HTTPS mode for the Docker image (installable app on the home network)

littlefox commented

2026-10-18 10:11:29 +00:00

Owner

User, after installing the PWA on Android from the LAN container: "After having Installed the PWA I still se an address bar upon opening it." Cause: the page is plain http (Chrome shows a URL bar for insecure installed apps, and can't build a WebAPK for a LAN address).

User: "yes, build the HTTPS mode after #96 and #97".

Plan:

An optional HTTPS mode in the container: Caddy tls internal on a second port, plus /relay proxied to kom-relay so the page and the relay share one https origin.
The app: on an https page, the default server becomes wss://<host>[:port]/relay instead of ws://<host>:4895 (also needed for #71).
The guide: installing Caddy's root certificate on Android once, and what to expect (likely standalone without the bar; a full WebAPK still needs a public address, #71).
A test with the e2e or smoke harness over https.

User, after installing the PWA on Android from the LAN container: "After having Installed the PWA I still se an address bar upon opening it." Cause: the page is plain http (Chrome shows a URL bar for insecure installed apps, and can't build a WebAPK for a LAN address). User: "yes, build the HTTPS mode after #96 and #97". Plan: - An optional HTTPS mode in the container: Caddy `tls internal` on a second port, plus `/relay` proxied to kom-relay so the page and the relay share one https origin. - The app: on an https page, the default server becomes `wss://<host>[:port]/relay` instead of `ws://<host>:4895` (also needed for #71). - The guide: installing Caddy's root certificate on Android once, and what to expect (likely standalone without the bar; a full WebAPK still needs a public address, #71). - A test with the e2e or smoke harness over https.

littlefox added the

area/packaging

area/web

kind/feature

labels

2026-10-18 10:11:29 +00:00

littlefox referenced this issue

2026-10-18 10:17:54 +00:00

Notifications #103

littlefox referenced this issue

2026-10-18 11:01:11 +00:00

Host a test server for the web app (HTTPS) #71

littlefox commented

2026-10-18 11:01:12 +00:00

Author

Owner

If this works on the user's phone, #71 leaves the 0.2 milestone (user, 2026-10-18), and #51's real-phone check can be done against this HTTPS mode instead.

littlefox referenced this issue from a pull request that will close it,

2026-10-18 11:51:15 +00:00

HTTPS mode for the Docker image: installable on the home network #111

littlefox referenced this issue from a commit

2026-10-18 11:51:16 +00:00

HTTPS mode for the Docker image: installable on the home network

littlefox closed this issue

2026-10-18 12:27:39 +00:00

littlefox commented

2026-10-18 12:31:37 +00:00

Author

Owner

Merged in #111; the image (git-d4d6827) is published and the user's container on 192.168.0.11 runs it with NEOKOM_HTTPS=192.168.0.11. Verified: tools/web-image-smoke.sh passes on the published image (http and https: CA download, https checked against that CA, browser login over wss, secure context, active service worker). On the LAN address: https://192.168.0.11:8443/ verifies against the downloaded CA (Caddy Local Authority - 2026 ECC Root, SHA-256 3D:DA:E0:ED:…:3D:54, valid to 2036), the login page's server field says wss://192.168.0.11:8443/relay, the service worker is active, and a WebSocket through /relay gets the server's greeting. Next: the user's phone (#51); if that works, #71 leaves the 0.2 milestone (D-038).