Advanced Setup Options

Advanced Setup

This page documents optional setup procedures for additional functionality.

HTTPS

DRES natively supports HTTPS. Enabling it is recommended for production deployments and is required for some browser features (e.g. Cross-Origin Resource Sharing). DRES uses a Java KeyStore to hold the SSL certificate.

Generating a KeyStore with Let's Encrypt

The following example generates a KeyStore from a Let's Encrypt certificate obtained via certbot. Root privileges are required.

# 1. Obtain the certificate
certbot certonly --standalone --preferred-challenges http -d <domain>

# 2. Concatenate the PEM files into one
cat /etc/letsencrypt/live/<domain>/*.pem > fullchain.pem

# 3. Convert PEM to PKCS12 format
openssl pkcs12 -export -out fullchain.pkcs12 -in fullchain.pem

# 4. Create an empty KeyStore (keytool requires an existing file to import into)
keytool -genkey -keyalg RSA -alias dres -keystore keystore.jks
keytool -delete -alias dres -keystore keystore.jks

# 5. Import the certificate into the KeyStore
keytool -v -importkeystore -srckeystore fullchain.pkcs12 -destkeystore keystore.jks -deststoretype JKS

Configuring DRES to Use the KeyStore

Once the KeyStore is generated, update config.json to point to it:

{
  "enableSsl": true,
  "keystorePath": "keystore.jks",
  "keystorePassword": "your-keystore-password"
}

See Setup Guide for all configuration options.

Note: enabling enableSsl does not disable plain HTTP — both httpPort and httpsPort remain active simultaneously. If you want to force HTTPS only, that needs to be handled at the reverse proxy level (see below).

Also remember to set the matching endpoint.tls flag in the frontend's own frontend/src/config.json, or the frontend will not talk to the backend correctly over HTTPS.

There is also an enableHttp3 config field — it exists in the config schema but is not yet implemented; setting it has no effect.

Reverse Proxy

If you are running DRES behind a reverse proxy such as nginx, see Reverse Proxy Settings for the required configuration, including WebSocket proxying.