Domains and HTTPS

Why HTTPS matters, even at home#

HTTPS encrypts what passes between your browser and your server, so nobody else on the network can read your passwords on the way. That's the obvious reason.

The less obvious one: browsers keep some features back from pages that aren't on HTTPS, like the encryption that password managers do in the browser, passkeys, and the camera. So a few apps simply don't work on a plain http:// address, however well the page seems to load. Vaultwarden, LibreMoney, Jitsi Meet, PrivateBin and Screego are the ones in the catalogue, and LibrePortal warns you before you install them without HTTPS.

The three choices#

The setup wizard's Domains step asks How should apps be reached securely?

The setting is called Secure Access afterwards, on Admin → Network in the HTTPS section. Change it with the command below, which explains exactly what it's about to do and asks before doing it:

sudo -u libreportal libreportal https selfsigned   # I don't have a domain
sudo -u libreportal libreportal https domain       # I have a domain
sudo -u libreportal libreportal https off          # Not now

To check: whether changing Secure Access on the Network settings page applies it; in the code only the command and the setup wizard switch it fully, so the guide points at the command

Both HTTPS choices need Traefik, the app that handles certificates and addresses for all the others. Install it from the App Center first; the command tells you if it's missing.

libreportal https status shows what's on now and what the certificate covers.

HTTPS without a domain#

This is the easy upgrade. Every app keeps the address you already use; only the http becomes https. There's no DNS to set up and nothing to change on your router. If someone opens the old http:// address, they're sent to the https:// one.

The catch is the warning. LibrePortal makes its own certificate, and your browser has never heard of it, so the first time you open an app it warns you that the connection isn't private. It is encrypted; the browser just can't check who made the certificate. Accept it once and that device is sorted for every app on that address. Phones make you tap through a few more screens than laptops do.

If you also reach the server over the VPN, you'll be asked once more for that address, because browsers remember your answer per address. So twice per device at most, then never again.

The certificate lasts a little over two years. LibrePortal checks it every night and makes a new one when it has 30 days left, or when the server's addresses change. A new certificate means one more warning on each device.

With HTTPS on, you can also give your apps local names like uptimekuma.lan.internal.

Using your own domain#

With a domain, each app gets a proper address of its own, like https://vault.example.com, with a certificate from Let's Encrypt that every browser already trusts. It's the right choice when people outside your home use your apps, and it's required for a few apps that need one (see below).

You need a domain you've bought from a registrar, and the ability to add DNS records to it.

Next to each domain, LibrePortal checks where its DNS points and says so: Reaches this server, Points elsewhere, No DNS record, Waiting for DNS, or Via proxy or relay. New records can take a while to spread, so Check again after a few minutes if it isn't right yet.

Each app's address#

Each app has a name that goes in front of your domain. Most use their own name, like nextcloud.example.com; a few have a shorter, friendlier one: Vaultwarden is vault, Gitea is git, Stalwart is mail and Uptime Kuma is uptime. Every app's page in this guide shows its address under With a domain.

To change it, open the app, go to Config → Network and edit the Subdomain on its port. Use @ (or the word root) for the domain itself, example.com with nothing in front. Under the box a small line shows the real address as you type, like vault.example.com, or example.com (root of the domain) for @. Left empty it shows the app's own name.

Two apps can't share an address, because Traefik would only ever answer for one of them. If the name you pick is already another app's, LibrePortal refuses the change, says which app has it, and suggests a free subdomain. The same check runs when you install an app, change its domain, or change a domain itself.

If you have more than one domain, each app has a Domain choice on its Config tab saying which one it lives on. It starts on Domain 1.

Private apps and domains#

A domain doesn't make an app public. When an app is set to Private, Traefik also checks who's asking and only lets your trusted places through, so vault.example.com gives everyone else nothing.

Apps that need a domain#

A few apps can't do their job without one, and their pages say so before you install:

• Authelia puts a sign-in page in front of other apps, and works through your domain and Traefik.
• Stalwart, when you choose to run public mail, needs a domain for your email addresses.
• Mastodon won't install at all until you have a domain and Traefik, because other servers only follow it over HTTPS at its permanent address. It goes on social.<your domain> unless you choose another name.

The other fediverse apps, which talk to other servers, are a special case. Friendica, WriteFreely, Funkwhale, PeerTube and Mobilizon keep the address they were installed on as part of their identity. They'll install without a domain, but if you ever want them to federate, set up your domain before you install them; it can't be changed afterwards.

A name for the WebUI itself#

The WebUI normally lives at your server's address and a port that was picked at random when you installed, such as https://192.168.1.50:41873. If you have a domain, you can also reach it at a proper name, lp.example.com by default, with a real Let's Encrypt certificate and no browser warning.

Go to Admin → Network and find the WebUI hostname card. Switch it on, change Name if you don't want lp, and press Apply. From a terminal:

sudo -u libreportal libreportal webui hostname enable lp

It needs a domain set first, as Domain 1 or whichever domain the WebUI uses, and Traefik installed. Use webui hostname status to see where it stands and webui hostname disable to switch it off.

The name survives updates. Updating or rebuilding the WebUI keeps it, along with any other setting you changed in the WebUI's own config. (Before 0.9.11 an update could wipe it, so the name stopped working; if yours did, switch it on again once.)

The name is not public. Like a private app, it answers your trusted places and your VPN, and nobody else.

Page Security for one app#

Each app has a Page Security setting in its advanced settings: Automatic — follow the HTTPS setting, Always HTTPS or Plain HTTP. Leave it on Automatic. Plain HTTP keeps that one app on http:// when HTTPS is on without a domain, for the rare app or device that can't cope with the certificate.

Installing apps without a restart#

Traefik, the web proxy, listens on a pool of spare HTTPS ports that is set up once. When you install an app it takes a free port from the pool, and uninstalling gives it back, so your other sites never drop for a few seconds while you add or remove something. Existing apps keep their addresses, bookmarks and firewall rules. Servers that already exist get the pool from an update; it goes live the next time Traefik restarts anyway.

If the pool ever fills up, the new app is installed on plain http:// and says so. The More HTTPS ports card in the WebUI then lets you enlarge the pool at a quiet moment. That takes one Traefik restart, and it never happens behind your back.

From the command line#

Run each one as sudo -u libreportal libreportal <command>. Add --yes to an https command to skip its question.

New to domains? How domains work explains registrars, DNS companies and the three ways to set one up.