Hello everyone!
Today, a small debate to discuss HTTPS in Gladys 4.
I’ve been thinking about it, and here are the different cases I’ve identified:
Case #1: First installation of Gladys
The user accesses their Raspberry Pi via the Raspberry Pi’s IP on their local network, connecting via HTTP for the first time. This approach has no significant risk; they are local and it’s the first connection.
Case #2: « General public » user
By « general public user, » I mean someone who may not have the necessary knowledge and does not necessarily want to get their hands dirty. They are simply passionate about technology, looking for a home automation solution that respects their privacy, and want a stable and secure installation of Gladys.
Recommended solution: Access to Gladys via the Gateway for remote access, and locally via HTTP for local access. After all, nothing prevents them from using the Gateway even at home, given that in Gladys 4 the Gateway interface and the local interface will be the same.
Case #3: Advanced user
This user can use the Gateway like the general public user, but will surely want direct access from the outside in order to be able to tinker with their installation even remotely.
Recommended solution: External connection via a domain + Let’s Encrypt.
I propose to stop using self-signed certificates with IP access as it is currently done, which is not clean. Today, with Let’s Encrypt, it’s super simple to have a free certificate. I think it’s up to the project to make architectural choices that promote clean and secure behavior.
The idea is therefore to integrate into Gladys the process of retrieving + renewing certificates.
There is a great NPM package called Greenlock that seems to do the job for what we want to do here. It even integrates with Express 
The question of remote services and MQTT
From what we have defined, MQTT will play a central role in communication between Gladys core and remote services.
What I propose: When the user configures MQTT (in the Gladys interface, not CLI), they have three options:
- MQTT runs without TLS
- MQTT runs with TLS and self-signed certificates automatically generated by Gladys.
- MQTT runs with TLS + a domain/subdomain + Let’s Encrypt certificates generated by Gladys
What do you think?