Use encrypted cookie sessions

settings.py

@@ -8,6 +8,8 @@ from functools import lru_cache
 @dataclass(frozen=True)
 class Settings:
     app_base_url: str | None
+    auth_secret_key: str | None
+    auth_cookie_secure: bool
     forgejo_base_url: str
     forgejo_token: str | None
     forgejo_oauth_client_id: str | None
@@ -44,12 +46,21 @@ def _parse_scopes(raw_value: str | None) -> tuple[str, ...]:
     return tuple(scope for scope in value.replace(",", " ").split() if scope)
 
 
+def _parse_bool(raw_value: str | None, *, default: bool = False) -> bool:
+    value = (raw_value or "").strip().lower()
+    if not value:
+        return default
+    return value in {"1", "true", "yes", "on"}
+
+
 @lru_cache(maxsize=1)
 def get_settings() -> Settings:
     return Settings(
         app_base_url=_normalize_base_url(os.getenv("APP_BASE_URL"))
         if os.getenv("APP_BASE_URL")
         else None,
+        auth_secret_key=os.getenv("AUTH_SECRET_KEY") or None,
+        auth_cookie_secure=_parse_bool(os.getenv("AUTH_COOKIE_SECURE")),
         forgejo_base_url=_normalize_base_url(os.getenv("FORGEJO_BASE_URL")),
         forgejo_token=os.getenv("FORGEJO_TOKEN") or None,
         forgejo_oauth_client_id=os.getenv("FORGEJO_OAUTH_CLIENT_ID") or None,