# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
@@ -19,10 +19,6 @@
DocumentRoot /var/www/html
- SSLEngine on
- SSLCertificateFile /etc/nginx/cert.crt
- SSLCertificateKeyFile /etc/nginx/cert.key
-
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
Header set Access-Control-Allow-Headers "Content-Type"
diff --git a/etc/raspberrypios/50x.html b/etc/raspberrypios/50x.html
index 16a2d0a2..3c1e4d76 100644
--- a/etc/raspberrypios/50x.html
+++ b/etc/raspberrypios/50x.html
@@ -4,7 +4,7 @@
Error!
-nginx could not find WROLPi! Are your services running?
+The web proxy could not find WROLPi! Are your services running?
Start by viewing status of your services at the
Controller
diff --git a/etc/raspberrypios/Caddyfile b/etc/raspberrypios/Caddyfile
new file mode 100644
index 00000000..a459bd76
--- /dev/null
+++ b/etc/raspberrypios/Caddyfile
@@ -0,0 +1,132 @@
+# Caddy config for WROLPi services (RPi/Debian bare metal).
+
+{
+ # No ACME - WROLPi is designed for offline use.
+ auto_https disable_redirects
+}
+
+:80 {
+ handle / {
+ root * /var/www
+ rewrite * /landing.html
+ file_server
+ }
+ handle /ca.crt {
+ root * /media/wrolpi/config/ssl
+ header Content-Type "application/x-x509-ca-cert"
+ header Content-Disposition "attachment; filename=\"wrolpi-ca.crt\""
+ file_server
+ }
+ handle {
+ redir https://{host}{uri} permanent
+ }
+}
+
+:443 {
+ tls /etc/ssl/wrolpi/cert.crt /etc/ssl/wrolpi/cert.key
+
+ header Access-Control-Allow-Origin "*"
+ header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+ header Access-Control-Allow-Headers "Content-Type, Accept"
+
+ handle /favicon.ico {
+ root * /opt/wrolpi
+ rewrite * /icon.ico
+ file_server
+ }
+
+ handle /apple-touch-icon.png {
+ root * /opt/wrolpi
+ rewrite * /icon.png
+ file_server
+ }
+
+ # WebSocket for React dev server.
+ handle /ws {
+ reverse_proxy 0.0.0.0:3000
+ }
+
+ # Controller - system management API and UI.
+ handle_path /controller/* {
+ reverse_proxy 0.0.0.0:8087
+ }
+ handle /controller {
+ redir * /controller/ 301
+ }
+
+ # Main API.
+ handle /api/* {
+ reverse_proxy 0.0.0.0:8081
+ }
+
+ # API docs.
+ handle /docs/* {
+ reverse_proxy 0.0.0.0:8081
+ }
+ handle /docs {
+ redir * /docs/ 301
+ }
+
+ # Static media files with directory browsing.
+ handle_path /media/* {
+ root * /media/wrolpi
+ file_server browse
+ }
+ handle /media {
+ redir * /media/ 301
+ }
+
+ # Downloads with Content-Disposition header.
+ handle_path /download/* {
+ root * /media/wrolpi
+ header Content-Disposition "attachment"
+ file_server browse
+ }
+ handle /download {
+ redir * /download/ 301
+ }
+
+ # React app with fallback to Controller.
+ handle {
+ reverse_proxy 0.0.0.0:3000 {
+ @bad status 502 503 504
+ handle_response @bad {
+ header Location /controller/?fallback=true
+ respond "" 302
+ }
+ }
+ }
+
+ handle_errors {
+ header Access-Control-Allow-Origin "*"
+ header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+ header Access-Control-Allow-Headers "Content-Type, Accept"
+ root * /var/www
+ rewrite * /50x.html
+ file_server
+ }
+}
+
+# Kiwix HTTPS proxy.
+:8085 {
+ tls /etc/ssl/wrolpi/cert.crt /etc/ssl/wrolpi/cert.key
+ header ?Access-Control-Allow-Origin "*"
+ header ?Access-Control-Allow-Methods "GET, OPTIONS"
+ reverse_proxy 0.0.0.0:9085
+}
+
+# Help HTTPS proxy.
+:8086 {
+ tls /etc/ssl/wrolpi/cert.crt /etc/ssl/wrolpi/cert.key
+ header ?Access-Control-Allow-Origin "*"
+ header ?Access-Control-Allow-Methods "GET, OPTIONS"
+ reverse_proxy 0.0.0.0:9086
+}
+
+# Map HTTPS proxy (Apache2 HTTP-only on 9084).
+:8084 {
+ tls /etc/ssl/wrolpi/cert.crt /etc/ssl/wrolpi/cert.key
+ header ?Access-Control-Allow-Origin "*"
+ header ?Access-Control-Allow-Methods "GET, OPTIONS"
+ reverse_proxy 0.0.0.0:9084
+}
diff --git a/etc/raspberrypios/landing.html b/etc/raspberrypios/landing.html
new file mode 100644
index 00000000..1ac7b3ec
--- /dev/null
+++ b/etc/raspberrypios/landing.html
@@ -0,0 +1,174 @@
+
+
+
+
+
+Welcome to WROLPi
+
+
+
+
+
Welcome to WROLPi
+
Your offline library needs a one-time certificate setup.
+
+
+
Certificate already trusted! Redirecting...
+
+
+
+
Step 1: Download the Root CA Certificate
+
Install this certificate on your device to trust all WROLPi HTTPS services permanently.
+
Download WROLPi Root CA
+
+
+
+
Step 2: Trust the Certificate
+
Follow the instructions for your device:
+
+
+ iOS / iPadOS
+
+
+ - Tap the download button above, then tap Allow when prompted.
+ - Open Settings → General → VPN & Device Management.
+ - Tap WROLPi Root CA → Install → enter your passcode.
+ - Go to Settings → General → About → Certificate Trust Settings.
+ - Enable full trust for WROLPi Root CA.
+
+
+
+
+ Android
+
+
+ - Tap the download button above.
+ - Open Settings → Security & privacy → More security settings → Encryption & credentials → Install a certificate → CA certificate.
+ - Select the downloaded
wrolpi-ca.crt file and confirm.
+
+
Menu paths vary by manufacturer. If you can't find it, search for "certificate" in Settings.
+
+
+
+ macOS
+
+
+ - Double-click the downloaded
wrolpi-ca.crt file to open Keychain Access.
+ - Add it to the System or login keychain.
+ - Find WROLPi Root CA in the keychain, double-click it.
+ - Expand Trust, set When using this certificate to Always Trust.
+ - Close and enter your password to confirm.
+
+
+
+
+ Windows
+
+
+ - Double-click the downloaded
wrolpi-ca.crt file.
+ - Click Install Certificate → Local Machine → Next.
+ - Select Place all certificates in the following store → Browse → Trusted Root Certification Authorities.
+ - Click Finish.
+
+
+
+
+ Linux (Debian / Ubuntu)
+
+
+ - Copy the certificate (the
.crt extension is required): sudo cp wrolpi-ca.crt /usr/local/share/ca-certificates/
+ - Update the trust store:
sudo update-ca-certificates
+ - Restart your browser. Chromium-based browsers (Chrome, Edge) will use the system store automatically.
+
+
Firefox on Linux does not use the system trust store by default — see the Firefox section below.
+
+
+
+ Firefox (all platforms)
+
+
Since Firefox 120, Firefox automatically trusts root certificates installed in the OS certificate store on Windows, macOS, and Android. If you've already installed the certificate above, Firefox should work with no extra steps on those platforms.
+
On Linux (or if auto-trust is disabled), import manually:
+
+ - Open Firefox, go to Settings → Privacy & Security.
+ - Scroll to Certificates → click View Certificates.
+ - In the Authorities tab, click Import.
+ - Select the downloaded
wrolpi-ca.crt file.
+ - Check Trust this CA to identify websites → OK.
+
+
Alternatively, enable auto-trust: go to about:config and set security.enterprise_roots.enabled to true.
+
+
+
+
+