The web interface can run over HTTPS

From Anthias 2026.05.0, one script on the player puts its web interface behind HTTPS, so signing in and managing content stay private on a network you share with others.

Run it on the player in one of 3 ways:

• ~/anthias/bin/enable_ssl.sh uses a certificate the player issues itself. It works when you reach the player by its IP address on a local network, and browsers warn about the certificate until you trust it.
• ~/anthias/bin/enable_ssl.sh --domain signage.example.com gets a certificate from Let's Encrypt and renews it. The domain has to point at the player, and Let's Encrypt has to be able to reach it on port 80. Add --email with your address for Let's Encrypt's notices, or --staging to try it against Let's Encrypt's test service first.
• ~/anthias/bin/enable_ssl.sh --cert cert.pem --key key.pem uses a certificate and key you already have.

With HTTPS on, the web interface answers on port 443, and port 80 redirects to it. If the player runs a firewall, open port 443, for example with sudo ufw allow 443/tcp. To go back to plain HTTP on port 80, run ~/anthias/bin/disable_ssl.sh. It keeps the certificate, so turning HTTPS on again reuses it.

HTTPS runs in an extra container, anthias-caddy, which only exists while it's on. Upgrades keep it running.

If you ran enable_ssl.sh before

Earlier versions had a script with the same name, but it has done nothing since Anthias 0.18.4: it finished and printed that you could reach the web interface at https://, while the player kept serving it over plain HTTP on port 80. If you ran it on 0.18.4 or later, your web interface was never on HTTPS. Run the new script after upgrading to turn it on.