This is probably better suited for notes in the BYOS section, but I see another issue here referencing the issue of running HTTP rather than HTTPS at home, and I'm a big believer in "all networks are adversarial, so just use HTTPS whenever you can".

And since Let's Encrypt came out several years ago, it's now trivial to use HTTPS - even at home, even on a non-public network - without having to bypass any security measures.

In generic terms:

1. Get a (free) domain, and point it to the local ip address (such as 192.168.0.10)
2. Use a tool that supports that DNS provider to get free HTTPS certs
3. Configure a webserver to use those certs, and proxy to the API server

More specifically (for the Just Works™ scenario):

• You can get a free domain with DuckDNS (like noip, afraid, and others)
• Let's Encrypt provides free HTTPS certs that work in all browsers (Brave, Safari, etc)
• Caddy is a webserver that supports Let's Encrypt via HTTP or DNS
• Caddy can reverse proxy to the Ruby web server

Technically:

1. You download caddy with DuckDNS support from
   https://caddyserver.com/download?package=github.com%2Fcaddy-dns%2Fduckdns or build it with xcaddy (see https://webinstall.dev/xcaddy for notes).
2. You get your DuckDNS API token and stick it in caddy.env:

   MY_DUCKDNS_TOKEN=xxxxxxxx-xxxx-4xxx-8xxx-xxxxxxxxxxxx

3. You create a Caddyfile for your duckdns domain:

   example.duckdns.org {
       tls {
           dns duckdns {env.MY_DUCKDNS_TOKEN}
       }
       reverse_proxy localhost:4567 # change to the BYOS port
   }

4. Run the HTTPS server

   caddy --envfile ./caddy.env --config ./Caddyfile --adapter caddyfile

And that's it. caddy will renew the valid HTTPS cert with Let's Encrypt every 90 days, and the domain you chose will work internal to your home network without any security errors.

Notes

Add caddy as a System Service

serviceman is a simple tool written in shell script that templates out the appropriate system launcher config file for launchctl (macOS), systemd (most Linuxes), or OpenRC (Alpine and similar Linuxes).

curl https://webi.sh/serviceman | sh
. ~/.config/envman/PATH.env
serviceman add --name caddy -- \
    caddy --envfile ./caddy.env --config ./Caddyfile --adapter caddyfile

You can, of course, find articles on how to set up launchctl or systemd or OpenRC individually, but it's one of those things that can be very tedious and error-prone, has a lot of nuance, and for many people tends to be more of a barrier to entry than a particularly useful skill to acquire.

Build caddy with DuckDNS support

As you'll see on the page, sometimes the online build server is overloaded or otherwise fails, but building it yourself is very easy:

curl https://webi.sh/go | sh
curl https://webi.sh/xcaddy | sh
. ~/.config/envman/PATH.env
CGO_ENABLED=0 xcaddy build \
    --with github.com/caddy-dns/duckdns \
    --output ./caddy