HTTPS

Remote browsers and workers reach the leader over HTTPS: the leader serves it on port 443, or a reverse proxy in front of it does.

Direct HTTPS

For a network deployment, configure DNS to reach this host, permit TCP 443 only from intended clients, and save this as smeltr.toml:

[leader]
enabled = true

[leader.http]
bind = "0.0.0.0"
public_origin = "https://smeltr.example.com"

[leader.tls]
enabled = true

[leader.storage]
data_dir = "/var/lib/smeltr"

[leader.secrets]
key = "/etc/smeltr/secrets/sealing.key"

Port 443 is the default, so you need no port line. On Linux, grant the service CAP_NET_BIND_SERVICE to listen on a port below 1024 (see capabilities). Keep the leader under a dedicated, non-root service account. Provision these directories for the service account. Keep the sealing key separate from ordinary data backups. The hostname and port must match the URL users actually open. Trust the generated public CA through your organization's browser/OS trust procedure before signing in; see Certificates. Setting public_origin does not create DNS, open a firewall, or configure a proxy.

To run it as a service, follow Run as a systemd service, which grants that capability. Then confirm https://smeltr.example.com is reachable and trusted from a client.

HTTPS reverse proxy

When a proxy on the same host terminates HTTPS for a host-installed binary, set leader.http.bind = "127.0.0.1", leader.tls.enabled = false, and set leader.http.public_origin = "https://smeltr.example.com". Set leader.http.port = 4000 (or another unprivileged port) so the process needs no extra capability, and configure the proxy separately to forward that origin to http://127.0.0.1:4000. Serve a certificate clients trust. Keep the upstream listener private and preserve the browser Origin header.

For a container, the Smeltr process normally listens on 0.0.0.0 inside its network namespace. Restrict the published host port instead, for example with -p 127.0.0.1:4000:4000, and point the same-host proxy at that address. In Kubernetes, expose Smeltr with a ClusterIP Service and keep the workload private behind the ingress.

Set workers to use the proxy’s externally reachable HTTPS URL. In this setup, enrollment codes tell workers to verify the proxy certificate using the operating system’s trusted certificates. Install your private CA there if needed. Test both browser login and worker enrollment before opening general access.