locadot 2.5.0 → 2.6.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 2.6.0 (2026-09-30)
+
+### Added
+- http → https redirect. `locadot https:redirect on` (or Settings → Proxy in the dashboard, or
+  `PUT /api/settings {"httpsRedirect": true}`) sends plain `http://` requests for every domain and the dashboard to
+  `https://` with a 307. Per domain, `locadot add/update --https-redirect on|off|default` (the edit row in the
+  dashboard, `httpsRedirect: true|false|null` in the API) overrides it either way. Off by default; applies without a
+  restart. Shared links, remote access, WebSockets and the dashboard's `/api` and `/healthz` are left alone.
+
+### Fixed
+- `locadot start --port/--https-port` no longer drops other settings saved in the config file.
+
 ## 2.5.0 (2026-09-29)
 
 ### Changed

package/README.md

@@ -79,6 +79,7 @@ Options for `add` / `update`:
 | `-t, --target <url>` | Any http(s) upstream. A bare `host:port` means `http://host:port`. |
 | `-k, --insecure` | Don't verify the TLS certificate of an `https` target (self-signed upstreams). |
 | `--cors` / `--no-cors` | Bypass CORS for this domain. The upstream gets `Origin`/`Referer` as its own origin, preflights are answered locally, any origin may read responses (with credentials), and cookies become `SameSite=None` over HTTPS. The page's calls to other domains go through locadot automatically, with no extra mapping (see [Sites that call other domains](#sites-that-call-other-domains---cors)). |
+| `--https-redirect on\|off\|default` | Send plain `http://` requests for this domain to `https://` (`on`), never (`off`), or follow `locadot https:redirect` (`default`, the initial state). `locadot update --host h --https-redirect on` changes only this, without a target. |
 | `--no-start` | Save the mapping without starting the proxy. |
 
 ### Proxy
@@ -88,6 +89,7 @@ Options for `add` / `update`:
 | `locadot start [--port 8080] [--https-port 8443]` | Start the central proxy. Default ports are 80 and 443. Ports you pass are remembered for later commands and start-at-boot, and a running proxy is moved to them. Fails loudly with the reason if it can't bind its ports. |
 | `locadot stop` | Stop the proxy. Mappings and logs are kept. |
 | `locadot restart [--port …] [--https-port …]` | Stop, then start. |
+| `locadot https:redirect [on\|off]` | Redirect plain `http://` requests to `https://` (307) for every domain and the dashboard; without an argument, show the setting. Off by default. A domain's own `--https-redirect` wins. Applies at once, without a restart. Shared links, remote access, WebSockets and the dashboard's `/api` and `/healthz` are never redirected. |
 | `locadot kill` | Stop the proxy, remove all mappings and clear the logs. |
 | `locadot status [--json]` | Is it running, its PID, ports, number of hosts, CA trust, start-at-boot, dashboard URL. |
 | `locadot doctor [--host h]` | Check the proxy, ports, permissions, CA trust, the registry and every target. Exits 1 if anything fails. |
@@ -276,6 +278,7 @@ each time the proxy starts.
 | `GET /api/logs?lines=200` | | `{ lines: [...] }` |
 | `POST /api/hosts` | `{ "host": "app.localhost", "target": "3000", "insecure": false, "cors": false }` | Add a mapping (201; 409 if it exists). |
 | `PUT /api/hosts/:host` | `{ "target": "https://example.com", "insecure": false, "cors": true }` | Change a mapping (404 if unknown). |
+| `PUT /api/hosts/:host` | `{ "httpsRedirect": true }` | Redirect this mapping's plain http to https (`true`), never (`false`), or follow the global setting (`null`). Also accepted by `POST /api/hosts` and alongside `target`. Rows show `httpsRedirect: true \| false \| null`. |
 | `PUT /api/hosts/:host` | `{ "allow": ["localhost:3000"] }` | Replace the internal addresses shared visitors may reach (normalized; `[]` clears; 400 if one is invalid). |
 | `PUT /api/hosts/:host` | `{ "protect": { "password": "…", "scopes": ["shared", "remote", "local"] } }` | Ask for a password on those paths in (at least one; `password` may be left out to keep the current one). `{ "protect": null }` removes it. Rows show `protect: { scopes, updatedAt }`, never the password. |
 | `PUT /api/hosts/:host` | `{ "tunnel": true, "domain": "app.example.com" }` | Share on a public URL: with `domain`, on that hostname through a named Cloudflare tunnel, without it on a random trycloudflare.com URL. `{ "tunnel": false }` stops sharing (400 for a bad hostname, 409 if another mapping uses it). |
@@ -284,8 +287,9 @@ each time the proxy starts.
 | `POST /api/trust` | `{ "trusted": true }` | Trust or untrust the CA. |
 | `POST /api/logs/clear` | | Clear the log. |
 | `POST /api/proxy/stop` | | Stop the proxy. Use `locadot start` to bring it back. |
-| `GET /api/settings` | | Running ports/bind, `logLevel`, `stateDir`, `saved`/`env` overrides, and `restartRequired`. |
+| `GET /api/settings` | | Running ports/bind, `logLevel`, `stateDir`, `saved`/`env` overrides, `restartRequired` and `httpsRedirect`. |
 | `PUT /api/settings` | `{ "httpPort": 8080, "httpsPort": 8443 }` | Save new ports to the config file (400 if invalid or equal). Takes effect after a restart. |
+| `PUT /api/settings` | `{ "httpsRedirect": true }` | Turn the global http → https redirect on or off; takes effect at once. |
 | `POST /api/proxy/restart` | | Restart the proxy (e.g. to pick up saved ports). |
 | `PUT /api/settings/ui-password` | `{ "password": "…", "current": "…" }` or `{ "enabled": false, "current": "…" }` | Set, change or remove the dashboard password (`current` is required once one is set). |
 | `GET /api/hub` | | Hub status/config, plus `localhost` (sender: is localhost access on) and `panel` (is the dashboard shared). |

package/dist/cli/commands/hosts.js

@@ -48,6 +48,18 @@ const hosts_1 = __importDefault(require("../../lib/hosts"));
 const allow_1 = require("../../lib/allow");
 const urls_1 = require("../../lib/urls");
 const shared_1 = require("../shared");
+const parseRedirect = (value) => {
+    if (value === undefined)
+        return undefined;
+    if (value === "on")
+        return true;
+    if (value === "off")
+        return false;
+    if (value === "default")
+        return null;
+    throw new localhost_1.InputError(`❌ --https-redirect takes on, off or default, got "${value}".`);
+};
+const redirectNote = (entry) => entry.httpsRedirect === undefined ? "" : entry.httpsRedirect ? "  (https redirect)" : "  (no https redirect)";
 const resolveTarget = (options) => {
     if (options.port !== undefined && options.target !== undefined) {
         throw new localhost_1.InputError("❌ Use either --port or --target, not both.");
@@ -64,6 +76,7 @@ const mapping = (options) => ({
     insecure: options.insecure,
     cors: options.cors,
     allow: options.allow,
+    httpsRedirect: parseRedirect(options.httpsRedirect),
 });
 const warnIfDown = async (entry) => {
     const probe = await localhost_1.default.probe(entry.target, 1500, entry.insecure);
@@ -80,6 +93,12 @@ async function add(options) {
     await warnIfDown(entry);
 }
 async function update(options) {
+    if (options.port === undefined && options.target === undefined && options.httpsRedirect !== undefined) {
+        const { host, entry } = await hosts_1.default.setHttpsRedirect({ host: options.host, httpsRedirect: parseRedirect(options.httpsRedirect) });
+        await (0, shared_1.ensureRunning)(options);
+        (0, shared_1.print)(`✅ ${(0, urls_1.urlFor)(host)}: ${entry.httpsRedirect === undefined ? "https redirect follows the global setting (locadot https:redirect)" : entry.httpsRedirect ? "plain http redirects to https" : "plain http is never redirected"}`);
+        return;
+    }
     const { host, entry } = await hosts_1.default.update(mapping(options));
     await (0, shared_1.ensureRunning)(options);
     (0, shared_1.print)(`✅ Updated ${(0, urls_1.urlFor)(host)} → ${entry.target}`);
@@ -126,7 +145,7 @@ async function list(options) {
     }
     const width = Math.max(...hosts.map(([host]) => (0, urls_1.urlFor)(host).length));
     for (const [host, entry] of hosts) {
-        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}${entry.allow?.length ? `  (allow ${entry.allow.join(", ")})` : ""}${entry.protect ? `  (password: ${entry.protect.scopes.join(", ")})` : ""}`);
+        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}${entry.allow?.length ? `  (allow ${entry.allow.join(", ")})` : ""}${entry.protect ? `  (password: ${entry.protect.scopes.join(", ")})` : ""}${redirectNote(entry)}`);
     }
     (0, shared_1.print)(`☑️ Total: ${hosts.length}.`);
 }

package/dist/cli/commands/proxy.js

@@ -7,14 +7,14 @@ exports.status = status;
 exports.start = start;
 exports.stop = stop;
 exports.restart = restart;
+exports.httpsRedirect = httpsRedirect;
 exports.kill = kill;
-const fs_1 = __importDefault(require("fs"));
 const localhost_1 = require("../../lib/localhost");
 const proxy_control_1 = __importDefault(require("../../lib/proxy-control"));
 const registry_1 = __importDefault(require("../../lib/registry"));
 const urls_1 = require("../../lib/urls");
 const constants_1 = __importDefault(require("../../constants"));
-const file_1 = __importDefault(require("../../utils/file"));
+const config_1 = __importDefault(require("../../lib/config"));
 const startup_1 = __importDefault(require("../../utils/startup"));
 const trust_1 = require("../../utils/trust");
 const shared_1 = require("../shared");
@@ -35,8 +35,7 @@ const usePorts = (options) => {
     if (httpPort === httpsPort)
         throw new localhost_1.InputError(`❌ HTTP and HTTPS can't share port ${httpPort}.`);
     Object.assign(constants_1.default.server, { httpPort, httpsPort });
-    file_1.default.ensureDir();
-    fs_1.default.writeFileSync(constants_1.default.paths.CONFIG_FILE, JSON.stringify({ httpPort, httpsPort }, null, 2) + "\n");
+    config_1.default.write({ httpPort, httpsPort });
     return true;
 };
 async function status(options) {
@@ -53,6 +52,7 @@ async function status(options) {
         bind: info?.bind ?? constants_1.default.server.bind,
         hosts,
         caTrusted: trusted,
+        httpsRedirect: config_1.default.httpsRedirect(),
         startupEnabled: startup,
         dashboard: (0, urls_1.urlFor)("localhost"),
         stateDir: constants_1.default.paths.HOME,
@@ -65,6 +65,7 @@ async function status(options) {
     (0, shared_1.print)(`   Ports:     http ${report.httpPort}, https ${report.httpsPort} on ${report.bind.join(", ")}`);
     (0, shared_1.print)(`   Hosts:     ${hosts}`);
     (0, shared_1.print)(`   CA:        ${trusted === undefined ? "unknown" : trusted ? "trusted" : "not trusted (run `locadot trust`)"}`);
+    (0, shared_1.print)(`   Redirect:  ${report.httpsRedirect ? "http → https" : "off"}`);
     (0, shared_1.print)(`   Startup:   ${startup ? "enabled" : "disabled"}`);
     (0, shared_1.print)(`   Dashboard: ${report.dashboard}`);
     (0, shared_1.print)(`   State dir: ${report.stateDir}`);
@@ -94,6 +95,16 @@ async function restart(options = {}) {
     const info = await proxy_control_1.default.restart();
     (0, shared_1.print)(`☑️ Proxy restarted on http ${info.httpPort}, https ${info.httpsPort} (pid ${info.pid}).`);
 }
+/** The global http → https redirect; the running proxy picks the change up without a restart. */
+async function httpsRedirect(value) {
+    if (value !== undefined && value !== "on" && value !== "off")
+        throw new localhost_1.InputError('❌ Use "on" or "off".');
+    if (value !== undefined)
+        config_1.default.write({ httpsRedirect: value === "on" || undefined });
+    const on = config_1.default.httpsRedirect();
+    (0, shared_1.print)(on ? `🔒 Plain http is redirected to https (${(0, urls_1.urlFor)("localhost")}).` : "☑️ Plain http is served as-is (no https redirect).");
+    (0, shared_1.print)("   Per domain: locadot update --host <host> --https-redirect on|off|default");
+}
 async function kill() {
     await proxy_control_1.default.kill();
     (0, shared_1.print)(constants_1.default.proxyInfo.proxyClose);

package/dist/dashboard/api.js

@@ -59,6 +59,7 @@ const links_1 = __importStar(require("../lib/links"));
 const hub_config_1 = __importDefault(require("../lib/hub-config"));
 const remotes_1 = __importStar(require("../lib/remotes"));
 const ui_auth_1 = __importDefault(require("../lib/ui-auth"));
+const config_1 = __importDefault(require("../lib/config"));
 const request_1 = require("../proxy/request");
 const MAX_BODY = 64 * 1024;
 class ApiError extends Error {
@@ -152,6 +153,12 @@ const optionalBool = (value, name) => {
         throw new ApiError(400, `\`${name}\` must be true or false.`);
     return value;
 };
+/** A mapping's https redirect: true/false, or null to follow the global setting. */
+const optionalRedirect = (value) => {
+    if (value === undefined || value === null || typeof value === "boolean")
+        return value;
+    throw new ApiError(400, "`httpsRedirect` must be true, false or null (follow the global setting).");
+};
 const requiredBool = (value, name) => {
     const result = optionalBool(value, name);
     if (result === undefined)
@@ -215,18 +222,8 @@ const sanitizeRemote = (remote) => {
     const { token, ...rest } = remote;
     return rest;
 };
-/** Reads CONFIG_FILE as-is (whatever `locadot start --port/--https-port` last wrote), tolerating a missing/corrupt file. */
-function readConfig() {
-    try {
-        const raw = JSON.parse(fs_1.default.readFileSync(constants_1.default.paths.CONFIG_FILE, "utf8"));
-        return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-    }
-    catch {
-        return {};
-    }
-}
 const savedPorts = () => {
-    const config = readConfig();
+    const config = config_1.default.read();
     return {
         httpPort: constants_1.default.validPort(config.httpPort),
         httpsPort: constants_1.default.validPort(config.httpsPort),
@@ -252,6 +249,7 @@ function buildSettingsBody(ctx, warning) {
         saved,
         env,
         restartRequired,
+        httpsRedirect: config_1.default.httpsRedirect(),
         uiAuth: { enabled: ui_auth_1.default.enabled(), updatedAt: ui_auth_1.default.read()?.updatedAt },
         ...(warning ? { warning } : {}),
     };
@@ -373,23 +371,29 @@ async function route(req, url, ctx) {
         if (path === "/api/settings" && method === "PUT") {
             const newHttp = validPortInput(body.httpPort, "httpPort");
             const newHttps = validPortInput(body.httpsPort, "httpsPort");
-            if (newHttp === undefined && newHttps === undefined)
-                throw new ApiError(400, "Provide `httpPort` and/or `httpsPort`.");
-            const config = readConfig();
-            const saved = savedPorts();
-            const finalHttp = newHttp ?? saved.httpPort ?? ctx.proxyInfo.httpPort;
-            const finalHttps = newHttps ?? saved.httpsPort ?? ctx.proxyInfo.httpsPort;
-            if (finalHttp === finalHttps)
-                throw new ApiError(400, "`httpPort` and `httpsPort` can't be the same.");
-            file_1.default.ensureDir();
-            fs_1.default.writeFileSync(constants_1.default.paths.CONFIG_FILE, JSON.stringify({ ...config, httpPort: finalHttp, httpsPort: finalHttps }, null, 2) + "\n");
-            logger_1.default.info(`⚙️ dashboard: settings saved → http ${finalHttp}, https ${finalHttps}`);
-            const warnings = [];
-            if (newHttp !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTP_PORT") !== undefined) {
-                warnings.push("LOCADOT_HTTP_PORT is set and overrides this");
+            const httpsRedirect = optionalBool(body.httpsRedirect, "httpsRedirect");
+            if (newHttp === undefined && newHttps === undefined && httpsRedirect === undefined) {
+                throw new ApiError(400, "Provide `httpPort`, `httpsPort` and/or `httpsRedirect`.");
+            }
+            if (httpsRedirect !== undefined) {
+                config_1.default.write({ httpsRedirect: httpsRedirect || undefined });
+                logger_1.default.info(`⚙️ dashboard: http → https redirect ${httpsRedirect ? "on" : "off"}`);
             }
-            if (newHttps !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTPS_PORT") !== undefined) {
-                warnings.push("LOCADOT_HTTPS_PORT is set and overrides this");
+            const warnings = [];
+            if (newHttp !== undefined || newHttps !== undefined) {
+                const saved = savedPorts();
+                const finalHttp = newHttp ?? saved.httpPort ?? ctx.proxyInfo.httpPort;
+                const finalHttps = newHttps ?? saved.httpsPort ?? ctx.proxyInfo.httpsPort;
+                if (finalHttp === finalHttps)
+                    throw new ApiError(400, "`httpPort` and `httpsPort` can't be the same.");
+                config_1.default.write({ httpPort: finalHttp, httpsPort: finalHttps });
+                logger_1.default.info(`⚙️ dashboard: settings saved → http ${finalHttp}, https ${finalHttps}`);
+                if (newHttp !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTP_PORT") !== undefined) {
+                    warnings.push("LOCADOT_HTTP_PORT is set and overrides this");
+                }
+                if (newHttps !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTPS_PORT") !== undefined) {
+                    warnings.push("LOCADOT_HTTPS_PORT is set and overrides this");
+                }
             }
             return { status: 200, body: buildSettingsBody(ctx, warnings.length ? warnings.join("; ") : undefined) };
         }
@@ -400,6 +404,7 @@ async function route(req, url, ctx) {
                 insecure: optionalBool(body.insecure, "insecure"),
                 cors: optionalBool(body.cors, "cors"),
                 allow: body.allow,
+                httpsRedirect: optionalRedirect(body.httpsRedirect),
             });
             ctx.reload();
             logger_1.default.info(`➕ dashboard: ${host} → ${entry.target}`);
@@ -429,13 +434,19 @@ async function route(req, url, ctx) {
                 const scopes = updated.entry.protect?.scopes;
                 logger_1.default.info(`🔒 dashboard: ${scopes ? `${updated.host} asks for a password on ${scopes.join(", ")}${protect?.password ? " (new password)" : ""}` : `${updated.host} is no longer password protected`}`);
             }
-            if (body.target !== undefined || (tunnel === undefined && body.allow === undefined && body.protect === undefined)) {
+            const httpsRedirect = optionalRedirect(body.httpsRedirect);
+            if (httpsRedirect !== undefined && body.target === undefined) {
+                updated = await hosts_1.default.setHttpsRedirect({ host, httpsRedirect });
+                logger_1.default.info(`✏️ dashboard: ${updated.host} https redirect ${httpsRedirect === null ? "follows the global setting" : httpsRedirect ? "on" : "off"}`);
+            }
+            if (body.target !== undefined || (tunnel === undefined && body.allow === undefined && body.protect === undefined && httpsRedirect === undefined)) {
                 updated = await hosts_1.default.update({
                     host,
                     target: body.target,
                     insecure: optionalBool(body.insecure, "insecure"),
                     cors: optionalBool(body.cors, "cors"),
                     allow: body.allow,
+                    httpsRedirect,
                 });
                 logger_1.default.info(`✏️ dashboard: ${updated.host} → ${updated.entry.target}`);
             }

package/dist/dashboard/index.js

@@ -95,6 +95,7 @@ async function buildHosts(ctx) {
             allow: entry.allow ?? [],
             tunnelDomain: entry.tunnelDomain ?? null,
             protect: entry.protect ? { scopes: entry.protect.scopes, updatedAt: host_auth_1.default.updatedAt(host) ?? null } : null,
+            httpsRedirect: entry.httpsRedirect ?? null,
             createdAt: entry.createdAt,
             updatedAt: entry.updatedAt,
             urls: hostUrls(host, httpPort, httpsPort),

package/dist/dashboard/ui/hosts.js

@@ -210,6 +210,8 @@ exports.jsHostsTable = `  // ---------- hosts table ----------
     if (row.cors) flags.push(["cors", "Origin/Referer rewritten to the target; any origin may call this host", "badge-cors"]);
     if (row.allow && row.allow.length) flags.push(["internal access", "Internal access: " + row.allow.join(", "), "badge-accent"]);
     if (row.protect) flags.push(["password", "Password protected on: " + protectScopeNames(row.protect.scopes), "badge-accent"]);
+    if (row.httpsRedirect === true) flags.push(["https only", "Plain http redirects to https, whatever the global setting", "badge-accent"]);
+    if (row.httpsRedirect === false) flags.push(["http allowed", "Plain http is never redirected, whatever the global setting", "badge-warn"]);
     if (flags.length) {
       td.className = "badges";
       flags.forEach(function (flag) {
@@ -995,6 +997,20 @@ exports.jsHostRows = `  function labelCells(tr, labels) {
     corsLabel.appendChild(corsInput);
     corsLabel.appendChild(document.createTextNode("cors"));
     insecureTd.appendChild(corsLabel);
+    var redirectLabel = document.createElement("label");
+    redirectLabel.className = "inline-check";
+    var redirectInput = document.createElement("select");
+    redirectInput.className = "input input-sm";
+    [["", "https redirect: global"], ["on", "https redirect: on"], ["off", "https redirect: off"]].forEach(function (opt) {
+      var o = document.createElement("option");
+      o.value = opt[0];
+      o.textContent = opt[1];
+      redirectInput.appendChild(o);
+    });
+    redirectInput.value = row.httpsRedirect === true ? "on" : row.httpsRedirect === false ? "off" : "";
+    redirectInput.setAttribute("aria-label", "https redirect for " + row.host);
+    redirectLabel.appendChild(redirectInput);
+    insecureTd.appendChild(redirectLabel);
     tr.appendChild(insecureTd);
 
     var hintTd = makeCell("Enter to save \\u00b7 Esc to cancel", "dim edit-hint");
@@ -1027,7 +1043,12 @@ exports.jsHostRows = `  function labelCells(tr, labels) {
       cancelBtn.disabled = true;
       apiFetch("/api/hosts/" + encodeURIComponent(row.host), {
         method: "PUT",
-        body: JSON.stringify({ target: newTarget, insecure: !!insecureInput.checked, cors: !!corsInput.checked })
+        body: JSON.stringify({
+          target: newTarget,
+          insecure: !!insecureInput.checked,
+          cors: !!corsInput.checked,
+          httpsRedirect: redirectInput.value === "on" ? true : redirectInput.value === "off" ? false : null
+        })
       })
         .then(function () {
           editingHost = null;

package/dist/dashboard/ui/system.js

@@ -254,6 +254,7 @@ exports.jsSettings = `  // ---------- settings page ----------
   var portsSave = document.getElementById("ports-save");
   var restartBtn = document.getElementById("restart-proxy-btn");
   var restartNote = document.getElementById("restart-note");
+  var setHttpsRedirect = document.getElementById("set-https-redirect");
   var setBind = document.getElementById("set-bind");
   var setBindNote = document.getElementById("set-bind-note");
   var setHome = document.getElementById("set-home");
@@ -281,6 +282,7 @@ exports.jsSettings = `  // ---------- settings page ----------
     if (s.env && s.env.httpsPort) notes.push("LOCADOT_HTTPS_PORT is set and overrides the saved HTTPS port.");
     portsNote.textContent = notes.join(" ");
     restartNote.hidden = !s.restartRequired;
+    setSwitch(setHttpsRedirect, !!s.httpsRedirect);
     setBind.textContent = (s.bind || []).join(", ");
     setBindNote.textContent = s.env && s.env.bind ? "Set by LOCADOT_BIND." : "Loopback only. Set LOCADOT_BIND to change it.";
     setHome.textContent = s.stateDir || "";
@@ -312,6 +314,19 @@ exports.jsSettings = `  // ---------- settings page ----------
       .then(function () { portsSave.disabled = false; portsSave.classList.remove("busy"); });
   });
 
+  setHttpsRedirect.addEventListener("click", function () {
+    var next = !(settingsLoaded && settingsLoaded.httpsRedirect);
+    setHttpsRedirect.disabled = true;
+    apiFetch("/api/settings", { method: "PUT", body: JSON.stringify({ httpsRedirect: next }) })
+      .then(function (s) {
+        renderSettings(s);
+        showToast(next ? "Plain http now redirects to https" : "https redirect off", "success");
+        loadHosts();
+      })
+      .catch(function (err) { apiError(err, "Couldn't change the redirect"); })
+      .then(function () { setHttpsRedirect.disabled = false; });
+  });
+
   restartBtn.addEventListener("click", function () {
     confirmDialog({ title: "Restart the proxy?", message: "Hosts are unavailable for a few seconds.", confirmLabel: "Restart", danger: true }).then(function (ok) {
     if (!ok) return;
@@ -573,6 +588,8 @@ exports.settingsView = `  <section class="view" data-view="settings" aria-label=
                 <div id="restart-note" class="hub-warn" hidden>Saved. Restart the proxy to use the new ports.</div>
               </form>
               <div class="stat-list">
+                <div class="stat-row"><div class="stat-main"><div class="label">Redirect http to https</div><div class="tile-sub">Plain http on this machine goes to https, for every host and the dashboard. A host's own setting wins.</div></div>
+                  <div class="stat-side"><button type="button" id="set-https-redirect" class="switch" role="switch" aria-checked="false" aria-label="Redirect http to https"><span class="switch-knob"></span></button></div></div>
                 <div class="stat-row"><div class="stat-main"><div class="label">Listening on</div><div id="set-bind" class="tile-value mono">—</div><div id="set-bind-note" class="tile-sub"></div></div></div>
                 <div class="stat-row"><div class="stat-main"><div class="label">State directory</div><div id="set-home" class="tile-value mono">—</div></div><div class="stat-side"><button type="button" id="set-home-copy" class="copy-btn">Copy</button></div></div>
                 <div class="stat-row"><div class="stat-main"><div class="label">Log level</div><div id="set-loglevel" class="tile-value mono">—</div><div class="tile-sub">Set LOCADOT_LOG_LEVEL before starting to change it.</div></div></div>

package/dist/index.js

@@ -38,6 +38,7 @@ const destinationOptions = (command) => command
     .option("-k, --insecure", "Don't verify the TLS certificate of an https target")
     .option("--cors", "Send Origin/Referer as the target's own and let any origin call this domain")
     .option("--no-cors", "Turn --cors off again (update)")
+    .option("--https-redirect <mode>", "Send plain http to https: on, off, or default (follow `locadot https:redirect`)")
     .option("--no-start", "Only save the mapping; don't start the proxy");
 program
     .name("locadot")
@@ -106,6 +107,10 @@ const portOptions = (command) => command
 portOptions(program.command("start").description("Start the central proxy")).action(run((options) => commands_1.default.start(options)));
 program.command("stop").description("Stop the central proxy (keeps hosts and logs)").action(run(() => commands_1.default.stop()));
 portOptions(program.command("restart").description("Restart the central proxy")).action(run((options) => commands_1.default.restart(options)));
+program
+    .command("https:redirect [onOrOff]")
+    .description("Redirect plain http to https for every domain and the dashboard (on/off); shows the setting without an argument")
+    .action(run((value) => commands_1.default.httpsRedirect(value)));
 program.command("kill").description("Stop the proxy, remove all hosts and clear logs").action(run(() => commands_1.default.kill()));
 program.command("trust").description("Install the locadot CA in the system trust store (sudo)").action(run(() => commands_1.default.trust()));
 program.command("untrust").description("Remove the locadot CA from the system trust store (sudo)").action(run(() => commands_1.default.untrust()));

package/dist/lib/config.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const constants_1 = __importDefault(require("../constants"));
+const file_1 = __importDefault(require("../utils/file"));
+let cached;
+class ConfigStore {
+    /** The file as-is, tolerating a missing or corrupt one. */
+    static read() {
+        try {
+            const raw = JSON.parse(fs_1.default.readFileSync(constants_1.default.paths.CONFIG_FILE, "utf8"));
+            return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+        }
+        catch {
+            return {};
+        }
+    }
+    /** Merges into the file, so saving the ports keeps the other settings and the other way round. */
+    static write(patch) {
+        file_1.default.ensureDir();
+        const next = { ...ConfigStore.read(), ...patch };
+        for (const key of Object.keys(next))
+            if (next[key] === undefined)
+                delete next[key];
+        fs_1.default.writeFileSync(constants_1.default.paths.CONFIG_FILE, JSON.stringify(next, null, 2) + "\n");
+        cached = undefined;
+    }
+    /** For the request path: re-reads only when the file changed. */
+    static readCached() {
+        let mtimeMs = -1;
+        try {
+            mtimeMs = fs_1.default.statSync(constants_1.default.paths.CONFIG_FILE).mtimeMs;
+        }
+        catch { }
+        if (cached?.mtimeMs !== mtimeMs)
+            cached = { mtimeMs, config: mtimeMs < 0 ? {} : ConfigStore.read() };
+        return cached.config;
+    }
+    static httpsRedirect() {
+        return ConfigStore.readCached().httpsRedirect === true;
+    }
+}
+exports.default = ConfigStore;

package/dist/lib/hosts.js

@@ -79,7 +79,7 @@ class HostOps {
             if (existing) {
                 throw new ConflictError(`❌ ${host} is already mapped to ${existing.target}. Use \`locadot update --host ${host} ...\` instead.`);
             }
-            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, allow: allow.length ? allow : undefined, createdAt: now, updatedAt: now };
+            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, allow: allow.length ? allow : undefined, httpsRedirect: input.httpsRedirect ?? undefined, createdAt: now, updatedAt: now };
             return registry.hosts[host];
         });
         return { host, entry };
@@ -101,12 +101,24 @@ class HostOps {
                 insecure: insecure || undefined,
                 cors: cors || undefined,
                 allow: list?.length ? list : undefined,
+                httpsRedirect: input.httpsRedirect === undefined ? existing.httpsRedirect : input.httpsRedirect ?? undefined,
                 updatedAt: new Date().toISOString(),
             };
             return registry.hosts[host];
         });
         return { host, entry };
     }
+    static async setHttpsRedirect(input) {
+        const host = localhost_1.default.requireHost(input.host);
+        const entry = await registry_1.default.mutate((registry) => {
+            const existing = registry.hosts[host];
+            if (!existing)
+                throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+            registry.hosts[host] = { ...existing, httpsRedirect: input.httpsRedirect ?? undefined, updatedAt: new Date().toISOString() };
+            return registry.hosts[host];
+        });
+        return { host, entry };
+    }
     /** Sharing on: `domain` shares on that hostname, none on a random trycloudflare.com URL. Sharing off keeps the hostname for next time. */
     static async setTunnel(input) {
         const host = localhost_1.default.requireHost(input.host);

package/dist/proxy/https-redirect.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redirectToHttps = exports.wantsHttps = void 0;
+const net_1 = __importDefault(require("net"));
+const constants_1 = __importDefault(require("../constants"));
+const urls_1 = require("../lib/urls");
+const request_1 = require("./request");
+/** The CLI and scripts talk to the dashboard's API and health check over plain http. */
+const dashboardExempt = (url) => {
+    const path = url.split("?")[0];
+    return path === "/healthz" || path === "/api" || path.startsWith("/api/");
+};
+/** Whether this request should be sent to https: the mapping's own choice, else the global setting. */
+const wantsHttps = (req, ctx, host, hub) => {
+    // Tunnels, the hub and peers reach the http port on purpose and are already https on their public side.
+    if ((0, request_1.isTls)(req) || (hub && hub.kind !== "none") || (0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req))
+        return false;
+    if (req.headers["cf-ray"] || req.headers["cf-connecting-ip"] || req.headers["cdn-loop"])
+        return false;
+    const global = ctx.httpsRedirect?.() === true;
+    if (constants_1.default.dashboardHosts.includes(host))
+        return global && !dashboardExempt(req.url || "/");
+    const entry = ctx.lookup(host);
+    if (entry)
+        return entry.httpsRedirect ?? global;
+    return global && Boolean(ctx.localFor?.(host));
+};
+exports.wantsHttps = wantsHttps;
+/** 307 keeps the method and body, and isn't cached, so turning the setting off takes effect straight away. */
+const redirectToHttps = (req, res, ctx) => {
+    const name = (0, request_1.hostOf)(req);
+    const origin = (0, urls_1.formatUrl)(net_1.default.isIPv6(name) ? `[${name}]` : name, true, ctx.httpsPort?.() ?? constants_1.default.server.httpsPort);
+    const path = req.url?.startsWith("/") ? req.url : "/";
+    res.writeHead(307, { Location: origin + path, "Cache-Control": "no-store", "Content-Type": "text/plain; charset=utf-8" });
+    res.end(`Redirecting to ${origin}${path}\n`);
+};
+exports.redirectToHttps = redirectToHttps;

package/dist/proxy/router.js

@@ -20,6 +20,7 @@ const passthrough_1 = require("./passthrough");
 const request_1 = require("./request");
 const stats_1 = require("./stats");
 const protect_1 = require("./protect");
+const https_redirect_1 = require("./https-redirect");
 // Cloudflare swaps an origin's 502/504 for its own "bad gateway" page, so through a tunnel say 503 and the page survives.
 const downStatus = (req) => ((0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req) ? 503 : 502);
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
@@ -123,6 +124,10 @@ function handleRequest(req, res, ctx) {
     }
     const host = resolveHost(req, ctx, hub);
     try {
+        if ((0, https_redirect_1.wantsHttps)(req, ctx, host, hub)) {
+            (0, https_redirect_1.redirectToHttps)(req, res, ctx);
+            return;
+        }
         if (constants_1.default.dashboardHosts.includes(host)) {
             ctx.dashboard(req, res);
             return;

package/dist/server/index.js

@@ -17,6 +17,7 @@ const hub_tunnel_1 = require("../proxy/hub-tunnel");
 const hub_1 = require("../proxy/hub");
 const remote_1 = require("../proxy/remote");
 const hub_config_1 = __importDefault(require("../lib/hub-config"));
+const config_1 = __importDefault(require("../lib/config"));
 const file_1 = __importDefault(require("../utils/file"));
 const logger_1 = __importDefault(require("../utils/logger"));
 const certs_1 = require("../utils/certs");
@@ -68,6 +69,8 @@ async function startCentralProxy() {
         lookup: (host) => registry.get().hosts[tunnels.hostFor(host) ?? host],
         tunnelFor: (host) => tunnels.hostFor(host),
         ownPorts: () => [info.httpPort, info.httpsPort],
+        httpsRedirect: () => config_1.default.httpsRedirect(),
+        httpsPort: () => info.httpsPort,
         remoteFor: remote_1.remoteFor,
         localFor: remote_1.localFor,
         remoteHosts: (name) => Object.entries(registry.get().hosts)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",