HTTPS mode for the Docker image: installable on the home network #111

Merged

littlefox merged 2 commits from issue-98-https into main

2026-10-18 12:27:39 +00:00

littlefox commented

2026-10-18 11:51:15 +00:00

Owner

Closes #98

NEOKOM_HTTPS=<address>: Caddy also serves the app on 8443 with its own local CA (on the neokom-data volume, so devices trust it once). The root can be downloaded at http://<host>:8080/neokom-ca.crt.
/relay: proxied to kom-relay on both sites. On an https: page the app's default server is now wss://<page host>/relay; http pages keep ws://<host>:4895.
docs/DOCKER.md: a new HTTPS section: turn it on, trust the certificate on Android/iPhone, install, what to expect (no address bar; no full WebAPK without a public server), what trusting a CA means, and how to undo it. Settings and security sections updated.
D-038: #71 leaves the 0.2 milestone once this works on the user's phone.

Verified with tools/web-image-smoke.sh against the devserver:

CA download works.
The https page verifies with curl against that CA.
A Chromium login works over wss://127.0.0.1:18443/relay, with a secure context and an active service worker (the browser trusted the key, as a phone trusts the CA).
The http checks still pass.
Clippy (native and wasm32) is clean.

The real-phone part (#51) is for the user.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

Closes #98 - **`NEOKOM_HTTPS=<address>`:** Caddy also serves the app on **8443** with its own local CA (on the `neokom-data` volume, so devices trust it once). The root can be downloaded at `http://<host>:8080/neokom-ca.crt`. - **`/relay`:** proxied to kom-relay on both sites. On an `https:` page the app's default server is now `wss://<page host>/relay`; http pages keep `ws://<host>:4895`. - **docs/DOCKER.md:** a new HTTPS section: turn it on, trust the certificate on Android/iPhone, install, what to expect (no address bar; no full WebAPK without a public server), what trusting a CA means, and how to undo it. Settings and security sections updated. - **D-038:** #71 leaves the 0.2 milestone once this works on the user's phone. Verified with `tools/web-image-smoke.sh` against the devserver: - CA download works. - The https page verifies with curl against that CA. - A Chromium login works over `wss://127.0.0.1:18443/relay`, with a secure context and an active service worker (the browser trusted the key, as a phone trusts the CA). - The http checks still pass. - Clippy (native and wasm32) is clean. The real-phone part (#51) is for the user. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

littlefox added 1 commit

2026-10-18 11:51:15 +00:00

HTTPS mode for the Docker image: installable on the home network

packaging / arch (pull_request) Has started running

Details

packaging / debian (pull_request) Has started running

Details

packaging / fedora (pull_request) Has started running

Details

packaging / nix (pull_request) Has started running

Details

ci / e2e (push) Has started running

Details

ci / desktop (push) Successful in 9m13s

Details

ci / check (push) Successful in 9m40s

Details

packaging / release (pull_request) Has been cancelled

Details

8c638792b8

The PWA installed from the http LAN address opened with an address bar
(#98). Browsers only install web apps from secure origins, and the user
would rather not wait for a public server (#71, D-038).

With NEOKOM_HTTPS=<address> the container also serves the app on 8443
from Caddy's own local CA, kept on a volume so each device trusts it
once. The root is offered at http://<host>:8080/neokom-ca.crt. Both
sites proxy /relay to kom-relay. On an https page the app's default
server is wss://<page host>/relay, since browsers refuse ws:// there.

The smoke test checks it end to end:
- the CA download;
- the https page, verified against that CA;
- a browser login over wss;
- a secure context with an active service worker.

The ws_probe example now finds the reply among async messages, and the
smoke test prints what it got on failure: it stalled twice today.

Refs #98

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

littlefox added 1 commit

2026-10-18 12:01:32 +00:00

Merge remote-tracking branch 'origin/main' into issue-98-https

ci / check (push) Successful in 12m38s

Details

ci / desktop (push) Successful in 15m42s

Details

packaging / arch (pull_request) Successful in 14m52s

Details

ci / e2e (push) Successful in 20m56s

Details

packaging / nix (pull_request) Successful in 18m28s