TLS / SSL

Option 1: Reverse proxy (recommended)

Use Caddy, Nginx, or Traefik to handle TLS termination. See Reverse Proxy.

Option 2: Built-in TLS

Configure TLS in config.toml:

[tls]
enabled = true
cert_path = "/path/to/cert.pem"
key_path = "/path/to/key.pem"

Let’s Encrypt with Caddy

Caddy handles Let’s Encrypt automatically:

api.example.com {
    reverse_proxy localhost:8080
}

Caddy will obtain and renew certificates automatically.

Self-signed certificates (development)

# Generate self-signed cert
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

# Configure
[tls]
enabled = true
cert_path = "./cert.pem"
key_path = "./key.pem"

HTTP to HTTPS redirect

With Caddy, HTTP redirects to HTTPS automatically.

With Nginx:

server {
    listen 80;
    server_name api.example.com;
    return 301 https://$server_name$request_uri;
}