krz/gitbay

https: set the TLS minimum version explicitly !490

merged merged by cmc on 2026-09-28 21:49 UTC · krz/gitbay:https-tls-minimum into main

Discussion

cmc

The HTTPS listener sets TLS 1.2 as its minimum explicitly.

  • serverTLS (cmd/gitbayd/tls.go) sets MinVersion: tls.VersionTLS12 on the config served in both TLS modes; in acme mode it keeps autocert's certificate callback and ALPN protocols.
  • Admin page and Architecture/06 say so; #281 leaves Known-Gaps; CHANGELOG.

First MR of the server-hardening stack (plan docs/plans/2026-09-27-server-hardening.md), stacked on !488.

Closes #281