Enable config option for secure auth cookies

Enable by default in release mode

src/server/config.rs

@@ -1,8 +1,13 @@
 use serde::Deserialize;
 
+/// Enable secure cookies by default only in release mode
+/// (Secure cookies can't be set over HTTP. Rough assumption: development is done over HTTP)
+const DEFAULT_COOKIES_SECURE: bool = cfg!(not(debug_assertions));
+
 #[derive(Debug, Clone, Deserialize)]
 pub struct AuthConfig {
     pub open_signup: bool,
+    pub cookies_secure: bool,
 }
 
 /// Build a connection URI from parts
@@ -153,6 +158,7 @@ pub fn load_config() -> Result<Config, config::ConfigError> {
     config::Config::builder()
         .set_default("server.port", 8080)?
         .set_default("auth.open_signup", false)?
+        .set_default("auth.cookies_secure", DEFAULT_COOKIES_SECURE)?
         .add_source(File::with_name(&format!("/etc/{pkg_name}/config")).required(false))
         .add_source(File::with_name(&format!("/etc/{pkg_name}")).required(false))
         .add_source(File::with_name("config").required(false))