HTTPS

Use HTTPS for the panel whenever it can be reached from the internet. On an http:// panel, browsers show a "Not secure" warning on every visit, and passwords and session cookies travel over the network in clear text. Display mode also needs HTTPS to keep the screen on, and passkeys, which sign the AI repairs you approve, only work over HTTPS.

There are two ways to do it:

Option 1: free Let's Encrypt certificateCopy Anchor Link

Run from the release package directory:

sudo bash install.sh master --domain monitor.example.com --https --email you@example.com

Use both instead of master if this server also runs the agent. On an existing installation, accounts, settings and data are kept.

The installer:

1. creates the reverse proxy in Nginx (/etc/nginx/conf.d/3rmonitor.conf) or Apache (/etc/apache2/sites-available/3rmonitor.conf or /etc/httpd/conf.d/3rmonitor.conf);
2. installs certbot and its Nginx or Apache plugin if needed (apt, dnf or yum);
3. gets a free Let's Encrypt certificate for the domain. certbot renews it automatically; --email is optional and receives expiry notices;
4. switches the panel URL to https://monitor.example.com/, unless you gave --public-url.

Before you run it: Nginx or Apache is installed, the domain's DNS points to this server, and port 80 is reachable from the internet.

On a new installation you can add --listen 127.0.0.1, so port 8899 isn't exposed and the panel can only be reached through the proxy. Don't do it if agents on other servers report to http://IP:8899: they would stop reaching the master. (The agent on the master itself reports to 127.0.0.1 and is not affected.)

Option 2: the master serves HTTPS itselfCopy Anchor Link

Put the paths of a PEM certificate and private key in /etc/3rmonitor/master.conf, and give HTTPS its own port with tls_listen. A free Cloudflare Origin Certificate works well: in Cloudflare, go to SSL/TLS → Origin Server, create the certificate, then set the SSL/TLS mode to Full (strict).

listen = 0.0.0.0:8899
tls_listen = 0.0.0.0:8443
tls_cert = /etc/3rmonitor/origin.pem
tls_key = /etc/3rmonitor/origin.key

Port 8899 keeps serving plain HTTP, so agents that report to http://…:8899, including the agent on the master itself, keep working.

The files must be readable by the 3rmonitor user:

sudo chgrp 3rmonitor /etc/3rmonitor/origin.pem /etc/3rmonitor/origin.key
sudo chmod 640 /etc/3rmonitor/origin.pem /etc/3rmonitor/origin.key
sudo systemctl restart 3rmonitor-master

Then set Settings → General → Panel public URL to the https:// address, for example https://monitor.example.com:8443/, and open the port in the firewall.

• Cloudflare only proxies HTTPS on some ports (443, 2053, 2083, 2087, 2096 and 8443), which is why the example uses 8443. Use tls_listen = 0.0.0.0:443 only if no web server uses port 443.
• Without tls_listen, the listen port itself switches to HTTPS (the behaviour of versions before 1.0.4). Agents must then use https:// in master_url (/etc/3rmonitor/agent.conf). A Cloudflare Origin Certificate is only trusted by Cloudflare, so use the address that goes through Cloudflare, or set insecure = true on the agents.

What happens with http:// addressesCopy Anchor Link

• When the panel URL in Settings is https://, opening http:// on the same domain redirects the browser to https://. The reverse proxy must send X-Forwarded-Proto; the Nginx and Apache configuration created by install.sh, and Cloudflare, do.
• Agents that still report to the http:// address keep working: their reports are not redirected. You don't need to touch them after option 1. New install commands in the panel use the https:// address.
• Opening the panel by IP (http://IP:8899) is never redirected, and you can sign in there: sign-in cookies are marked Secure only on HTTPS requests.

See also Cloudflare tips.