add support for http.

docker-compose.quickstart.yml

@@ -10,7 +10,8 @@ services:
         - type=local,dest=.docker-cache/buildx,mode=max
     container_name: overlord-server
     ports:
-      - "5173:5173"
+      # Bind host-published port. Use 127.0.0.1 for local reverse proxies (ngrok/caddy/traefik).
+      - "${OVERLORD_PUBLISH_HOST:-0.0.0.0}:5173:5173"
     environment:
       # Optional username for first admin user
       - OVERLORD_USER=admin
@@ -28,6 +29,9 @@ services:
       # Set true only behind a trusted reverse proxy that terminates TLS (for example Render).
       # Default false keeps current behavior: Overlord terminates TLS in-process.
       - OVERLORD_TLS_OFFLOAD=false
+      # Cookie security mode: auto (default), true, or false.
+      # auto: Secure cookie on HTTPS requests / X-Forwarded-Proto=https.
+      - OVERLORD_AUTH_COOKIE_SECURE=auto
       # Optional certbot integration (used only when NODE_ENV=production)
       - OVERLORD_TLS_CERTBOT_ENABLED=false
       - OVERLORD_TLS_CERTBOT_LIVE_PATH=/etc/letsencrypt/live
@@ -50,7 +54,8 @@ services:
     networks:
       - overlord-network
     healthcheck:
-      test: ["CMD", "curl", "-f", "-k", "https://localhost:5173/health"]
+      # Use http:// when OVERLORD_TLS_OFFLOAD=true.
+      test: ["CMD-SHELL", "curl -f ${OVERLORD_HEALTHCHECK_URL:-https://localhost:5173/health} >/dev/null 2>&1 || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3