fix: make TLS configurable in goosed agent via GOOSE_TLS env var (#7686)

crates/goose-server/src/commands/agent.rs

@@ -40,7 +40,7 @@ pub async fn run() -> Result<()> {
     let secret_key =
         std::env::var("GOOSE_SERVER__SECRET_KEY").unwrap_or_else(|_| "test".to_string());
 
-    let app_state = state::AppState::new().await?;
+    let app_state = state::AppState::new(settings.tls).await?;
 
     let cors = CorsLayer::new()
         .allow_origin(Any)
@@ -55,16 +55,6 @@ pub async fn run() -> Result<()> {
         .layer(cors);
 
     let addr = settings.socket_addr();
-    let tls_setup = self_signed_config().await?;
-
-    let handle = Handle::new();
-    let shutdown_handle = handle.clone();
-    tokio::spawn(async move {
-        shutdown_signal().await;
-        shutdown_handle.graceful_shutdown(None);
-    });
-
-    info!("listening on https://{}", addr);
 
     let tunnel_manager = app_state.tunnel_manager.clone();
     tokio::spawn(async move {
@@ -76,10 +66,31 @@ pub async fn run() -> Result<()> {
         gateway_manager.check_auto_start().await;
     });
 
-    axum_server::bind_rustls(addr, tls_setup.config)
-        .handle(handle)
-        .serve(app.into_make_service())
-        .await?;
+    if settings.tls {
+        let tls_setup = self_signed_config().await?;
+
+        let handle = Handle::new();
+        let shutdown_handle = handle.clone();
+        tokio::spawn(async move {
+            shutdown_signal().await;
+            shutdown_handle.graceful_shutdown(None);
+        });
+
+        info!("listening on https://{}", addr);
+
+        axum_server::bind_rustls(addr, tls_setup.config)
+            .handle(handle)
+            .serve(app.into_make_service())
+            .await?;
+    } else {
+        let listener = tokio::net::TcpListener::bind(addr).await?;
+
+        info!("listening on http://{}", addr);
+
+        axum::serve(listener, app)
+            .with_graceful_shutdown(async { shutdown_signal().await })
+            .await?;
+    }
 
     if goose::otel::otlp::is_otlp_initialized() {
         tokio::time::sleep(tokio::time::Duration::from_millis(100)).await;

crates/goose-server/src/configuration.rs

@@ -9,6 +9,8 @@ pub struct Settings {
     pub host: String,
     #[serde(default = "default_port")]
     pub port: u16,
+    #[serde(default = "default_tls")]
+    pub tls: bool,
 }
 
 impl Settings {
@@ -28,6 +30,7 @@ impl Settings {
             // Server defaults
             .set_default("host", default_host())?
             .set_default("port", default_port())?
+            .set_default("tls", default_tls())?
             // Layer on the environment variables
             .add_source(
                 Environment::with_prefix("GOOSE")
@@ -74,6 +77,10 @@ fn default_port() -> u16 {
     3000
 }
 
+fn default_tls() -> bool {
+    true
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -83,6 +90,7 @@ mod tests {
         let server_settings = Settings {
             host: "127.0.0.1".to_string(),
             port: 3000,
+            tls: true,
         };
         let addr = server_settings.socket_addr();
         assert_eq!(addr.to_string(), "127.0.0.1:3000");

crates/goose-server/src/routes/action_required.rs

@@ -72,7 +72,7 @@ mod tests {
 
         #[tokio::test(flavor = "multi_thread")]
         async fn test_tool_confirmation_endpoint() {
-            let state = AppState::new().await.unwrap();
+            let state = AppState::new(true).await.unwrap();
 
             let app = routes(state);
 

crates/goose-server/src/routes/reply.rs

@@ -480,7 +480,7 @@ mod tests {
 
         #[tokio::test(flavor = "multi_thread")]
         async fn test_reply_endpoint() {
-            let state = AppState::new().await.unwrap();
+            let state = AppState::new(true).await.unwrap();
 
             let app = routes(state);
 

crates/goose-server/src/state.rs

@@ -29,11 +29,11 @@ pub struct AppState {
 }
 
 impl AppState {
-    pub async fn new() -> anyhow::Result<Arc<AppState>> {
+    pub async fn new(tls: bool) -> anyhow::Result<Arc<AppState>> {
         register_builtin_extensions(goose_mcp::BUILTIN_EXTENSIONS.clone());
 
         let agent_manager = AgentManager::instance().await?;
-        let tunnel_manager = Arc::new(TunnelManager::new());
+        let tunnel_manager = Arc::new(TunnelManager::new(tls));
         let gateway_manager = Arc::new(GatewayManager::new(agent_manager.clone())?);
 
         Ok(Arc::new(Self {

crates/goose-server/src/tunnel/mod.rs

@@ -91,16 +91,17 @@ pub struct TunnelManager {
     restart_tx: Arc<RwLock<Option<mpsc::Sender<()>>>>,
     watchdog_handle: Arc<RwLock<Option<tokio::task::JoinHandle<()>>>>,
     lock_file: Arc<std::sync::Mutex<Option<File>>>,
+    scheme: String,
 }
 
 impl Default for TunnelManager {
     fn default() -> Self {
-        Self::new()
+        Self::new(true)
     }
 }
 
 impl TunnelManager {
-    pub fn new() -> Self {
+    pub fn new(tls: bool) -> Self {
         TunnelManager {
             state: Arc::new(RwLock::new(TunnelState::Idle)),
             info: Arc::new(RwLock::new(None)),
@@ -108,6 +109,7 @@ impl TunnelManager {
             restart_tx: Arc::new(RwLock::new(None)),
             watchdog_handle: Arc::new(RwLock::new(None)),
             lock_file: Arc::new(std::sync::Mutex::new(None)),
+            scheme: if tls { "https" } else { "http" }.to_string(),
         }
     }
 
@@ -229,7 +231,7 @@ impl TunnelManager {
             tunnel_secret,
             server_secret,
             agent_id,
-            "https",
+            &self.scheme,
             self.lapstone_handle.clone(),
             restart_tx,
         )
@@ -317,6 +319,7 @@ impl TunnelManager {
             restart_tx: self.restart_tx.clone(),
             watchdog_handle: self.watchdog_handle.clone(),
             lock_file: self.lock_file.clone(),
+            scheme: self.scheme.clone(),
         }
     }