Purpose
Put the dashboard and the S3 endpoint behind TLS. Four modes, from fully automatic
(Let’s Encrypt via Cloudflare) to bring-your-own enterprise certificates.
When you use it
- Any install that’s reachable beyond localhost should get a certificate.
- A client tool needs an encrypted S3 endpoint.
Controls
- Status banner — “Your relayer is running without encryption” with Enable
SSL and Not on Cloudflare? Use Self-Signed shortcuts while on HTTP. - Automatic SSL (recommended) — free Let’s Encrypt certificate, renewed
automatically. Fields: Domain name (DNS must be on Cloudflare),
Cloudflare API token (Zone:DNS:Edit permission — used only to prove domain
ownership; a “Show me how” step-by-step is built in under the token field),
optional Zone ID (auto-detected if blank). Get Certificate runs the
issuance and stays disabled until both the domain and the token are filled in. - Self-Signed Certificate — instant and free; browsers and S3 clients will show
a trust warning. Selecting it opens an address list: add every IP address and
domain name the certificate should cover (Add Address), then Issue
Certificate. The certificate is valid for three years. - Custom Certificate — upload from your own CA or PKI. Three file pickers:
Certificate (required), Private Key (required), and CA Chain
(optional, for internal PKIs). Apply Certificate installs them via a
zero-downtime nginx reload; if validation fails the existing certificate is kept. - HTTP Only (not recommended) — no encryption; the default on a fresh install.
Common tasks
- Enable TLS the easy way: have the domain on Cloudflare → create an API token
with Zone:DNS:Edit → fill domain + token → Get Certificate. Takes about a minute. - Lab box without a domain: choose Self-Signed, add the IPs/hostnames clients
will use, Issue Certificate, then tell your client to skip certificate
verification (rclone:no_check_certificate = true; AWS CLI:--no-verify-ssl).
Gotchas
- Installing a certificate does not change the existing endpoint:
http://<host>:9000keeps working, and an encrypted endpoint is added at
https://<host>:9443. Point clients at 9443 explicitly to use TLS. - The Cloudflare token needs only DNS-edit on the one zone; don’t paste a global
API key.
Screenshots
