From 38de2f9b40fe743f9d40bbfbb24005af35db9a22 Mon Sep 17 00:00:00 2001
From: Roland <roland@learningselfreliance.com>
Date: Wed, 12 Jun 2024 18:44:59 -0600
Subject: [PATCH] Moving HTTP kiwix/help services to 9085/9086 ports.  Nginx
 will serve HTTPS proxy for kiwix/help services at the old ports.  Modifying
 apache2 to use HTTPS to serve map.

Using new https_proxy docker container to serve HTTPS for zim, map and help.
---
 README.md                                   |   6 +-
 app/src/App.js                              |   3 +-
 app/src/components/Apps.js                  |   2 +-
 app/src/components/Common.js                |   7 +-
 app/src/components/Map.js                   |   8 +-
 app/src/components/Zim.js                   |   9 +-
 docker-compose.yml                          |  57 +++++++--
 docker/help/Dockerfile                      |   2 +-
 docker/help/nginx.help.conf                 |  18 +++
 docker/https_proxy/Dockerfile               |  12 ++
 docker/https_proxy/nginx.proxy.conf         |  18 +++
 docker/map/nginx.map.conf                   |  18 +++
 docker/web/Dockerfile                       |  11 ++
 docker/web/nginx.dev.conf                   |  44 +++++++
 docker/web/wrolpi.dev.conf                  |  73 ++++++++++++
 docker/zim/entrypoint.sh                    |   2 +-
 docker/zim/nginx.zim.conf                   |  18 +++
 etc/raspberrypios/000-default.conf          |   4 +
 etc/raspberrypios/nginx.conf                | 123 +++++++-------------
 etc/raspberrypios/ports.conf                |  16 +--
 etc/raspberrypios/wrolpi-api.service        |   2 +-
 etc/raspberrypios/wrolpi-help-files.desktop |   6 +
 etc/raspberrypios/wrolpi-help.desktop       |   6 +
 etc/raspberrypios/wrolpi-help.service       |   2 +-
 etc/raspberrypios/wrolpi.conf               |  73 ++++++++++++
 etc/raspberrypios/wrolpi.desktop            |   6 +
 help.sh                                     |  12 +-
 nginx.dev.conf                              |  90 --------------
 pi-gen/stage2/04-wrolpi/04-run-chroot.sh    |  27 +----
 repair.sh                                   |  15 +++
 scripts/start_kiwix_serve.sh                |   4 +-
 31 files changed, 450 insertions(+), 244 deletions(-)
 create mode 100644 docker/help/nginx.help.conf
 create mode 100644 docker/https_proxy/Dockerfile
 create mode 100644 docker/https_proxy/nginx.proxy.conf
 create mode 100644 docker/map/nginx.map.conf
 create mode 100644 docker/web/Dockerfile
 create mode 100644 docker/web/nginx.dev.conf
 create mode 100644 docker/web/wrolpi.dev.conf
 create mode 100644 docker/zim/nginx.zim.conf
 create mode 100644 etc/raspberrypios/wrolpi-help-files.desktop
 create mode 100644 etc/raspberrypios/wrolpi-help.desktop
 create mode 100644 etc/raspberrypios/wrolpi.conf
 create mode 100644 etc/raspberrypios/wrolpi.desktop
 delete mode 100644 nginx.dev.conf

diff --git a/README.md b/README.md
index 9c0e260b..6e62cfd9 100644
--- a/README.md
+++ b/README.md
@@ -89,7 +89,7 @@ You can try out WROLPi by running the docker containers.
 8. Start the docker containers.
     * `docker-compose up`
 9. Browse to WROLPi.
-    * http://0.0.0.0:8080
+    * https://0.0.0.0:8443
 
 # Debian 12 Install
 
@@ -106,7 +106,7 @@ Steps necessary to initialize your WROLPi after installing the Debian image from
 5. Switch to the root user: `su -`
 6. Initialize the WROLPi databases using the repair script: `/opt/wrolpi/repair.sh`
 7. Reboot: `reboot`
-8. Browse to http://wrolpi.local or the IP address of your WROLPi!
+8. Browse to https://wrolpi.local or the IP address of your WROLPi!
 
 # Raspberry Pi Install
 
@@ -118,7 +118,7 @@ Steps necessary to initialize your WROLPi after installing the Raspberry Pi imag
     * `echo '/dev/sda1 /media/wrolpi auto defaults,nofail 0 0' | sudo tee -a /etc/fstab`
 4. Initialize the WROLPi databases using the repair script: `sudo /opt/wrolpi/repair.sh`
 5. Reboot `sudo reboot`
-6. Join the Hotspot or browse to http://wrolpi.local or the IP address of your WROLPi!
+6. Join the Hotspot or browse to https://wrolpi.local or the IP address of your WROLPi!
 
 # Charter
 
diff --git a/app/src/App.js b/app/src/App.js
index cd82db13..519023ba 100644
--- a/app/src/App.js
+++ b/app/src/App.js
@@ -21,6 +21,7 @@ import {SemanticToastContainer} from "react-semantic-toasts-2";
 import {FilePreviewProvider} from "./components/FilePreview";
 import {TagsProvider} from "./Tags";
 import {ZimRoute} from "./components/Zim";
+import {HELP_VIEWER_URI} from "./components/Common";
 
 function PageNotFound() {
     const {t} = useContext(ThemeContext);
@@ -51,7 +52,7 @@ function Footer() {
 function HelpPage() {
     return <iframe
         title='map'
-        src={`http://${window.location.hostname}:8086/`}
+        src={HELP_VIEWER_URI}
         style={{
             position: 'fixed',
             height: '100%',
diff --git a/app/src/components/Apps.js b/app/src/components/Apps.js
index 3791d9f6..11180928 100644
--- a/app/src/components/Apps.js
+++ b/app/src/components/Apps.js
@@ -147,7 +147,7 @@ function OTP() {
 
     const {t} = useContext(ThemeContext);
 
-    let newPadURL = `http://${window.location.host}/api/otp/html`;
+    let newPadURL = `https://${window.location.host}/api/otp/html`;
     let cheatSheetURL = `${process.env.PUBLIC_URL}/one-time-pad-cheat-sheet.pdf`;
 
     return <>
diff --git a/app/src/components/Common.js b/app/src/components/Common.js
index ba515c06..f672616f 100644
--- a/app/src/components/Common.js
+++ b/app/src/components/Common.js
@@ -48,7 +48,7 @@ import _ from "lodash";
 import {killDownloads, startDownloads} from "../api";
 import Grid from "semantic-ui-react/dist/commonjs/collections/Grid";
 
-export const API_URI = process.env && process.env.REACT_APP_API_URI ? process.env.REACT_APP_API_URI : `${window.location.protocol}//${window.location.host}/api`;
+export const API_URI = process.env && process.env.REACT_APP_API_URI ? process.env.REACT_APP_API_URI : `https://${window.location.host}/api`;
 export const VIDEOS_API = `${API_URI}/videos`;
 export const ARCHIVES_API = `${API_URI}/archive`;
 export const OTP_API = `${API_URI}/otp`;
@@ -56,6 +56,11 @@ export const ZIM_API = `${API_URI}/zim`;
 export const DEFAULT_LIMIT = 20;
 export const NAME = process.env && process.env.REACT_APP_NAME ? process.env.REACT_APP_NAME : null;
 
+// Other services on a WROLPi.
+export const MAP_VIEWER_URI = `https://${window.location.hostname}:8084`;
+export const ZIM_VIEWER_URI = `https://${window.location.hostname}:8085`;
+export const HELP_VIEWER_URI = `https://${window.location.hostname}:8086`;
+
 export function Paginator({activePage, onPageChange, totalPages, showFirstAndLast, size = 'mini'}) {
     const handlePageChange = (e, {activePage}) => {
         onPageChange(activePage);
diff --git a/app/src/components/Map.js b/app/src/components/Map.js
index ce0983bd..2a022654 100644
--- a/app/src/components/Map.js
+++ b/app/src/components/Map.js
@@ -7,6 +7,7 @@ import {
     humanFileSize,
     IframeViewer,
     InfoMessage,
+    MAP_VIEWER_URI,
     PageContainer,
     TabLinks,
     useTitle,
@@ -32,9 +33,6 @@ import {Loader, Placeholder, Table} from "./Theme";
 import {StatusContext} from "../contexts/contexts";
 import _ from "lodash";
 
-
-const VIEWER_URL = `http://${window.location.hostname}:8084/`;
-
 function DockerMapImportWarning() {
     const {status} = useContext(StatusContext);
     if (status['dockerized']) {
@@ -95,7 +93,7 @@ function DownloadMessage() {
 
 const ViewerMessage = () => {
     return <HandPointMessage>
-        <p>You can view your Map at <a href={VIEWER_URL}>{VIEWER_URL}</a></p>
+        <p>You can view your Map at <a href={MAP_VIEWER_URI}>{MAP_VIEWER_URI}</a></p>
     </HandPointMessage>
 }
 
@@ -293,7 +291,7 @@ class ManageMap extends React.Component {
 }
 
 function MapPage() {
-    return <IframeViewer title='map' viewerUrl={VIEWER_URL}/>
+    return <IframeViewer title='map' viewerUrl={MAP_VIEWER_URI}/>
 }
 
 export function MapRoute() {
diff --git a/app/src/components/Zim.js b/app/src/components/Zim.js
index 06eecc2b..fe474e4a 100644
--- a/app/src/components/Zim.js
+++ b/app/src/components/Zim.js
@@ -43,7 +43,8 @@ import {
     TabLinks,
     TagIcon,
     useTitle,
-    WarningMessage
+    WarningMessage,
+    ZIM_VIEWER_URI
 } from "./Common";
 import Grid from "semantic-ui-react/dist/commonjs/collections/Grid";
 import {TagsSelector} from "../Tags";
@@ -66,8 +67,6 @@ import {SortableTable} from "./SortableTable";
 import {toast} from "react-semantic-toasts-2";
 import _ from "lodash";
 
-const VIEWER_URL = `http://${window.location.hostname}:8085/`;
-
 export const OutdatedZimsMessage = ({onClick}) => {
     const [open, setOpen] = React.useState(false);
 
@@ -339,7 +338,7 @@ const DownloadMessage = () => {
 
 const ViewerMessage = () => {
     return <HandPointMessage>
-        <p>You can view your Zim files using the Kiwix app, or at <a href={VIEWER_URL}>{VIEWER_URL}</a></p>
+        <p>You can view your Zim files using the Kiwix app, or at <a href={ZIM_VIEWER_URI}>{ZIM_VIEWER_URI}</a></p>
     </HandPointMessage>
 }
 
@@ -536,7 +535,7 @@ class ManageZim extends React.Component {
 }
 
 function ZimViewer() {
-    return <IframeViewer title='zim' viewerUrl={VIEWER_URL}/>
+    return <IframeViewer title='zim' viewerUrl={ZIM_VIEWER_URI}/>
 }
 
 export function ZimRoute() {
diff --git a/docker-compose.yml b/docker-compose.yml
index 4e5067bd..f646ec4d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -77,22 +77,38 @@ services:
       - './modules/map/leaflet.html:/var/www/html/index.html'
       - './modules/map/leaflet.js:/var/www/html/leaflet.js'
       - './modules/map/leaflet.css:/var/www/html/leaflet.css'
-    ports:
-      - '8084:80'
     command: 'run'
     shm_size: 1g  # Increase shared size to render large map tiles
     healthcheck:
       test: [ 'CMD-SHELL', 'curl http://127.0.0.1:80' ]
       interval: 1m
 
+  map_https: # HTTPS for map tile server
+    depends_on:
+      - map
+    build:
+      context: .
+      dockerfile: docker/https_proxy/Dockerfile
+    ports:
+      - '8084:443'
+    volumes:
+      - './docker/map/nginx.map.conf:/etc/nginx/nginx.conf'
+    healthcheck:
+      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:443' ]
+      interval: 1m
+
   web:
     depends_on:
       - app
-    image: nginx:latest
+    build:
+      context: .
+      dockerfile: docker/web/Dockerfile
     ports:
       - ${WEB_HOST-0.0.0.0}:${WEB_PORT-8080}:80
+      - ${WEB_HOST-0.0.0.0}:${WEB_HTTPS_PORT-8443}:443
     volumes:
-      - './nginx.dev.conf:/etc/nginx/nginx.conf'
+      - './docker/web/nginx.dev.conf:/etc/nginx/nginx.conf'
+      - './docker/web/wrolpi.dev.conf:/etc/nginx/conf.d/wrolpi.conf'
       - './icon.ico:/etc/nginx/favicon.ico'
       - './icon.png:/etc/nginx/icon.png'
       - './test:/opt/media'
@@ -107,8 +123,23 @@ services:
     volumes:
       - './test:/media/wrolpi'
       - './docker/zim/entrypoint.sh:/entrypoint.sh'
+    healthcheck:
+      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:80' ]
+      interval: 1m
+
+  zim_https: # HTTPS for Zim service.
+    depends_on:
+      - zim
+    build:
+      context: .
+      dockerfile: docker/https_proxy/Dockerfile
     ports:
-      - '8085:8085'
+      - '8085:443'
+    volumes:
+      - './docker/zim/nginx.zim.conf:/etc/nginx/nginx.conf'
+    healthcheck:
+      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:443' ]
+      interval: 1m
 
   help: # The WROLPi Help documentation.
     build:
@@ -116,12 +147,24 @@ services:
       dockerfile: docker/help/Dockerfile
     volumes:
       - './docker/help/wrolpi-help:/opt/wrolpi-help'
-    ports:
-      - '8086:8086'
     healthcheck:
       test: [ 'CMD-SHELL', 'curl http://127.0.0.1:8086' ]
       interval: 1m
 
+  help_https: # HTTPS for Help service.
+    depends_on:
+      - help
+    build:
+      context: .
+      dockerfile: docker/https_proxy/Dockerfile
+    ports:
+      - '8086:443'
+    volumes:
+      - './docker/help/nginx.help.conf:/etc/nginx/nginx.conf'
+    healthcheck:
+      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:443' ]
+      interval: 1m
+
 volumes:
   openstreetmap-data:
     external: true
diff --git a/docker/help/Dockerfile b/docker/help/Dockerfile
index de8a8d8e..631f79f6 100644
--- a/docker/help/Dockerfile
+++ b/docker/help/Dockerfile
@@ -6,4 +6,4 @@ COPY docker/help/wrolpi-help /opt/wrolpi-help
 RUN pip3 install -r /opt/wrolpi-help/requirements.txt
 
 ENTRYPOINT ["mkdocs"]
-CMD ["serve", "-a", "0.0.0.0:8086"]
+CMD ["serve", "-a", "0.0.0.0:80"]
diff --git a/docker/help/nginx.help.conf b/docker/help/nginx.help.conf
new file mode 100644
index 00000000..0ebe5607
--- /dev/null
+++ b/docker/help/nginx.help.conf
@@ -0,0 +1,18 @@
+events {}
+
+http {
+    server {
+        listen 443 ssl;
+
+        ssl_certificate /cert.crt;
+        ssl_certificate_key /cert.key;
+
+        location / {
+            proxy_pass http://help:80;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}
diff --git a/docker/https_proxy/Dockerfile b/docker/https_proxy/Dockerfile
new file mode 100644
index 00000000..1c00a4a3
--- /dev/null
+++ b/docker/https_proxy/Dockerfile
@@ -0,0 +1,12 @@
+# This Dockerfile is used as a reverse proxy to serve a HTTPS nieve service with HTTPS.
+FROM nginx:latest as https_proxy
+
+# Create a self-signed cert and key pair for HTTPS.
+RUN openssl genrsa -out /cert.key 2048
+RUN openssl req -new -x509 -nodes -key /cert.key -out /cert.crt -days 3650  \
+    -subj "/C=US/ST=State/L=City/O=Org/OU=WROLPi/CN=wrolpi.local"
+RUN chmod 777 /cert.key /cert.crt
+
+# Copy Nginx configuration
+COPY docker/https_proxy/nginx.proxy.conf /etc/nginx/nginx.conf
+CMD ["nginx", "-g", "daemon off;"]
diff --git a/docker/https_proxy/nginx.proxy.conf b/docker/https_proxy/nginx.proxy.conf
new file mode 100644
index 00000000..f55e683a
--- /dev/null
+++ b/docker/https_proxy/nginx.proxy.conf
@@ -0,0 +1,18 @@
+events {}
+
+http {
+    server {
+        listen 443 ssl;
+
+        ssl_certificate /cert.crt;
+        ssl_certificate_key /cert.key;
+
+        location / {
+            proxy_pass http://localhost:80;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}
diff --git a/docker/map/nginx.map.conf b/docker/map/nginx.map.conf
new file mode 100644
index 00000000..86e2a896
--- /dev/null
+++ b/docker/map/nginx.map.conf
@@ -0,0 +1,18 @@
+events {}
+
+http {
+    server {
+        listen 443 ssl;
+
+        ssl_certificate /cert.crt;
+        ssl_certificate_key /cert.key;
+
+        location / {
+            proxy_pass http://map:80;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}
diff --git a/docker/web/Dockerfile b/docker/web/Dockerfile
new file mode 100644
index 00000000..c2b55dba
--- /dev/null
+++ b/docker/web/Dockerfile
@@ -0,0 +1,11 @@
+FROM nginx:latest
+
+# Create a self-signed cert and key pair for HTTPS.
+RUN openssl genrsa -out /cert.key 2048
+RUN openssl req -new -x509 -nodes -key /cert.key -out /cert.crt -days 3650  \
+    -subj "/C=US/ST=State/L=City/O=Org/OU=WROLPi/CN=wrolpi.local"
+RUN chmod 777 /cert.key /cert.crt
+
+RUN rm /etc/nginx/conf.d/default.conf
+COPY docker/web/nginx.dev.conf /etc/nginx/nginx.conf
+COPY docker/web/wrolpi.dev.conf /etc/nginx/conf.d/wrolpi.conf
diff --git a/docker/web/nginx.dev.conf b/docker/web/nginx.dev.conf
new file mode 100644
index 00000000..2d2292d4
--- /dev/null
+++ b/docker/web/nginx.dev.conf
@@ -0,0 +1,44 @@
+events {
+
+}
+
+
+http {
+  client_max_body_size 0;
+
+  map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+  }
+  charset utf-8;
+
+  include mime.types;
+  types {
+    # Custom types for ebooks.
+    application/x-mobipocket-ebook mobi;
+    application/epub+zip epub;
+  }
+
+  server {
+    listen 80;
+    listen [::]:80;
+    server_name _; # Default server for requests without "Host" header
+
+    location / {
+      return 301 https://$host:8443$request_uri;
+    }
+  }
+
+  server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    proxy_pass_header Host;
+
+    # Self-signed cert from Dockerfile build.
+    ssl_certificate /cert.crt;
+    ssl_certificate_key /cert.key;
+
+    include /etc/nginx/conf.d/*;
+  }
+
+}
\ No newline at end of file
diff --git a/docker/web/wrolpi.dev.conf b/docker/web/wrolpi.dev.conf
new file mode 100644
index 00000000..f5c60898
--- /dev/null
+++ b/docker/web/wrolpi.dev.conf
@@ -0,0 +1,73 @@
+# Nginx config for the WROLPi services.
+
+#
+# App
+#
+
+location /favicon.ico {
+      alias /etc/nginx/favicon.ico;
+}
+
+location /apple-touch-icon.png {
+  alias /etc/nginx/icon.png;
+}
+
+location / {
+  # React APP
+  proxy_pass http://app:3000;
+  rewrite $1 break;
+}
+
+location /ws {
+  proxy_pass http://app:3000;
+  proxy_http_version 1.1;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection $connection_upgrade;
+}
+
+#
+# API
+#
+
+location /api {
+  proxy_pass http://api:8081;
+  rewrite /^api(.*)$ $1 break;
+}
+
+location /docs {
+  proxy_pass http://api:8081;
+  rewrite /^docs(.*)$ $1 break;
+}
+
+location /media {
+  # The media files mounted in the docker volume
+  sendfile on;
+  sendfile_max_chunk 1m;
+
+  tcp_nopush on;
+  tcp_nodelay on;
+  keepalive_timeout 65;
+
+  autoindex on;
+  autoindex_exact_size off;
+  alias /opt/media;
+}
+
+location /download {
+  # Assume any request here is to download a file from the media directory.
+  if ( $request_filename ~ '^.*/(.+)$' ) {
+    # Always include the filename for downloads.
+    add_header Content-Disposition 'attachment; filename="$1"';
+  }
+
+  sendfile on;
+  sendfile_max_chunk 1m;
+
+  tcp_nopush on;
+  tcp_nodelay on;
+  keepalive_timeout 65;
+
+  autoindex on;
+  autoindex_exact_size off;
+  alias /opt/media;
+}
diff --git a/docker/zim/entrypoint.sh b/docker/zim/entrypoint.sh
index ac383135..52c307c3 100755
--- a/docker/zim/entrypoint.sh
+++ b/docker/zim/entrypoint.sh
@@ -4,4 +4,4 @@ rm -f /library.xml
 # Find all Zim files and import them.
 find /media/wrolpi -iname '*.zim' -exec /import_zim.sh {} \;
 
-kiwix-serve --monitorLibrary --library /library.xml --address 0.0.0.0 --port 8085
+kiwix-serve --monitorLibrary --library /library.xml --address 0.0.0.0 --port 80
diff --git a/docker/zim/nginx.zim.conf b/docker/zim/nginx.zim.conf
new file mode 100644
index 00000000..a525a9cb
--- /dev/null
+++ b/docker/zim/nginx.zim.conf
@@ -0,0 +1,18 @@
+events {}
+
+http {
+    server {
+        listen 443 ssl;
+
+        ssl_certificate /cert.crt;
+        ssl_certificate_key /cert.key;
+
+        location / {
+            proxy_pass http://zim:80;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}
diff --git a/etc/raspberrypios/000-default.conf b/etc/raspberrypios/000-default.conf
index 4a7495d0..9a4f9f5a 100644
--- a/etc/raspberrypios/000-default.conf
+++ b/etc/raspberrypios/000-default.conf
@@ -19,6 +19,10 @@
 
 	DocumentRoot /var/www/html
 
+    SSLEngine on
+    SSLCertificateFile /etc/nginx/cert.crt
+    SSLCertificateKeyFile /etc/nginx/cert.key
+
 	# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
 	# error, crit, alert, emerg.
 	# It is also possible to configure the loglevel for particular
diff --git a/etc/raspberrypios/nginx.conf b/etc/raspberrypios/nginx.conf
index 919ae93b..9dfac32c 100644
--- a/etc/raspberrypios/nginx.conf
+++ b/etc/raspberrypios/nginx.conf
@@ -25,93 +25,56 @@ http {
   error_page 504 /error/50x.html;
 
   server {
-    proxy_pass_header Host;
-
-    location ^~ /error/ {
-      internal;
-      alias /var/www/;
-    }
-
-    location /favicon.ico {
-      alias /opt/wrolpi/icon.ico;
-    }
-
-    location /apple-touch-icon.png {
-      alias /opt/wrolpi/icon.png;
-    }
-
-    location /50x.html {
-      alias /error/50x.html;
-    }
-
-    location /epub/epub.html {
-      alias /opt/wrolpi/app/public/epub/epub.html;
-    }
-
-    location /epub/epub.js {
-      alias /opt/wrolpi/app/public/epub/epub.js;
-    }
-
-    location /epub/jszip.min.js {
-      alias /opt/wrolpi/app/public/jszip.min.js;
-    }
+    listen 80;
+    listen [::]:80;
+    server_name _; # Default server for requests without "Host" header
 
     location / {
-      # React APP
-      proxy_pass http://127.0.0.1:5000;
-      rewrite $1 break;
+      return 301 https://$host$request_uri;
     }
+  }
 
-    location /sockjs-node {
-      proxy_pass http://127.0.0.1:5000;
-      proxy_http_version 1.1;
-      proxy_set_header Upgrade $http_upgrade;
-      proxy_set_header Connection $connection_upgrade;
+  server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    proxy_pass_header Host;
+
+    # Self-signed cert.
+    ssl_certificate /etc/nginx/cert.crt;
+    ssl_certificate_key /etc/nginx/cert.key;
+
+    include /etc/nginx/conf.d/*;
+  }
+
+  # HTTPS Map is served by Apache2.  This is because mod_tile.conf is required to render the map.  renderd does not
+  # support nginx.
+
+  server {
+    # HTTPS Kiwix.
+    listen 8085 ssl;
+    listen [::]:8085 ssl;
+    proxy_pass_header Host;
+
+    ssl_certificate /etc/nginx/cert.crt;
+    ssl_certificate_key /etc/nginx/cert.key;
+
+    location / {
+      proxy_pass http://0.0.0.0:9085;
     }
+  }
 
-    location /api {
-      proxy_pass http://127.0.0.1:8081;
-      rewrite /^api(.*)$ $1 break;
+  server {
+    # HTTPS Help.
+    listen 8086 ssl;
+    listen [::]:8086 ssl;
+    proxy_pass_header Host;
+
+    ssl_certificate /etc/nginx/cert.crt;
+    ssl_certificate_key /etc/nginx/cert.key;
+
+    location / {
+      proxy_pass http://0.0.0.0:9086;
     }
-
-    location /docs {
-      proxy_pass http://127.0.0.1:8081;
-      rewrite /^docs(.*)$ $1 break;
-    }
-
-    location /media {
-      # The media files mounted in the docker volume
-      sendfile on;
-      sendfile_max_chunk 1m;
-
-      tcp_nopush on;
-      tcp_nodelay on;
-      keepalive_timeout 65;
-
-      autoindex on;
-      autoindex_exact_size off;
-      alias /media/wrolpi;
-    }
-
-    location /download {
-      # Assume any request here is to download a file from the media directory.
-      if ( $request_filename ~ '^.*/(.+)$' ) {
-        # Always include the filename for downloads.
-        add_header Content-Disposition 'attachment; filename="$1"';
-      }
-
-      sendfile on;
-      sendfile_max_chunk 1m;
-
-      tcp_nopush on;
-      tcp_nodelay on;
-      keepalive_timeout 65;
-
-      autoindex on;
-      autoindex_exact_size off;
-      alias /media/wrolpi;
-    }
-
   }
 
 }
diff --git a/etc/raspberrypios/ports.conf b/etc/raspberrypios/ports.conf
index ddcbc031..0f8b9773 100644
--- a/etc/raspberrypios/ports.conf
+++ b/etc/raspberrypios/ports.conf
@@ -1,15 +1 @@
-# If you just change the port or add more ports here, you will likely also
-# have to change the VirtualHost statement in
-# /etc/apache2/sites-enabled/000-default.conf
-
-Listen 8084
-
-<IfModule ssl_module>
-	Listen 443
-</IfModule>
-
-<IfModule mod_gnutls.c>
-	Listen 443
-</IfModule>
-
-# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
+Listen 8084
\ No newline at end of file
diff --git a/etc/raspberrypios/wrolpi-api.service b/etc/raspberrypios/wrolpi-api.service
index 1389ab5c..c099e525 100644
--- a/etc/raspberrypios/wrolpi-api.service
+++ b/etc/raspberrypios/wrolpi-api.service
@@ -5,7 +5,7 @@ PartOf=wrolpi.target
 
 [Service]
 Environment=PYTHONUNBUFFERED=1
-ExecStart=/opt/wrolpi/venv/bin/sanic main:api_app --host 0.0.0.0 --port 8081 --fast
+ExecStart=/opt/wrolpi/venv/bin/sanic main:api_app --host 0.0.0.0 --port 8081 -w 2
 ExecReload=/bin/kill -HUP $MAINPID
 Group=wrolpi
 User=wrolpi
diff --git a/etc/raspberrypios/wrolpi-help-files.desktop b/etc/raspberrypios/wrolpi-help-files.desktop
new file mode 100644
index 00000000..af0bcb9d
--- /dev/null
+++ b/etc/raspberrypios/wrolpi-help-files.desktop
@@ -0,0 +1,6 @@
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi Help Files
+Type=Link
+URL=/opt/wrolpi-help/docs/
+Icon=/usr/share/icons/gnome/48x48/places/folder.png
diff --git a/etc/raspberrypios/wrolpi-help.desktop b/etc/raspberrypios/wrolpi-help.desktop
new file mode 100644
index 00000000..81e5ed89
--- /dev/null
+++ b/etc/raspberrypios/wrolpi-help.desktop
@@ -0,0 +1,6 @@
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi Help
+Type=Link
+URL=https://127.0.0.1:8086
+Icon=/opt/wrolpi-help/venv/lib/python3.11/site-packages/mkdocs/themes/mkdocs/img/favicon.ico
diff --git a/etc/raspberrypios/wrolpi-help.service b/etc/raspberrypios/wrolpi-help.service
index 2ade3e85..5eed0add 100644
--- a/etc/raspberrypios/wrolpi-help.service
+++ b/etc/raspberrypios/wrolpi-help.service
@@ -4,7 +4,7 @@ PartOf=wrolpi.target
 
 [Service]
 Type=simple
-ExecStart=/bin/bash -c 'source /opt/wrolpi-help/venv/bin/activate && exec mkdocs serve -a 0.0.0.0:8086'
+ExecStart=/bin/bash -c 'source /opt/wrolpi-help/venv/bin/activate && exec mkdocs serve -a 0.0.0.0:9086'
 Group=wrolpi
 User=wrolpi
 WorkingDirectory=/opt/wrolpi-help/
diff --git a/etc/raspberrypios/wrolpi.conf b/etc/raspberrypios/wrolpi.conf
new file mode 100644
index 00000000..a6eb2530
--- /dev/null
+++ b/etc/raspberrypios/wrolpi.conf
@@ -0,0 +1,73 @@
+# Nginx config for the WROLPi services.
+
+#
+# App
+#
+
+location /favicon.ico {
+  alias /opt/wrolpi/icon.ico;
+}
+
+location /apple-touch-icon.png {
+  alias /opt/wrolpi/icon.png;
+}
+
+location / {
+  # React APP
+  proxy_pass http://0.0.0.0:5000;
+  rewrite $1 break;
+}
+
+location /ws {
+  proxy_pass http://0.0.0.0:5000;
+  proxy_http_version 1.1;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection $connection_upgrade;
+}
+
+#
+# API
+#
+
+location /api {
+  proxy_pass http://0.0.0.0:8081;
+  rewrite /^api(.*)$ $1 break;
+}
+
+location /docs {
+  proxy_pass http://0.0.0.0:8081;
+  rewrite /^docs(.*)$ $1 break;
+}
+
+location /media {
+  # The media files mounted in the docker volume
+  sendfile on;
+  sendfile_max_chunk 1m;
+
+  tcp_nopush on;
+  tcp_nodelay on;
+  keepalive_timeout 65;
+
+  autoindex on;
+  autoindex_exact_size off;
+  alias /media/wrolpi;
+}
+
+location /download {
+  # Assume any request here is to download a file from the media directory.
+  if ( $request_filename ~ '^.*/(.+)$' ) {
+    # Always include the filename for downloads.
+    add_header Content-Disposition 'attachment; filename="$1"';
+  }
+
+  sendfile on;
+  sendfile_max_chunk 1m;
+
+  tcp_nopush on;
+  tcp_nodelay on;
+  keepalive_timeout 65;
+
+  autoindex on;
+  autoindex_exact_size off;
+  alias /opt/media;
+}
diff --git a/etc/raspberrypios/wrolpi.desktop b/etc/raspberrypios/wrolpi.desktop
new file mode 100644
index 00000000..9f23f8cd
--- /dev/null
+++ b/etc/raspberrypios/wrolpi.desktop
@@ -0,0 +1,6 @@
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi App
+Type=Link
+URL=https://127.0.0.1
+Icon=/opt/wrolpi/icon.png
diff --git a/help.sh b/help.sh
index a551e7bd..89c981ad 100755
--- a/help.sh
+++ b/help.sh
@@ -90,7 +90,7 @@ if sudo -i -u wrolpi psql -l 2>/dev/null | grep wrolpi >/dev/null; then
   if sudo -i -u wrolpi psql wrolpi -c '\d' | grep "file_group" >/dev/null; then
     echo "OK: WROLPi database is initialized"
 
-    if [ "$(sudo -i -u wrolpi psql wrolpi -c 'copy (select count(*) from file_group) to stdout')" -gt 0 ]; then
+    if [ "$(sudo -i -u wrolpi psql wrolpi -c 'copy (select count(*) from file_group) to stdout' 2>/dev/null)" -gt 0 ]; then
       echo "OK: WROLPi database has files"
     else
       echo "FAILED: WROLPi database has no files"
@@ -212,7 +212,7 @@ else
   echo "FAILED: renderd systemd does not exist"
 fi
 
-if curl -s http://0.0.0.0:8084 2>/dev/null | grep -i openstreetmap >/dev/null; then
+if curl -k -s https://0.0.0.0:8084 2>/dev/null | grep -i openstreetmap >/dev/null; then
   echo "OK: Map app responded"
 else
   echo "FAILED: Map app did not respond"
@@ -226,7 +226,7 @@ echo
 # Kiwix
 
 check_file /media/wrolpi/zims/library.xml "The kiwix library file exists" "The kiwix library file does not exist at /media/wrolpi/zims/library.xml"
-if curl -s http://0.0.0.0:8085 2>/dev/null | grep -i kiwix >/dev/null; then
+if curl -k -s https://0.0.0.0:8085 2>/dev/null | grep -i kiwix >/dev/null; then
   echo "OK: Kiwix app responded"
 else
   echo "FAILED: Kiwix app did not respond"
@@ -249,9 +249,9 @@ else
   echo "FAILED: Media directory is not a mounted drive.  (This is fine if you don't have an external drive.)"
 fi
 
-if curl -s http://0.0.0.0/media/ | grep "Index of" >/dev/null; then
+if curl -k -s https://0.0.0.0/media/ | grep "Index of" >/dev/null; then
   echo "OK: Media directory files are served by nginx"
-  if curl -s -I http://0.0.0.0/media/config/wrolpi.yaml | grep '200 OK' >/dev/null; then
+  if curl -k -s -I https://0.0.0.0/media/config/wrolpi.yaml | grep '200 OK' >/dev/null; then
     echo "OK: Config can be fetched from nginx"
   else
     echo "FAILED: Media directory files are not being served"
@@ -320,7 +320,7 @@ else
   echo "FAILED: Help mkdocs cannot be run"
 fi
 
-if curl -s http://0.0.0.0:8086/ | grep MkDocs 2>/dev/null >/dev/null; then
+if curl -k -s https://0.0.0.0:8086/ | grep MkDocs 2>/dev/null >/dev/null; then
   echo "OK: Help service is running"
 else
   echo "FAILED: Help service is not running"
diff --git a/nginx.dev.conf b/nginx.dev.conf
deleted file mode 100644
index 48e4be09..00000000
--- a/nginx.dev.conf
+++ /dev/null
@@ -1,90 +0,0 @@
-events {
-
-}
-
-
-http {
-  client_max_body_size 0;
-
-  map $http_upgrade $connection_upgrade {
-    default upgrade;
-    '' close;
-  }
-  charset utf-8;
-
-  include mime.types;
-  types {
-    # Custom types for ebooks.
-    application/x-mobipocket-ebook mobi;
-    application/epub+zip epub;
-  }
-
-  server {
-    proxy_pass_header Host;
-
-    location /favicon.ico {
-      alias /etc/nginx/favicon.ico;
-    }
-
-    location /apple-touch-icon.png {
-      alias /etc/nginx/icon.png;
-    }
-
-    location / {
-      # React APP
-      proxy_pass http://app:3000;
-      rewrite $1 break;
-    }
-
-    location /ws {
-      proxy_pass http://app:3000;
-      proxy_http_version 1.1;
-      proxy_set_header Upgrade $http_upgrade;
-      proxy_set_header Connection $connection_upgrade;
-    }
-
-    location /api {
-      proxy_pass http://api:8081;
-      rewrite /^api(.*)$ $1 break;
-    }
-
-    location /docs {
-      proxy_pass http://api:8081;
-      rewrite /^docs(.*)$ $1 break;
-    }
-
-    location /media {
-      # The media files mounted in the docker volume
-      sendfile on;
-      sendfile_max_chunk 1m;
-
-      tcp_nopush on;
-      tcp_nodelay on;
-      keepalive_timeout 65;
-
-      autoindex on;
-      autoindex_exact_size off;
-      alias /opt/media;
-    }
-
-    location /download {
-      # Assume any request here is to download a file from the media directory.
-      if ( $request_filename ~ '^.*/(.+)$' ) {
-        # Always include the filename for downloads.
-        add_header Content-Disposition 'attachment; filename="$1"';
-      }
-
-      sendfile on;
-      sendfile_max_chunk 1m;
-
-      tcp_nopush on;
-      tcp_nodelay on;
-      keepalive_timeout 65;
-
-      autoindex on;
-      autoindex_exact_size off;
-      alias /opt/media;
-    }
-  }
-
-}
diff --git a/pi-gen/stage2/04-wrolpi/04-run-chroot.sh b/pi-gen/stage2/04-wrolpi/04-run-chroot.sh
index d44b4876..169910a8 100755
--- a/pi-gen/stage2/04-wrolpi/04-run-chroot.sh
+++ b/pi-gen/stage2/04-wrolpi/04-run-chroot.sh
@@ -16,30 +16,9 @@ cat >/home/pi/.pgpass <<'EOF'
 127.0.0.1:5432:gis:_renderd:wrolpi
 127.0.0.1:5432:wrolpi:wrolpi:wrolpi
 EOF
-cat >/home/pi/Desktop/wrolpi.desktop <<'EOF'
-[Desktop Entry]
-Encoding=UTF-8
-Name=WROLPi App
-Type=Link
-URL=http://127.0.0.1
-Icon=/opt/wrolpi/icon.png
-EOF
-cat >/home/pi/Desktop/wrolpi-help.desktop <<'EOF'
-[Desktop Entry]
-Encoding=UTF-8
-Name=WROLPi Help
-Type=Link
-URL=http://127.0.0.1:8086
-Icon=/opt/wrolpi-help/venv/lib/python3.11/site-packages/mkdocs/themes/mkdocs/img/favicon.ico
-EOF
-cat >/home/pi/Desktop/wrolpi-help-files.desktop <<'EOF'
-[Desktop Entry]
-Encoding=UTF-8
-Name=WROLPi Help Files
-Type=Link
-URL=/opt/wrolpi-help/docs/
-Icon=/usr/share/icons/gnome/48x48/places/folder.png
-EOF
+# Update desktop shortcuts.
+cp /opt/wrolpi/etc/raspberrypios/*desktop /home/pi/Desktop/
+# Fix permissions.
 chown -R pi:pi /home/pi
 chmod 0600 /home/pi/.pgpass
 usermod -aG wrolpi pi
diff --git a/repair.sh b/repair.sh
index a711421c..76e7f7e1 100755
--- a/repair.sh
+++ b/repair.sh
@@ -34,8 +34,22 @@ git reset HEAD --hard
 
 # Copy configs to system.
 cp /opt/wrolpi/etc/raspberrypios/nginx.conf /etc/nginx/nginx.conf
+[ -f /etc/nginx/conf.d/default.conf ] && rm /etc/nginx/conf.d/default.conf
+cp /opt/wrolpi/etc/raspberrypios/wrolpi.conf /etc/nginx/conf.d/wrolpi.conf
 cp /opt/wrolpi/etc/raspberrypios/50x.html /var/www/50x.html
 
+# Generate nginx certificate for HTTPS.
+if [[ ! -f /etc/nginx/cert.crt || ! -f /etc/nginx/cert.key ]]; then
+  openssl genrsa -out /etc/nginx/cert.key 2048
+  openssl req -new -x509 -nodes -key /etc/nginx/cert.key -out /etc/nginx/cert.crt -days 3650  \
+      -subj "/C=US/ST=State/L=City/O=Org/OU=WROLPi/CN=$(hostname).local"
+  chmod 640 /etc/nginx/cert.key /etc/nginx/cert.crt
+fi
+
+# Update desktop shortcuts.
+cp /opt/wrolpi/etc/raspberrypios/*desktop /home/pi/Desktop/
+chown pi:pi /home/pi/Desktop/*desktop
+
 # WROLPi needs a few privileged commands.
 cp /opt/wrolpi/etc/raspberrypios/90-wrolpi /etc/sudoers.d/90-wrolpi
 chmod 0440 /etc/sudoers.d/90-wrolpi
@@ -60,6 +74,7 @@ cp /opt/wrolpi/etc/raspberrypios/index.html \
   /opt/wrolpi/modules/map/leaflet.js \
   /opt/wrolpi/modules/map/leaflet.css /var/www/html/
 chmod 644 /var/www/html/*
+a2enmod ssl
 
 systemctl enable renderd
 systemctl start renderd
diff --git a/scripts/start_kiwix_serve.sh b/scripts/start_kiwix_serve.sh
index 73ee1a50..d94927fd 100755
--- a/scripts/start_kiwix_serve.sh
+++ b/scripts/start_kiwix_serve.sh
@@ -23,5 +23,5 @@ find /media/wrolpi/zims -iname '*.zim' -exec kiwix-manage ${LIBRARY} add {} \;
 
 [ ! -f ${LIBRARY} ] && echo "Could not find any Zim files to import" && exit 2
 
-# Serve kiwix on the
-kiwix-serve --library ${LIBRARY} --address 0.0.0.0 --port 8085
+# Serve HTTP kiwix on 9085.  nginx will serve HTTPS on 8085.
+kiwix-serve --library ${LIBRARY} --address 0.0.0.0 --port 9085