Self hosted applications

I'm not sure whether this is the correct issue tracker or not.
Anyways, I wanted a self-hosted home inventory management PWA for people to find their items efficiently. I made it and now I found that this will never work, because of the strict rules that basically excludes my use case.

So first, the manifest.json requires a "start_url", and I didn't want this as my start url can vary based on the DHCP settings of my router. But I thought, ok it's just a minor inconvenience. I can make it fixed.

Secondly, PWA only runs in secure contexts. It means it has to be either localhost, or "secure" HTTPS. At this point I was getting angry, because why is it more secure to send my data through HTTPS to companies than my LAN where my data never leaves the building. And obviously I cannot register a cert for a 192.168.0.x IP address, so I have to make a self-signed certificate. Which is fine, at least my LAN will be protected, so I kind of accepted the idea. So I made this. It worked well for desktops but not for mobile.

It turned out that Android let's you install certificates, but those are only for VPNs, and basically chrome never gets that certificate.

So that's the end. I thought I can use PWA. But I can't.

Some possible solutions:

• extending the secure contexts with LAN addresses.
• allowing pwa for non secure contexts, as not everything has high risks. (And if browsers can work with HTTP, then PWA should work as well.)
• letting android developers fix the problem (based on their issues, it will never happen)
• making same standard that says, browsers should allow users to add certificates

Good to have:

• start_url should not be required. Especially if it is designed for offline use.

Start by reading the manifest.json start_url requirement and the secure-context constraints described in the issue. Review the proposed LAN, non-secure, certificate, and Android options against the Service Worker issue scope; done would require a concrete, agreed standards change.