HTTPS

Nifty can serve HTTPS itself in one of these ways, but only one at a time. Choose the one that fits.

Way	Use it when
Let's Encrypt	The internet reaches this machine at your domain
Let's Encrypt over Cloudflare DNS	It doesn't (a home or office server), and the domain's DNS is on Cloudflare
Certificate files	You already have a certificate, from certbot or elsewhere
Tailscale	Only your own devices need to reach it
Behind a proxy	Caddy, nginx or similar already handles HTTPS

install.sh sets up any of these for you (Install on Linux). The settings below go in /etc/nifty.env. After you change them, restart Nifty with sudo systemctl restart nifty.

Let's Encrypt

NIFTY_ORIGIN=https://notes.example.com
NIFTY_LISTEN=:443
NIFTY_ACME=tls
[email protected]    # optional

• The domain's DNS must point at this computer, and the internet must reach it on port 443 or 80.
• Nifty gets the certificate on the first visit, so the first visit takes a few seconds. Nifty renews the certificate 30 days before it expires.
• Nifty redirects http:// on port 80 to HTTPS.

Let's Encrypt over Cloudflare DNS

Use this method for a computer the internet can't reach, such as a home server or one on your tailnet. Nifty proves that the domain is yours by adding a DNS record through Cloudflare's API.

1. In Cloudflare, open My Profile → API Tokens and create a token with Zone → DNS → Edit on this domain's zone only.

2. Point the domain at this computer's local or tailnet address, so that your devices can find it.

3. Add these settings, and then restart Nifty.

   NIFTY_ORIGIN=https://notes.example.com
   NIFTY_LISTEN=:443
   NIFTY_ACME=cloudflare
   NIFTY_CLOUDFLARE_API_TOKEN=…

The certificate usually arrives within two minutes of starting. The token works only from the environment, never as a flag. Keep /etc/nifty.env as install.sh writes it, owned by root:nifty with mode 640.

Certificate files

NIFTY_ORIGIN=https://notes.example.com
NIFTY_LISTEN=:443
NIFTY_TLS_CERT=/etc/ssl/nifty/fullchain.pem
NIFTY_TLS_KEY=/etc/ssl/nifty/privkey.pem

• Use PEM files for the full chain and its private key. Nifty won't start if they don't match, have expired or don't cover the origin's host.
• Nifty reads them again within a minute of a change, so renewals don't need a restart. If a new pair doesn't load, Nifty keeps the old one and logs why.
• The nifty user must be able to read the files, and they can't be under /home or /root. For certbot's files, run sudo setfacl -m u:nifty:r <file>, and add u:nifty:x on each directory above it.

Ports 443 and 80

Ports below 1024 need a systemd drop-in. install.sh adds it for you. To add it yourself, create /etc/systemd/system/nifty.service.d/ports.conf with these lines.

[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

Then run sudo systemctl daemon-reload && sudo systemctl restart nifty. To redirect from a port other than 80, or not to redirect at all, set NIFTY_REDIRECT_HTTP (Configuration).

Try it first

Let's Encrypt limits how often it issues certificates. While you experiment, use its staging server. Browsers won't trust the staging certificate.

NIFTY_ACME_DIRECTORY=https://acme-staging-v02.api.letsencrypt.org/directory

When everything works, remove that line and restart Nifty. Nifty then gets a real certificate.

If no certificate comes

Every step is in the log, on lines that start with tls:.

journalctl -u nifty | grep tls:

A failure logs Let's Encrypt's reason, the fix when it's known and when Nifty will try again, which is an hour later. To try again immediately, fix the cause and restart Nifty. Nifty warns in the log when a certificate has less than 14 days left.