From d283ece6835af3ff17f67206e1756e6ab8d2c1ce Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Wed, 4 Mar 2026 11:51:57 -0500
Subject: [PATCH] Fix demo mode: install rustls CryptoProvider, skip TLS, add
 ARC_DEMO env var

- Install ring CryptoProvider at CLI startup to prevent rustls panic
- Skip TLS in demo mode so the server uses plain HTTP
- Add ARC_DEMO=1 env var to web app config to bypass GitHub OAuth

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 Cargo.lock                            |  1 +
 apps/arc-web/app/lib/config.server.ts | 10 ++++++++--
 crates/arc-api/src/serve.rs           |  4 ++--
 crates/arc-cli/Cargo.toml             |  1 +
 crates/arc-cli/src/main.rs            |  2 ++
 5 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 04dc8a951..c593a2c98 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -196,6 +196,7 @@ dependencies = [
  "rand 0.8.5",
  "regex",
  "reqwest 0.12.28",
+ "rustls",
  "rustls-pemfile",
  "semver",
  "serde_json",
diff --git a/apps/arc-web/app/lib/config.server.ts b/apps/arc-web/app/lib/config.server.ts
index 2cfe62191..5ca049dd5 100644
--- a/apps/arc-web/app/lib/config.server.ts
+++ b/apps/arc-web/app/lib/config.server.ts
@@ -68,13 +68,19 @@ function loadAppConfig(): AppConfig {
   const rawApi = (raw.api ?? {}) as Partial<ApiConfig>;
   const rawGit = (raw.git ?? {}) as Partial<GitConfig>;
 
+  const demo = process.env.ARC_DEMO === "1";
+
   return {
     web: {
       ...WEB_DEFAULTS,
       url: (rawWeb.url as string) ?? WEB_DEFAULTS.url,
-      auth: { ...AUTH_DEFAULTS, ...rawWebAuth },
+      auth: demo
+        ? { provider: "insecure_disabled", allowed_usernames: [] }
+        : { ...AUTH_DEFAULTS, ...rawWebAuth },
     },
-    api: { ...API_DEFAULTS, ...rawApi },
+    api: demo
+      ? { ...API_DEFAULTS, authentication_strategy: "insecure_disabled" }
+      : { ...API_DEFAULTS, ...rawApi },
     git: { ...GIT_DEFAULTS, ...rawGit },
   };
 }
diff --git a/crates/arc-api/src/serve.rs b/crates/arc-api/src/serve.rs
index 1866c859c..22c712631 100644
--- a/crates/arc-api/src/serve.rs
+++ b/crates/arc-api/src/serve.rs
@@ -154,8 +154,8 @@ pub async fn serve_command(args: ServeArgs, styles: &'static Styles) -> anyhow::
         eprintln!("{}", styles.dim.apply_to("(dry-run mode)"));
     }
 
-    // Branch: TLS or plain HTTP
-    if let Some(ref tls_config) = server_config.api.tls {
+    // Branch: TLS or plain HTTP (demo mode always uses plain HTTP)
+    if let (false, Some(ref tls_config)) = (args.demo, &server_config.api.tls) {
         let client_auth = client_auth.unwrap();
 
         let rustls_config = crate::tls::build_rustls_config(tls_config, client_auth);
diff --git a/crates/arc-cli/Cargo.toml b/crates/arc-cli/Cargo.toml
index 10c588fe1..b0a2afa0d 100644
--- a/crates/arc-cli/Cargo.toml
+++ b/crates/arc-cli/Cargo.toml
@@ -32,6 +32,7 @@ semver.workspace = true
 reqwest.workspace = true
 jsonwebtoken.workspace = true
 base64.workspace = true
+rustls = { version = "0.23", default-features = false, features = ["std", "ring"] }
 rustls-pemfile = "2"
 x509-parser = "0.16"
 rand.workspace = true
diff --git a/crates/arc-cli/src/main.rs b/crates/arc-cli/src/main.rs
index 327b6481f..301337ad1 100644
--- a/crates/arc-cli/src/main.rs
+++ b/crates/arc-cli/src/main.rs
@@ -78,6 +78,8 @@ enum LlmCommand {
 
 #[tokio::main]
 async fn main() -> Result<()> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
     let cli = Cli::parse();
     if !cli.no_dotenv {
         if let Some(home) = dirs::home_dir() {