The web interface can run over HTTPS
One script on the player puts the web interface behind HTTPS, so signing in and managing content stay private on a network you share with others. It can use a certificate the player issues itself, one from Let's Encrypt, or your own.
From Anthias 2026.05.0, one script on the player puts its web interface behind HTTPS, so signing in and managing content stay private on a network you share with others.
Run it on the player in one of 3 ways:
~/anthias/bin/enable_ssl.shuses a certificate the player issues itself. It works when you reach the player by its IP address on a local network, and browsers warn about the certificate until you trust it.~/anthias/bin/enable_ssl.sh --domain signage.example.comgets a certificate from Let's Encrypt and renews it. The domain has to point at the player, and Let's Encrypt has to be able to reach it on port 80. Add--emailwith your address for Let's Encrypt's notices, or--stagingto try it against Let's Encrypt's test service first.~/anthias/bin/enable_ssl.sh --cert cert.pem --key key.pemuses a certificate and key you already have.
With HTTPS on, the web interface answers on port 443, and port 80 redirects to it. If the player runs a firewall, open port 443, for example with sudo ufw allow 443/tcp. To go back to plain HTTP on port 80, run ~/anthias/bin/disable_ssl.sh. It keeps the certificate, so turning HTTPS on again reuses it.
HTTPS runs in an extra container, anthias-caddy, which only exists while it's on. Upgrades keep it running.
If you ran enable_ssl.sh before
Earlier versions had a script with the same name, but it has done nothing since Anthias 0.18.4: it finished and printed that you could reach the web interface at https://, while the player kept serving it over plain HTTP on port 80. If you ran it on 0.18.4 or later, your web interface was never on HTTPS. Run the new script after upgrading to turn it on.