Remote requires HTTPS?

[olivii]

Hi,

Thanks so much for TW5, I've been using it daily for about 2 years and I still in love with it.

My current setup is with the dockerized NodeJS on my raspberry and used in my home network only.
I wanted to have access on it also when outside home.
Therefore, I followed a tutorial on port forwarding and succeeded to have access on it from outside my network. All good!

However, I'm worried about not having an HTTPS in the connection.
My question: Is the authentication from NodeJS enough for safety (I have a strong password) or can someone still eavesdrop over my connection, see my password in clear (because HTTP not secured) and access my data ? (talking here about general safety case; not about shady airport wifi situations..)

If this could be a risk, is there a way to use "Let's Encrypt" free certificates from the NodeJS somehow ?

Thanks,

Oli

[saqimtiaz]

I would not recommend running the nodejs server exposed to the internet. Use a reverse proxy (nginx) or look into Tailscale.

[olivii]

Thanks for your quick answer, I wasn't aware I could run Nginx before the NodeJS at the same time. I'll look it up!

[joshuafontany]

https://talk.tiddlywiki.org/t/how-to-tiddlywiki-on-nodejs-nginx-proxy-letsencrypt/1183

[pmario]

If this could be a risk, is there a way to use "Let's Encrypt" free certificates

There are probably a lot of examples how to use Let's Encrypt with nginx as a reverse proxy on the internet

[pmario]

Once you figured it out, it would be nice if you would let us know about it too!

[joshuafontany]

I have this setup working on a Google Cloud VM instance. Let me know if you run into any issues. I do plan to document it at some point, & I used the Nginx (non https) tutorial on the TiddlyTalk forum as a basis.

[olivii]

Right, it's working well. It's not that difficult in the end. It just takes time because it's the first time I worked with Nginx and SSL certification.
I'll write down some info on what I did in a week or so. There are great tutos on youtube.

The only thing that failed and waste me quite some time was: I wanted to send the TW5 towards a subfolder in Nginx (like accessing with domain.com/tiddlywiki) but because of the subfolder path, it cannot recognize the path of some necessary assets.

1. It couldn't read the Status of the TiddlyWebAdaptor (the third line in the console when opening TW5 with NodeJS) {username, anonymous, read_only, space, etc}
2. It couldn't access the StoryList, so there was a sync error.
   I tried with rewrite in Nginx but couldn't succeed. My current workaround is to send the tiddlywiki directly to the main page of the domain. And that's working fine for now.

[joshuafontany]

You have to both manually set the "host path" as a server startup parameter AND as a tiddler (which tells the browser adaptor which path to call). Relevant links:
https://tiddlywiki.com/#Using%20a%20custom%20path%20prefix%20with%20the%20client-server%20edition:%5B%5BUsing%20a%20custom%20path%20prefix%20with%20the%20client-server%20edition%5D%5D%20%5B%5BWebServer%20Parameter%3A%20path-prefix%5D%5D

[jbarr]

I am using a Cloudflare Tunnel to provide remote access to TiddlyWiki on my homelab and a Cloudflare Application to provide authenticated access. from my LAN, I can hit the TW by IP without issue, and over the Internet, I can access it by subdomain once I'm authenticated. (Note that my use case is for MY exclusive access, not public access.)