You can give a path to your SSL cert in the config, and set "protocol" to "https" and you're done. If you're using Certbot, give the path to the live cert and it will work even after renewal.
About CSRF, as the framework is focused on APIs, the use of cookies is possible but not recommended, so you won't need CSRF protection when using Goyave.
About CSRF, as the framework is focused on APIs, the use of cookies is possible but not recommended, so you won't need CSRF protection when using Goyave.