save changes

src/Policy/StellaOps.Policy.Gateway/Program.cs

@@ -133,6 +133,9 @@ builder.Services.AddAuthentication();
 builder.Services.AddAuthorization();
 builder.Services.AddStellaOpsScopeHandler();
 builder.Services.AddPolicyPostgresStorage(builder.Configuration);
+// Also configure unnamed PostgresOptions so PolicyDataSource (IOptions<PostgresOptions>) resolves the connection string.
+builder.Services.Configure<StellaOps.Infrastructure.Postgres.Options.PostgresOptions>(
+    builder.Configuration.GetSection("Postgres:Policy"));
 builder.Services.AddMemoryCache();
 
 // Exception services
@@ -198,6 +201,20 @@ builder.Services.AddSingleton<IToolAccessEvaluator, ToolAccessEvaluator>();
 builder.Services.AddStellaOpsResourceServerAuthentication(
     builder.Configuration,
     configurationSection: $"{PolicyGatewayOptions.SectionName}:ResourceServer");
+
+// Accept self-signed certificates when HTTPS metadata validation is disabled (dev/Docker)
+if (!bootstrap.Options.ResourceServer.RequireHttpsMetadata)
+{
+    builder.Services.ConfigureHttpClientDefaults(clientBuilder =>
+    {
+        clientBuilder.ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback =
+                HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
+        });
+    });
+}
+
 builder.Services.AddSingleton<PolicyGatewayMetrics>();
 builder.Services.AddSingleton<PolicyGatewayDpopProofGenerator>();
 builder.Services.AddSingleton<PolicyEngineTokenProvider>();