Redirect HTTP requests on HTTPS port

[markcallen]

Summary

• redirect plain HTTP requests sent to the published HTTPS port back to the equivalent https:// URL while preserving host and port
• add E2E coverage for the redirect behavior
• add Chromium --test-type under no-new-privileges and document the warning suppression behavior

Tests

• sh -n scripts/guacamole-config.sh
• bash -n scripts/e2e-guacamole.sh
• scripts/e2e-guacamole.sh

[Copilot]

Pull request overview

This PR improves Hatch’s HTTPS ingress behavior by redirecting plain HTTP sent to the published HTTPS port to the equivalent https:// URL (preserving host/port), and tightens runtime behavior/documentation around Chromium when running under no-new-privileges.

Changes:

• Add an nginx redirect for HTTP requests mistakenly sent to the HTTPS listener (nginx 497 → 301).
• Extend the Guacamole E2E script to validate the redirect behavior and to assert Chromium starts with --test-type under no-new-privileges.
• Update docs/PRD to describe the Chromium warning suppression behavior and capture the new redirect acceptance criterion.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/guacamole-config.sh	Adds nginx error_page 497 redirect to https://$http_host$request_uri.
scripts/e2e-guacamole.sh	Adds redirect validation and checks for Chromium --test-type in E2E.
config/chromium-launch.sh	Appends --test-type when NoNewPrivs: 1 is detected.
README.md	Documents --test-type being added under no-new-privileges.
INSTALL.md	Updates Chromium sandbox section to mention --test-type behavior.
PRD.md	Adds acceptance criteria for HTTP→HTTPS-on-HTTPS-port redirect and warning suppression.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.