS:0.0.0.0}
   port: ${BACKOFFICE_PORT:8080}
+  forward-headers-strategy: ${BACKOFFICE_FORWARD_HEADERS_STRATEGY:none}
+  servlet:
+    session:
+      cookie:
+        secure: ${BACKOFFICE_SESSION_COOKIE_SECURE:false}
+        http-only: true
+        same-site: lax
 
 backoffice:
   security:
     admin-user: ${BACKOFFICE_ADMIN_USER:admin}
     admin-password: ${BACKOFFICE_ADMIN_PASSWORD:admin}
+    require-https: ${BACKOFFICE_REQUIRE_HTTPS:false}
   token:
     max-days: ${BACKOFFICE_TOKEN_MAX_DAYS:365}
   ords: