HTTPS and remote access

On the shop’s network, the hub speaks plain HTTP on port 8080. That’s normal for equipment on a private network. Anything reached over the internet should use HTTPS. Pick one of these:

Caddy in front of the hub (a server with a domain name)

Caddy gets and renews certificates by itself. Point a domain (e.g. pos.example.my) at the server, install Caddy, and put this in /etc/caddy/Caddyfile:

pos.example.my {
    reverse_proxy 127.0.0.1:8080
}

Then sudo systemctl reload caddy, and tell the hub its address so pairing codes use it:

OPENKEDAI_PUBLIC_URL=https://pos.example.my

Keep port 8080 closed to the internet (only 80 and 443 open), e.g. with ufw allow 80,443/tcp and without allowing 8080, or set OPENKEDAI_HOST=127.0.0.1.

Cloudflare Tunnel (no open ports)

A tunnel connects the hub to Cloudflare from the inside, so nothing on the router or server is opened. Install cloudflared, create a tunnel for a hostname in your Cloudflare account, and point it at http://localhost:8080. Then set OPENKEDAI_PUBLIC_URL to https://<that hostname>.

Tailscale (private access for the owner)

Tailscale puts the hub, the owner’s laptop and phone on a private network. Install it on the hub and on the owner’s devices; the back office is then at http://<hub's Tailscale name>:8080 from anywhere, and nothing is exposed to the internet. To give it HTTPS too, use tailscale serve.

Devices and HTTPS

• POS devices connect to whatever address the pairing code carries. With HTTPS in front, set OPENKEDAI_PUBLIC_URL before pairing devices, or use Settings → Hub → Change hub address afterwards.
• Devices don’t look for an https:// hub on the shop’s network: such an address doesn’t move around.