Serving over HTTPS

mddb listens on localhost:8080 by default and serves plain HTTP. Put HTTPS in front of it before other devices connect. GitHub sign-in, the GitHub App, and a standalone voice gateway need a public HTTPS origin.

Set the public origin

After you choose an address, set it as base_url and restart mddb:

[server]
base_url = "https://mddb.example.com"

OAuth callbacks, email links, and voice tokens use this origin. A mismatch makes provider sign-in fail.

To accept connections from other machines without a proxy, set http = "0.0.0.0:8080". Traffic then stays unencrypted.

Tailscale serves your tailnet

Tailscale gives mddb an HTTPS address without open ports or firewall rules:

# Reachable from your tailnet at https://<hostname>.<tailnet>.ts.net
tailscale serve --bg 8080

Tailscale Funnel publishes the same address to the internet:

# Reachable from the internet at https://<hostname>.<tailnet>.ts.net
tailscale funnel --bg 8080

Tailscale provisions Let's Encrypt certificates for both commands. Set base_url to the ts.net address. Use Funnel when GitHub must reach the GitHub App webhook.

Caddy serves a public domain

Caddy obtains and renews Let's Encrypt certificates for your domain. Start from the sample Caddyfile:

1. Replace mddb.example.com with your domain.
2. Copy the file to /etc/caddy/Caddyfile, or include it with import.
3. Reload Caddy with systemctl reload caddy.

The sample proxies to localhost:8080, sets security headers, checks /api/v1/health, and writes an access log. Set the client IP source in mddb:

[server]
base_url = "https://mddb.example.com"
trusted_proxies = ["127.0.0.1/32", "::1/128"]

Without trusted_proxies, mddb ignores forwarded addresses, and every client shares Caddy's rate limits.

Forward every path

Forward all paths to mddb, including /.well-known/. Go Mode clients and the voice bar read /.well-known/gomode.json. An external voice gateway in OAuth token mode also reads /.well-known/oauth-authorization-server and /oauth/jwks.