What's the motivation for having both? It'd be nicer to have one, but if customers need both we'll obvs do it.

Well, if we don't support having two listen addresses then coder won't be very useful unless it's behind a reverse proxy that can serve both HTTP and HTTPS or redirect from HTTP to HTTPS. And at that point, there's no point using coder's in built HTTPS support because you could just do it from your reverse proxy...

After we add this flag I'd like to add a flag to redirect from HTTP to HTTPS, which means coder could be used entirely without a reverse proxy and behave sensibly.

Is there a situation where a customer would want to serve Coder on both unencrypted HTTP and encrypted HTTPS? I think if the latter is present, they should always redirect HTTP to HTTPS.

That makes sense @ketang but at the moment since coder can only listen on one or the other users are forced to do this with a reverse proxy, which makes the TLS options in coder useless since they'll be doing TLS termination at the reverse proxy. I don't mind changing this issue so if we listen on both we always do a HTTPS redirect from HTTP.

Why can Coder only listen on one?

Coder only listens on one right now since we only have one listen address flag. If you don't specify TLS certs then it's a HTTP server, otherwise it's a HTTPS server.

Sounds like we're experiencing this with dev.coder.com - it doesn't automatically add HTTPS or redirect and therefore I see a broken page.

I removed the needs decision label because I think this would be beneficial. It just makes setup a bit simpler.

This is something I would like to help with! From a user perspective, I would prefer only having to set one option and it should automatically redirect HTTP -> HTTPS for us.

I don't know what implementation details look like but I think it could even be worth a breaking change for long-term UX improvements.

I'd like to work on this but I think we need to align on direction and implementation. Would love to hear thoughts.

This issue is becoming stale. In order to keep the tracker readable and actionable, I'm going close to this issue in 7 days if there isn't more activity.