HTTPS

The proxy can be setup to enable using HTTPS to access the running instances. Besides the warm and fuzzy feeling of knowing that nobody can snoop on the traffic that is happening completely local inside your machine. Accessing the page over HTTPS is required for some JavaScript features (such as service workers), as they are only available in “secure contexts”.

Getting a wildcard certificate

Since the domain name used for the instance is dynamic, a wildcard certificate is required.

Let’s encrypt

Let’s encrypt allows getting trusted wildcard certificates for free if you can use DNS validation.

How to setup DNS validation will depend on the specifics of the DNS provider and ACME client. This lists some DNS providers and supported ACME clients.

Self signed

You can also create a self-signed wildcard certificate using a tool like mkcert. This certificate will not be trusted by your browser and tools like curl, but you can add manually add it to the trusted certificates on your system, or bypass the certificates warning in the browser/curl every time.

# Generate local wildcard certificate
mkcert -cert-file <path-to-your-certificates>haze.example.com.crt -key-file <path-to-your-certificates>haze.example.com.key '*.haze.example.com'

Using the certificate

Without reverse proxy

The haze proxy can serve over HTTPS directly, to enable that add the following to the [proxy] section of your haze.toml.

https = true
cert = "/path/to/haze.example.com.crt"
key = "/path/to/haze.example.com.key"

You might also want to change the port it’s listening on to 443.

With a reverse proxy

This depends on what reverse proxy you have setup. The following example is for nginx.

upstream haze-handler {
    server unix:/run/haze/haze.sock;
}

server {
    listen 80;
    listen 443 ssl;
    http2 on;
    server_name *.haze.example.com;

    ssl_certificate     <path-to-your-certificates>/haze.example.com.crt;
    ssl_certificate_key <path-to-your-certificates>/haze.example.com.key;

    location / {
            proxy_pass http://haze-handler;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
    }
}