Securing Local & LAN Installations (SSL/TLS Guide)

Rezilienz is built as a Sovereign, Markdown-First Headless CMS prioritizing privacy, portability, and network independence. To protect your assets and credentials without relying on remote SaaS servers, Rezilienz uses a Zero-Knowledge client-side encrypted Vault.

Because the Vault operates directly inside your web browser using modern web encryption APIs (window.crypto.subtle) and modern Clipboard APIs, web browsers strictly require a "Secure Context" to unlock these features.

This guide explains browser Secure Contexts and shows how to set up a secure HTTPS local network or server environment.

---

1. Browser "Secure Context" Rules

To prevent session hijacking and packet sniffing, web browsers disable powerful client-side APIs on insecure (plain HTTP) connections.

By default, the browser allows cryptographic APIs in only three secure contexts:

1. Local Loopbacks: http://localhost, http://127.0.0.1, or http://[::1].
2. Standard HTTPS: Any domain served over an encrypted connection (e.g. https://yourdomain.com).
3. Tor Onion Services: Any .onion domain (e.g. http://xyz.onion) accessed via Tor/Tor Browser, since Tor inherently provides end-to-end cryptographic encryption and routing.

If you deploy Rezilienz on a headless home server (like a Raspberry Pi or local server) and access it via a LAN IP (e.g., http://192.168.1.15), the browser will classify the context as insecure and disable the Vault.

---

2. Option A: Zero-Configuration Options (Localhost / Tor)

If you do not want to configure custom SSL certificates, you can use these native alternatives:

• Local Development: Access the CMS directly on the machine running it using http://localhost:[port] or http://127.0.0.1:[port].
• Tor Hidden Service: Expose your home server through a Tor onion address. Browsers like Tor Browser, Brave, and Firefox automatically treat all .onion domains as secure contexts, letting you access your Vault from anywhere in the world over plain HTTP without certificates.

---

3. Option B: Local Trusted Certificates using mkcert (Recommended)

For general home LAN servers, the easiest and most robust solution is to use mkcert. This utility automatically creates a locally-trusted Certificate Authority (CA) on your dev machine and issues valid local certificates.

Step 1: Install mkcert on your main development machine

• macOS: brew install mkcert nss
• Linux (Debian/Ubuntu): sudo apt install mkcert libnss3-tools
• Windows: Use choco install mkcert

Step 2: Install the local Root CA in your system browsers

Run this command once on your dev machine:

mkcert -install

(Your OS will ask for admin privilege to register the local Root CA).

Step 3: Generate the certificates for your LAN Server

Generate a certificate containing both your local domain name and your home server's LAN IP address:

mkcert rezilienz.local 192.168.5.199

This generates two files:

• rezilienz.local+1.pem (The Certificate)
• rezilienz.local+1-key.pem (The Private Key)

Step 4: Move and configure them on your Web Server

Copy these files into your server configuration (e.g., in /etc/ssl/ or the project certs/ directory), and configure Apache or Nginx to point to them.

---

4. Option C: Secure Reverse Proxy with Caddy

Caddy is a modern, open-source web server that handles SSL automatically. If you want a lightweight, painless proxy that terminates local SSL and serves both the PHP frontend and Python backend, a Caddyfile like this handles it in 5 lines:

rezilienz.local, 192.168.5.199 {
    tls internal  # Automatically generates and trusts local certificates
    
    root * /home/user/rezilienz/apps
    php_fastcgi unix//run/php/php8.2-fpm.sock # Serve PHP frontend
    file_server
    
    reverse_proxy /api/* 127.0.0.1:8000 # Forward API requests to FastAPI
}

---

5. Option D: Manual Self-Signed Certs via OpenSSL (Standard)

If you prefer to generate standard self-signed certificates manually using standard Linux tools without third-party utilities, run this command:

mkdir -p certs
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
  -keyout certs/rezilienz.key \
  -out certs/rezilienz.crt \
  -subj "/CN=192.168.5.199" \
  -addext "subjectAltName = IP:192.168.5.199"

Once generated, configure Apache or Nginx to load certs/rezilienz.crt and certs/rezilienz.key. Note that browsers will show a "Self-Signed Certificate Warning"—you will need to click "Advanced -> Proceed" to enter the CMS, but the browser will still unlock all Vault cryptographic APIs successfully.