Skills › Scientific Agent Skills › autoskill › https-proxy.md

https-proxy.md

72 lines · skills/autoskill/references/https-proxy.md at 5f2bc03

1# Optional: TLS for localhost screenpipe access

3Screenpipe's HTTP server (Axum, binding `localhost:3030`) speaks plain HTTP. Loopback HTTP is supported for same-host use. Keep the listener on loopback; transport encryption does not replace endpoint authentication or protect against other processes on the host.

5TLS on localhost is only useful when:

7- A corporate security policy mandates "TLS everywhere" regardless of transport.

8- The screenpipe endpoint is tunneled or exposed off-host.

9- A browser client requires a "secure context" (Service Workers, WebCrypto).

11The example below keeps the proxy loopback-only. Caddy's `tls internal` creates a local CA and attempts to install it into local trust stores when permitted. Python's HTTPX may use a different trust store.

Optional: TLS for localhost screenpipe access

Screenpipe's HTTP server (Axum, binding localhost:3030) speaks plain HTTP. Loopback HTTP is supported for same-host use. Keep the listener on loopback; transport encryption does not replace endpoint authentication or protect against other processes on the host.

TLS on localhost is only useful when:

A corporate security policy mandates "TLS everywhere" regardless of transport.
The screenpipe endpoint is tunneled or exposed off-host.
A browser client requires a "secure context" (Service Workers, WebCrypto).

The example below keeps the proxy loopback-only. Caddy's tls internal creates a local CA and attempts to install it into local trust stores when permitted. Python's HTTPX may use a different trust store.

Raw lines 1 to 12

13## Caddy

15Install:

17```bash

18brew install caddy # macOS

19# or see https://caddyserver.com/docs/install

20```

22Add to your `Caddyfile`:

24```caddyfile

25screenpipe.local {

26 bind 127.0.0.1

27 tls internal

28 reverse_proxy localhost:3030

29}

30```

32Ensure `screenpipe.local` resolves to loopback (add to `/etc/hosts`):

34```

35127.0.0.1 screenpipe.local

36```

38Start Caddy:

40```bash

41caddy run

42```

44Then update autoskill's `config.yaml`:

46```yaml

47screenpipe:

48 url: https://screenpipe.local

49```

51HTTPX verifies HTTPS by default and normally uses certifi, which may not include

52Caddy's local CA. Set `SSL_CERT_FILE` to a PEM CA bundle trusted for this service

53(including the Caddy root, and public roots if the same process calls a cloud LLM).

54Do not disable certificate verification to work around trust errors. A Caddy

55proxy bound off-host also needs access controls; TLS alone is not authorization.

56The Screenpipe bearer token is still required for protected API routes.

58This configuration was documentation-reviewed, not deployed during maintenance.

59Sources: [Caddy local HTTPS](https://caddyserver.com/docs/automatic-https) and

60[HTTPX SSL configuration](https://www.python-httpx.org/advanced/ssl/).

Caddy

Install:

brew install caddy   # macOS
# or see https://caddyserver.com/docs/install

Add to your Caddyfile:

screenpipe.local {
    bind 127.0.0.1
    tls internal
    reverse_proxy localhost:3030
}

Ensure screenpipe.local resolves to loopback (add to /etc/hosts):

127.0.0.1   screenpipe.local

Start Caddy:

caddy run

Then update autoskill's config.yaml:

screenpipe:
  url: https://screenpipe.local

HTTPX verifies HTTPS by default and normally uses certifi, which may not include Caddy's local CA. Set SSL_CERT_FILE to a PEM CA bundle trusted for this service (including the Caddy root, and public roots if the same process calls a cloud LLM). Do not disable certificate verification to work around trust errors. A Caddy proxy bound off-host also needs access controls; TLS alone is not authorization. The Screenpipe bearer token is still required for protected API routes.

This configuration was documentation-reviewed, not deployed during maintenance. Sources: Caddy local HTTPS and HTTPX SSL configuration.

Raw lines 13 to 61

62## mkcert (alternative)

64If you prefer managing the cert yourself instead of Caddy's internal CA:

66```bash

67brew install mkcert

68mkcert -install

69mkcert localhost 127.0.0.1

70```

72Then terminate TLS with nginx, Caddy, or stunnel using the generated cert.

mkcert (alternative)

If you prefer managing the cert yourself instead of Caddy's internal CA:

brew install mkcert
mkcert -install
mkcert localhost 127.0.0.1

Then terminate TLS with nginx, Caddy, or stunnel using the generated cert.

Raw lines 62 to 72