Local deployments should have self-signed certificates
Nobody has claimed this yet.
- Dominant language
- Elixir
- Stars
- 296
- Forks
- 86
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 50
Description
Currently, Lightning runs on port 4000 - with no TLS/SSL on the web front end.
In the pursuit of encouraging best practices local deploys in production mode should:
- Generate a self signed certificate
- Use the self signed cert on a secure port (like 4443?)
- Warn the user when logging in via the HTTP endpoint that this is insecure
- Serve the application via a secure endpoint with the self signed certificate
However when a user deploys the application in front of a reverse proxy that provides certificates, this policy should be able to be disabled via at least an environment variable.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are identified in the issue. Start by locating the local deployment configuration and the web endpoint currently using port 4000; define how certificate generation, port 4443, HTTP warnings, and an environment-variable override should work, then verify behavior both directly and behind a reverse proxy.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elixir
- Domain
- devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100