((p "Since Zettelstore does not encrypt the messages it exchanges with its clients, you may need some additional software to enable encryption.") (h2 (@ (id . "public-key-encryption")) "Public-key encryption") (p "To enable encryption, you probably use some kind of encryption keys." " " "In most cases, you need to deploy a " (@L (@H "“") "public-key encryption" (@H "”")) " process, where your side publish a public encryption key that only works with a corresponding private decryption key." " " "Technically, this is not trivial." " " "Any client who wants to communicate with your Zettelstore must trust the public encryption key." " " "Otherwise the client cannot be sure that it is communication with your Zettelstore." " " "This problem is solved in part with " (a (@ (href . "https://letsencrypt.org/") (rel . "external")) "Let's Encrypt") "," " " (@L (@H "“") "a free, automated, and open certificate authority (CA), run for the public’s benefit." " " "It is a service provided by the " (a (@ (href . "https://www.abetterinternet.org/") (rel . "external")) "Internet Security Research Group") (@H "”")) ".") (p "Alternatively, you can buy these keys for public-key encryption at " (@L (@H "“") "certificate authorities" (@H "”")) " or its dealers.") (h2 (@ (id . "server-software-for-encryption")) "Server software for encryption") (p "The solution of placing a server for encryption in front of an encryption-unaware server is a relatively old one." " " "There are many different alternatives to choose.") (p "First, there are web servers." " " "Business-grade web servers must enable encryption." " " "Most of them allow to forward a request unencrypted to another web server." " " "Some examples:") (ul (li (a (@ (href . "https://httpd.apache.org/") (rel . "external")) "Apache Web Server") ": enable " (a (@ (href . "http://httpd.apache.org/docs/current/mod/mod_proxy.html") (rel . "external")) "mod_proxy") " and configure a reverse proxy.") (li (a (@ (href . "https://nginx.org/") (rel . "external")) "nginx") ": set-up a reverse proxy with the " (a (@ (href . "https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass") (rel . "external")) (kbd "proxy_pass")) " directive.") (li (a (@ (href . "https://caddyserver.com/") (rel . "external")) "Caddy") ": see below for details.")) (p "Other software is also possible." " " "There exists software dedicated for this task of handling the encryption part." " " "Some examples:") (ul (li (a (@ (href . "https://www.stunnel.org/") (rel . "external")) "stunnel") " (" (@L (@H "“") "a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code." (@H "”")) ")") (li (a (@ (href . "https://traefik.io/") (rel . "external")) "Traefik") ": set-up a " (a (@ (href . "https://docs.traefik.io/routing/routers/") (rel . "external")) "router") ".")) (h2 (@ (id . "example-configuration-for-caddy")) "Example configuration for Caddy") (p "For the inexperienced owner of a Zettelstore, " (a (@ (href . "https://caddyserver.com/") (rel . "external")) "Caddy") " is a good option" (sup (@ (id . "fnref:1")) (a (@ (class . "zs-noteref") (href . "#fn:1") (role . "doc-noteref")) "1")) "." " " "Caddy has the capability to automatically fetch appropriately encryption key from Let's Encrypt, without any further configuration." " " "The only requirement of doing this is that the server must be publicly accessible.") (p "Here is the base configuration for the main site for Zettelstore at " (a (@ (href . "https://zettelstore.de/") (rel . "external")) "https://zettelstore.de/") ":") (pre (code "zettelstore.de {\n  reverse_proxy localhost:23123\n}")) (p "That's all!") (p "If you want to add some additional content on the server, you could change the configuration as follows:") (pre (code "zettelstore.de {\n  file_server * {\n    root /var/www/html\n  }\n  route /manual/* {\n    reverse_proxy localhost:23123\n  }\n}")) (p "This will forwards requests with the prefix " (@L (@H "“") "/manual/" (@H "”")) " to the running Zettelstore." " " "All other requests will be handled by Caddy itself.") (p "In this case you must specify the " (a (@ (href . "00001004010000#url-prefix")) "startup configuration key " (kbd "url-prefix")) " with the value " (@L (@H "“") "/manual/" (@H "”")) "." " " "This is to allow Zettelstore to ignore the prefix while reading web requests and to give the correct URLs with the given prefix when sending a web response."))