Auto-generate self-signed TLS certs on startup

getUserMedia requires HTTPS, so generate certs if missing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/index.tsx

@@ -22,16 +22,26 @@ app.get('/ggwave.js', () =>
 
 startup(PORT)
 
-const hasCerts = await Bun.file('./certs/cert.pem').exists()
+async function ensureCerts() {
+  const certPath = './certs/cert.pem'
+  const keyPath = './certs/key.pem'
+  if (await Bun.file(certPath).exists()) return
+
+  const { mkdirSync } = await import('fs')
+  mkdirSync('./certs', { recursive: true })
+  Bun.spawnSync(['openssl', 'req', '-x509', '-newkey', 'rsa:2048',
+    '-keyout', keyPath, '-out', certPath,
+    '-days', '365', '-nodes', '-subj', '/CN=localhost'])
+}
+
+await ensureCerts()
 
 export default {
   ...app.defaults,
   port: PORT,
   idleTimeout: 255,
-  ...(hasCerts && {
+  tls: {
-    tls: {
+    key: Bun.file('./certs/key.pem'),
-      key: Bun.file('./certs/key.pem'),
+    cert: Bun.file('./certs/cert.pem'),
-      cert: Bun.file('./certs/cert.pem'),
+  },
-    },
-  }),
 }