fix/wss for all

.gitignore

@@ -1,3 +1,6 @@
+# local dev TLS certificates (generated by scripts/setup-dev-certs.sh)
+/certs
+
 # dependencies
 /node_modules
 /.pnp

CONTRIBUTING.md

@@ -48,14 +48,24 @@ Now every time you commit the lint and format commands will run automatically.
 
 ### Testing Environment
 
-For testing features locally, we provide a complete IRC testing stack with Docker Compose:
+For testing features locally, we provide a complete IRC testing stack with Docker Compose (ergo IRC server + 3 bots over TLS).
 
-#### Start Testing Stack (IRC Server + 3 Bots)
+#### First-time setup (once per machine)
+
+Install [mkcert](https://github.com/FiloSottile/mkcert), then:
+```bash
+npm run gen-certs
+```
+This installs the local CA into your OS trust store and writes a `.env` file used by compose.
+
+#### Start the stack
 ```bash
 # in one terminal
 npm run dev
 # in another terminal
-docker-compose --profile testing up -d
+npm run run-dev-stack
 ```
 
-Now you can connect to `ws://localhost:8097` with any nickname and check the `#test` channel.
+To stop: `npm run stop-dev-stack`
+
+Connect with `wss://localhost:8097` (browser/WebView) or `ircs://localhost:6697` (Tauri native TCP) and join `#test`.

compose.yaml

@@ -13,18 +13,43 @@ services:
       timeout: 10s
       retries: 3
 
+  gen-certs:
+    image: alpine:3.20
+    volumes:
+      - ${MKCERT_CAROOT:?Run ./scripts/setup-dev-certs.sh first}:/caroot:ro
+      - ./certs:/certs
+    command:
+      - sh
+      - -c
+      - |
+        openssl x509 -noout -in /certs/server.pem 2>/dev/null && exit 0
+        apk add --no-cache openssl -q
+        openssl genrsa -out /certs/server-key.pem 2048
+        openssl req -new -key /certs/server-key.pem -out /tmp/csr.pem -subj "/CN=localhost"
+        printf '[SAN]\nsubjectAltName=DNS:localhost,IP:127.0.0.1,IP:::1\n' > /tmp/ext.cnf
+        openssl x509 -req -in /tmp/csr.pem \
+          -CA /caroot/rootCA.pem -CAkey /caroot/rootCA-key.pem -set_serial 1 \
+          -out /certs/server.pem -days 825 -sha256 -extfile /tmp/ext.cnf -extensions SAN
+    profiles:
+      - testing
+
   # TODO - Add IRC daemon + backend etc
   ircd:
     init: true
     # TODO: Use our unrealircd custom image instead
     image: ghcr.io/ergochat/ergo:master
     container_name: ergo
     ports:
-      - '8097:8097'
-      - '6667:6667'
+      - '6667:6667'   # plain IRC (bots)
+      - '6697:6697'   # IRC over TLS — ircs://localhost:6697 (Tauri native TCP)
+      - '8097:8097'   # WebSocket over TLS — wss://localhost:8097 (browser / WebView)
     restart: unless-stopped
+    depends_on:
+      gen-certs:
+        condition: service_completed_successfully
     volumes:
       - ./docker/ergo.yaml:/ircd/ircd.yaml
+      - ./certs:/ircd/certs:ro
     profiles:
       - testing
 

docker/ergo.yaml

@@ -34,49 +34,24 @@ server:
 
     # addresses to listen on
     listeners:
-        # The standard plaintext port for IRC is 6667. Allowing plaintext over the
-        # public Internet poses serious security and privacy issues. Accordingly,
-        # we recommend using plaintext only on local (loopback) interfaces:
-        # "127.0.0.1:6667": # (loopback ipv4, localhost-only)
-        # "[::1]:6667":     # (loopback ipv6, localhost-only)
-        # If you need to serve plaintext on public interfaces, comment out the above
-        # two lines and uncomment the line below (which listens on all interfaces):
+        # Plain IRC — used by Docker-internal bot connections only
         ":6667":
-        # Alternately, if you have a TLS certificate issued by a recognized CA,
-        # you can configure port 6667 as an STS-only listener that only serves
-        # "redirects" to the TLS port, but doesn't allow chat. See the manual
-        # for details.
-
-        # The standard SSL/TLS port for IRC is 6697. This will listen on all interfaces:
-        # ":6697":
-        #     # this is a standard TLS configuration with a single certificate;
-        #     # see the manual for instructions on how to configure SNI
-        #     tls:
-        #         cert: fullchain.pem
-        #         key: privkey.pem
-        #     # 'proxy' should typically be false. It's for cloud load balancers that
-        #     # always send a PROXY protocol header ahead of the connection. See the
-        #     # manual ("Reverse proxies") for more details.
-        #     proxy: false
-        #     # set the minimum TLS version:
-        #     min-tls-version: 1.2
-
-        # Example of a Unix domain socket for proxying:
-        # "/tmp/ergo_sock":
-
-        # Example of a Tor listener: any connection that comes in on this listener will
-        # be considered a Tor connection. It is strongly recommended that this listener
-        # *not* be on a public interface --- it should be on 127.0.0.0/8 or unix domain:
-        # "/hidden_service_sockets/ergo_tor_sock":
-        #     tor: true
-
-        # Example of a WebSocket listener:
+
+        # IRC over TLS (ircs://) — used by Tauri native TCP connections
+        # Requires certs generated by: scripts/setup-dev-certs.sh
+        ":6697":
+            tls:
+                cert: /ircd/certs/server.pem
+                key: /ircd/certs/server-key.pem
+            min-tls-version: 1.2
+
+        # WebSocket over TLS (wss://) — used by browser / Tauri WebView
         ":8097":
             websocket: true
-            # This is non TLS if disabled
-            # tls:
-            #     cert: fullchain.pem
-            #     key: privkey.pem
+            tls:
+                cert: /ircd/certs/server.pem
+                key: /ircd/certs/server-key.pem
+            min-tls-version: 1.2
 
     # sets the permissions for Unix listen sockets. on a typical Linux system,
     # the default is 0775 or 0755, which prevents other users/groups from connecting

package.json

@@ -20,6 +20,9 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "test:debug": "vitest --inspect-brk --browser --no-file-parallelism",
+    "gen-certs": "bash scripts/setup-dev-certs.sh",
+    "run-dev-stack": "docker compose --profile testing up --remove-orphans",
+    "stop-dev-stack": "docker compose --profile testing down --remove-orphans",
     "tauri": "tauri"
   },
   "dependencies": {

scripts/setup-dev-certs.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# One-time per machine: installs mkcert CA into the OS trust store and writes
+# MKCERT_CAROOT to .env so compose can mount it for cert generation.
+# Requires mkcert: brew install mkcert  |  choco install mkcert
+
+command -v mkcert >/dev/null || { echo "mkcert not found"; exit 1; }
+
+mkcert -install
+echo "MKCERT_CAROOT=$(mkcert -CAROOT)" > "$(dirname "$0")/../.env"
+echo "Done. Run: docker compose --profile testing up -d"

src/components/ui/AddServerModal.tsx

@@ -84,7 +84,7 @@ export const AddServerModal: React.FC = () => {
         const port = Number.parseInt(serverPort, 10);
         // Remove any existing protocol prefix from serverHost
         const cleanHost = serverHost.replace(
-          /^(https?|wss?|ircs?|irc):\/\//,
+          /^(https?|wss|ircs?|irc):\/\//,
           "",
         );
 

src/components/ui/LinkSecurityWarningModal.tsx

@@ -25,7 +25,6 @@ const SingleWarningModal: React.FC<WarningModalProps> = ({
   const [timerExpired, setTimerExpired] = useState(false);
   const [isScrolledToBottom, setIsScrolledToBottom] = useState(false);
   const [hasScrollbar, setHasScrollbar] = useState(false);
-  const [skipLocalhostWarning, setSkipLocalhostWarning] = useState(false);
   const [skipLinkSecurityWarning, setSkipLinkSecurityWarning] = useState(false);
   const scrollContainerRef = useRef<HTMLDivElement>(null);
   const timerStartedRef = useRef(false);
@@ -82,8 +81,6 @@ const SingleWarningModal: React.FC<WarningModalProps> = ({
   const serverName =
     server.name || serverConfig?.name || server.host || "Unknown Server";
   const securityLevel = server.linkSecurity || 0;
-  const isLocalhost =
-    server.host === "localhost" || server.host === "127.0.0.1";
   const isLinkSecurityWarning =
     server.linkSecurity !== undefined && server.linkSecurity < 2;
 
@@ -111,8 +108,6 @@ const SingleWarningModal: React.FC<WarningModalProps> = ({
       if (s.id === serverId) {
         return {
           ...s,
-          ...(skipLocalhostWarning &&
-            isLocalhost && { skipLocalhostWarning: true }),
           ...(skipLinkSecurityWarning &&
             isLinkSecurityWarning && { skipLinkSecurityWarning: true }),
         };
@@ -224,38 +219,6 @@ const SingleWarningModal: React.FC<WarningModalProps> = ({
 
             {/* Security Issues List */}
             <div className="space-y-3">
-              {isLocalhost && (
-                <div className="bg-yellow-500 bg-opacity-10 border border-yellow-500 border-opacity-30 rounded p-3">
-                  <div className="flex items-start gap-2">
-                    <FaExclamationTriangle className="text-yellow-500 text-sm mt-0.5 flex-shrink-0" />
-                    <div className="space-y-1">
-                      <p className="text-sm font-semibold text-yellow-200">
-                        Unencrypted Connection (Localhost)
-                      </p>
-                      <p className="text-xs text-yellow-100">
-                        This connection uses an unencrypted WebSocket (
-                        <code className="bg-black bg-opacity-30 px-1 rounded">
-                          ws://
-                        </code>
-                        ) instead of secure WebSocket (
-                        <code className="bg-black bg-opacity-30 px-1 rounded">
-                          wss://
-                        </code>
-                        ). While localhost connections are typically safe for
-                        development, any communication could be visible to
-                        others on your local network or to malicious software
-                        running on your computer.
-                      </p>
-                      <p className="text-xs text-yellow-100">
-                        <strong>Risk:</strong> Messages, passwords, and
-                        authentication tokens could be intercepted by network
-                        sniffers or malware on your local machine.
-                      </p>
-                    </div>
-                  </div>
-                </div>
-              )}
-
               {isLinkSecurityWarning && (
                 <div className="bg-orange-500 bg-opacity-10 border border-orange-500 border-opacity-30 rounded p-3">
                   <div className="flex items-start gap-2">
@@ -302,7 +265,7 @@ const SingleWarningModal: React.FC<WarningModalProps> = ({
                 </div>
               )}
 
-              {!isLocalhost && !isLinkSecurityWarning && (
+              {!isLinkSecurityWarning && (
                 <div className="bg-yellow-500 bg-opacity-10 border border-yellow-500 border-opacity-30 rounded p-3">
                   <p className="text-sm text-yellow-200">
                     <strong>⚠️ Security Risk!</strong> This connection may be
@@ -313,33 +276,18 @@ const SingleWarningModal: React.FC<WarningModalProps> = ({
             </div>
 
             {/* Recommendation */}
-            {(isLocalhost || isLinkSecurityWarning) && (
+            {isLinkSecurityWarning && (
               <div className="bg-blue-500 bg-opacity-10 border border-blue-500 border-opacity-30 rounded p-3">
                 <p className="text-xs text-blue-200">
                   <strong>💡 Recommendation:</strong> Only proceed if you trust
                   this server and understand the risks. Avoid sharing sensitive
                   information or passwords over this connection.
-                  {isLocalhost &&
-                    " For production use, configure your server with SSL/TLS and use wss:// instead of ws://."}
                 </p>
               </div>
             )}
 
             {/* Checkboxes for remembering choice */}
             <div className="space-y-2">
-              {isLocalhost && (
-                <label className="flex items-center gap-2 text-sm text-discord-text-muted cursor-pointer hover:text-discord-text">
-                  <input
-                    type="checkbox"
-                    checked={skipLocalhostWarning}
-                    onChange={(e) => setSkipLocalhostWarning(e.target.checked)}
-                    className="rounded border-discord-dark-200"
-                  />
-                  <span>
-                    Don't warn me about localhost connections for this server
-                  </span>
-                </label>
-              )}
               {isLinkSecurityWarning && (
                 <label className="flex items-center gap-2 text-sm text-discord-text-muted cursor-pointer hover:text-discord-text">
                   <input

src/lib/ircClient.ts

@@ -476,8 +476,7 @@ export class IRCClient {
 
     // Create a new connection promise and store it
     const connectionPromise = new Promise<Server>((resolve, reject) => {
-      // for local testing and automated tests, if domain is localhost or 127.0.0.1 use ws instead of wss
-      let protocol = ["localhost", "127.0.0.1"].includes(host) ? "ws" : "wss";
+      let protocol: "wss" | "ircs" | "irc" = "wss";
       let actualHost = host;
       let actualPort = port;
 
@@ -488,13 +487,19 @@ export class IRCClient {
         protocol = parsed.scheme;
         actualHost = parsed.host;
         actualPort = parsed.port;
-      } else if (host.startsWith("ws://") || host.startsWith("wss://")) {
-        // Parse ws/wss URLs
-        const urlMatch = host.match(/^(wss?):\/\/([^:]+)(?::(\d+))?/);
+      } else if (host.startsWith("wss://")) {
+        // Parse wss:// URLs
+        const urlMatch = host.match(/^wss:\/\/([^:]+)(?::(\d+))?/);
         if (urlMatch) {
-          protocol = urlMatch[1] as "ws" | "wss";
-          actualHost = urlMatch[2];
-          actualPort = urlMatch[3] ? Number.parseInt(urlMatch[3], 10) : port;
+          actualHost = urlMatch[1];
+          actualPort = urlMatch[2] ? Number.parseInt(urlMatch[2], 10) : port;
+        }
+      } else if (host.startsWith("ws://")) {
+        // Upgrade legacy ws:// to wss:// — unencrypted WebSockets are no longer supported
+        const urlMatch = host.match(/^ws:\/\/([^:]+)(?::(\d+))?/);
+        if (urlMatch) {
+          actualHost = urlMatch[1];
+          actualPort = urlMatch[2] ? Number.parseInt(urlMatch[2], 10) : port;
         }
       }
 

src/lib/socket.ts

@@ -162,7 +162,7 @@ export class WebSocketWrapper implements ISocket {
 }
 
 export function createSocket(url: string): ISocket {
-  if (url.startsWith("ws://") || url.startsWith("wss://")) {
+  if (url.startsWith("wss://")) {
     return new WebSocketWrapper(url);
   }
   if (url.startsWith("irc://") || url.startsWith("ircs://")) {

src/store/index.ts

@@ -50,7 +50,7 @@ function generateDeterministicId(serverId: string, name: string): string {
 function normalizeHost(host: string): string {
   if (host.includes("://")) {
     // Extract hostname from URL format
-    const withoutProtocol = host.replace(/^(irc|ircs|ws|wss):\/\//, "");
+    const withoutProtocol = host.replace(/^(irc|ircs|wss):\/\//, "");
     return withoutProtocol.split(":")[0]; // Get just hostname, strip port if present
   }
   return host;
@@ -61,15 +61,8 @@ function ensureUrlFormat(host: string, port: number): string {
   if (host.includes("://")) {
     return host; // Already in URL format
   }
-  // Convert old hostname-only format to URL
-  const isLocalhost =
-    host === "localhost" || host === "127.0.0.1" || host === "::1";
-  const scheme = isLocalhost
-    ? "ws"
-    : port === 6697 || port === 9999 || port === 443 || port === 993
-      ? "wss"
-      : "ws";
-  return `${scheme}://${host}:${port}`;
+  // Convert old hostname-only format to URL — always wss://
+  return `wss://${host}:${port}`;
 }
 
 // Types for batch event processing
@@ -5899,13 +5892,9 @@ ircClient.on("CAP LS", ({ serverId, cliCaps }) => {
         return { servers: updatedServers };
       });
 
-      // Check for insecure connection and show warning modal
+      // Show warning modal for low UnrealIRCd link-security value
       const currentState = useStore.getState();
       const currentServer = currentState.servers.find((s) => s.id === serverId);
-      const isLocalhost =
-        currentServer &&
-        (currentServer.host === "localhost" ||
-          currentServer.host === "127.0.0.1");
       const hasLowLinkSecurity = linkSecurityValue < 2;
 
       // Check if we should show warning based on individual skip preferences
@@ -5918,12 +5907,10 @@ ircClient.on("CAP LS", ({ serverId, cliCaps }) => {
           )
         : undefined;
 
-      const shouldWarnLocalhost =
-        isLocalhost && !serverConfig?.skipLocalhostWarning;
       const shouldWarnLinkSecurity =
         hasLowLinkSecurity && !serverConfig?.skipLinkSecurityWarning;
 
-      if (shouldWarnLocalhost || shouldWarnLinkSecurity) {
+      if (shouldWarnLinkSecurity) {
         useStore.setState((state) => {
           // Check if warning already exists for this server
           const existingWarning = state.ui.linkSecurityWarnings.find(