---
title: Securing Local & LAN Installations (SSL/TLS Guide)
date: unknown
---

# Securing Local & LAN Installations (SSL/TLS Guide)

# Securing Local & LAN Installations (SSL/TLS Guide)

Rezilienz is built as a **Sovereign, Markdown-First Headless CMS** prioritizing privacy, portability, and network independence. To protect your assets and credentials without relying on remote SaaS servers, Rezilienz uses a **Zero-Knowledge client-side encrypted Vault**.

Because the Vault operates directly inside your web browser using modern web encryption APIs (`window.crypto.subtle`) and modern Clipboard APIs, **web browsers strictly require a "Secure Context"** to unlock these features.

This guide explains browser Secure Contexts and shows how to set up a secure HTTPS local network or server environment.

---

## 1. Browser "Secure Context" Rules

To prevent session hijacking and packet sniffing, web browsers disable powerful client-side APIs on insecure (plain HTTP) connections. 

By default, the browser allows cryptographic APIs in only three secure contexts:
1. **Local Loopbacks**: `http://localhost`, `http://127.0.0.1`, or `http://[::1]`.
2. **Standard HTTPS**: Any domain served over an encrypted connection (e.g. `https://yourdomain.com`).
3. **Tor Onion Services**: Any `.onion` domain (e.g. `http://xyz.onion`) accessed via Tor/Tor Browser, since Tor inherently provides end-to-end cryptographic encryption and routing.

If you deploy Rezilienz on a headless home server (like a Raspberry Pi or local server) and access it via a LAN IP (e.g., `http://192.168.1.15`), the browser **will classify the context as insecure** and disable the Vault. 

---

## 2. Option A: Zero-Configuration Options (Localhost / Tor)

If you do not want to configure custom SSL certificates, you can use these native alternatives:

*   **Local Development**: Access the CMS directly on the machine running it using `http://localhost:[port]` or `http://127.0.0.1:[port]`.
*   **Tor Hidden Service**: Expose your home server through a Tor onion address. Browsers like Tor Browser, Brave, and Firefox automatically treat all `.onion` domains as secure contexts, letting you access your Vault from anywhere in the world over plain HTTP without certificates.

---

## 3. Option B: Local Trusted Certificates using `mkcert` (Recommended)

For general home LAN servers, the easiest and most robust solution is to use **`mkcert`**. This utility automatically creates a locally-trusted Certificate Authority (CA) on your dev machine and issues valid local certificates.

### Step 1: Install `mkcert` on your main development machine
*   **macOS**: `brew install mkcert nss`
*   **Linux (Debian/Ubuntu)**: `sudo apt install mkcert libnss3-tools`
*   **Windows**: Use `choco install mkcert`

### Step 2: Install the local Root CA in your system browsers
Run this command once on your dev machine:
```bash
mkcert -install
```
*(Your OS will ask for admin privilege to register the local Root CA).*

### Step 3: Generate the certificates for your LAN Server
Generate a certificate containing both your local domain name and your home server's LAN IP address:
```bash
mkcert rezilienz.local 192.168.5.199
```
This generates two files:
*   `rezilienz.local+1.pem` (The Certificate)
*   `rezilienz.local+1-key.pem` (The Private Key)

### Step 4: Move and configure them on your Web Server
Copy these files into your server configuration (e.g., in `/etc/ssl/` or the project `certs/` directory), and configure Apache or Nginx to point to them.

---

## 4. Option C: Secure Reverse Proxy with Caddy

**Caddy** is a modern, open-source web server that handles SSL automatically. If you want a lightweight, painless proxy that terminates local SSL and serves both the PHP frontend and Python backend, a `Caddyfile` like this handles it in 5 lines:

```caddy
rezilienz.local, 192.168.5.199 {
    tls internal  # Automatically generates and trusts local certificates
    
    root * /home/user/rezilienz/apps
    php_fastcgi unix//run/php/php8.2-fpm.sock # Serve PHP frontend
    file_server
    
    reverse_proxy /api/* 127.0.0.1:8000 # Forward API requests to FastAPI
}
```

---

## 5. Option D: Manual Self-Signed Certs via OpenSSL (Standard)

If you prefer to generate standard self-signed certificates manually using standard Linux tools without third-party utilities, run this command:

```bash
mkdir -p certs
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
  -keyout certs/rezilienz.key \
  -out certs/rezilienz.crt \
  -subj "/CN=192.168.5.199" \
  -addext "subjectAltName = IP:192.168.5.199"
```

Once generated, configure Apache or Nginx to load `certs/rezilienz.crt` and `certs/rezilienz.key`. Note that browsers will show a "Self-Signed Certificate Warning"—you will need to click "Advanced -> Proceed" to enter the CMS, but the browser **will still unlock all Vault cryptographic APIs successfully.**