# HTTPS and remote access

On the shop's network, the hub speaks plain HTTP on port 8080. That's normal for equipment on a
private network. Anything reached over the internet should use HTTPS. Pick one of these:

## Caddy in front of the hub (a server with a domain name)

[Caddy](https://caddyserver.com/) gets and renews certificates by itself. Point a domain (e.g.
`pos.example.my`) at the server, install Caddy, and put this in `/etc/caddy/Caddyfile`:

```text
pos.example.my {
    reverse_proxy 127.0.0.1:8080
}
```

Then `sudo systemctl reload caddy`, and tell the hub its address so pairing codes use it:

```sh
OPENKEDAI_PUBLIC_URL=https://pos.example.my
```

Keep port 8080 closed to the internet (only 80 and 443 open), e.g. with `ufw allow 80,443/tcp`
and without allowing 8080, or set `OPENKEDAI_HOST=127.0.0.1`.

## Cloudflare Tunnel (no open ports)

A tunnel connects the hub to Cloudflare from the inside, so nothing on the router or server is
opened. Install `cloudflared`, create a tunnel for a hostname in your Cloudflare account, and
point it at `http://localhost:8080`. Then set `OPENKEDAI_PUBLIC_URL` to `https://<that hostname>`.

## Tailscale (private access for the owner)

[Tailscale](https://tailscale.com/) puts the hub, the owner's laptop and phone on a private
network. Install it on the hub and on the owner's devices; the back office is then at
`http://<hub's Tailscale name>:8080` from anywhere, and nothing is exposed to the internet. To give
it HTTPS too, use `tailscale serve`.

## Devices and HTTPS

- POS devices connect to whatever address the pairing code carries. With HTTPS in front, set
  `OPENKEDAI_PUBLIC_URL` before pairing devices, or use **Settings → Hub → Change hub address**
  afterwards.
- Devices don't look for an `https://` hub on the shop's network: such an address doesn't move
  around.