Subdomains use HTTPS if settings specify

[davidfischer]

This PR adds an option PUBLIC_DOMAIN_USES_HTTPS which if set will make all "view docs" links and everywhere that uses the resolver (eg. the version selector menu) default to HTTPS for *.readthedocs.iodomains. We know there is a valid certificate for these and so our generated links should use HTTPS.

This is step 1/5 on on getting to HTTPS everywhere:
#3282 (comment)

[ericholscher]

Looks good. This should be coupled w/ a PR to our ops repo that uses this setting!

[davidfischer]

👍

[rmzelle]

Would it be possible to have PUBLIC_DOMAIN_USES_HTTPS default to True for new RTD projects (and set to False for existing projects)?

[davidfischer]

I think there's some confusion about what PUBLIC_DOMAIN_USES_HTTPS will actually do. When we set this to true in production, that means anywhere where somebody clicks "view docs" and the link goes to *.readthedocs.io, the link will be HTTPS. This will apply to all projects where the domain for the docs is *.readthedocs.io both old and new.

Some people run the readthedocs open source project on their own infrastructure. They may or may not have SSL certificates. Likewise if this code is run locally, it shouldn't generate a HTTPS link to localhost. That's why this will default to false. However, in production, this will be true.

[rmzelle]

Ah, sorry, I thought it was a per-project setting. Never mind!

[davidfischer]

Ah, sorry, I thought it was a per-project setting. Never mind!

The per project part of it is that it won't apply to people using custom domains until we can support Let's Encrypt. Then we'll just change this to always use HTTPS in production.

[humitos]

Instead of override this outside the method you may use with inside the method and test the same cases you are testing now, but using PUBLIC_DOMAIN_USES_HTTPS=False and test that in that case both are http

[davidfischer]

That's a pretty good idea.

[davidfischer]

I'm wondering if I should somehow make the setting generic enough where it can later apply to custom domains or whether that will be a separate setting.

[davidfischer]

I'm wondering if I should somehow make the setting generic enough where it can later apply to custom domains or whether that will be a separate setting.

I don't want to overengineer this for now. I think we'll decide that when we add Let's Encrypt support. Whether we need another setting or we slightly tweak the purpose of this one, I think it'll be fine.

[ericholscher]

This should go out in a deploy early next week. 🎆