Operator · How-to

Put it behind HTTPS#

Serve Inkhold over HTTPS, so the tablet and browsers can reach it safely from outside your home. Plain HTTP is fine inside a trusted home network.

Let Inkhold do it#

Inkhold speaks TLS 1.3 itself; you need no reverse proxy. Give it a certificate and its key in config.zon:

.tls = .{
    .enabled = true,
    .cert_path = "/etc/inkhold/cert.pem",
    .key_path = "/etc/inkhold/key.pem",
},

Restart Inkhold. On the tablet’s sign-in screen, turn on Enable HTTPS; in the browser, use https://.

Leave cipher_suites empty. Inkhold then picks what is cheap on its own processor: AES-GCM where the processor has AES instructions, ChaCha20 where it does not, as on every Raspberry Pi. On a Pi 1, AES costs about three times as much.

To try it before you have a real certificate, bash scripts/dev-cert.sh in the repository makes a self-signed one.

Or behind a reverse proxy#

If nginx, Caddy or Traefik already handles HTTPS for you:

• Set trusted_proxy to the proxy’s address, so Inkhold’s sign-in limits apply to each visitor (read from X-Real-IP or the last X-Forwarded-For) and not to the proxy.
• Have the proxy mark the session cookie Secure (nginx: proxy_cookie_flags ~ secure). Inkhold only does it when it handles TLS itself.