HTTPS warning in production

[Twixes]

Is your feature request related to a problem?

It should be emphasized that PostHog should be ran in production with TLS.

Describe the solution you'd like

A fixed bar – similar to the debug one – warning that TLS (https://) is a must when running over http:// with DEBUG false.

Additional context

This was suggested by @mariusandra in the onboarding rework Figma document.

Thank you for your feature request – we love each and every one!

[paolodamico]

I'll update the Figma on #1408 with the suggestions, to push more on users setting up TLS correctly. I still think that we should allow users to continue even without TLS on the setup because sometimes you might have to wait a bit (e.g. if the CA hasn't issued the certificate), and therefore having this extra banner would be great!

[mariusandra]

Agreed that posthog should definitely run over HTTP as well. This situation is very common if you're setting up the server manually to try it out. We should just tell the user of the tradeoffs with a big enough warning label that saves our ass if someone gets MITM'd this way.

In fact, restricting access on HTTP and just allowing HTTPS is almost impossible. Since TLS is handled outside posthog, we have no way of knowing for certain if it's behind a HTTPS proxy or not.