There is no single “turn HTTPS on” switch that works for every CasaOS deployment. The right design depends on who needs to reach the server. If only your own devices need access, a private overlay network can avoid publishing the CasaOS dashboard at all. If other people or public web clients need a hostname, use a reverse proxy or tunnel that terminates TLS and forwards traffic to the internal service.
The 2024 source reply contained one important technical error: it suggested that ZeroTier could technically view the plain HTTP traffic inside the overlay. Current ZeroTier documentation explicitly says network traffic is encrypted end-to-end and that ZeroTier infrastructure cannot read packet contents. A browser can still display http:// because the application layer itself is HTTP, but the overlay transport is encrypted.
There Are Three Common Remote-Access Patterns
- Private overlay/VPN: only trusted devices join the private network.
- Reverse proxy + domain: public HTTPS terminates at Nginx/Caddy/Traefik and proxies to CasaOS/apps internally.
- Managed tunnel: a connector creates an outbound tunnel to a provider such as Cloudflare.
These can be combined, but beginners should choose the simplest architecture that meets the actual access requirement.
ZeroTier Encrypts Traffic End to End
Current ZeroTier protocol documentation says all ZeroTier traffic is end-to-end encrypted with keys controlled by the devices, and its FAQ says ZeroTier, Inc. cannot read network traffic.
See ZeroTier's current traffic-privacy statement.
Why the Browser May Still Say HTTP
If CasaOS listens on http://192.168.x.x and you reach that address over an encrypted overlay, the browser-to-CasaOS application protocol is still HTTP. The overlay encrypts the IP packets underneath it.
This is similar to using HTTP inside a private WireGuard tunnel: the transport is encrypted even though the web server itself is not serving TLS.
HTTPS Still Adds Useful Defense in Depth
Using HTTPS inside or outside a VPN gives you:
- server identity through certificates;
- browser-native secure-origin behavior;
- encrypted application transport even if traffic leaves the overlay;
- better compatibility with apps that require secure cookies or HTTPS callbacks.
A Reverse Proxy Is the Normal Self-Hosted HTTPS Pattern
With a reverse proxy, the public or private DNS name resolves to the proxy. The proxy listens on 443, manages the certificate, then forwards the request to CasaOS or an application on an internal HTTP port.
Nginx Proxy Manager, Caddy, and Traefik are common choices. The proxy itself must be protected because it becomes the front door to multiple services.
A Public Certificate Normally Needs a Domain or Valid ACME Challenge
Let's Encrypt-style certificates are issued for domain names after the requester proves control. For a home setup, that usually means a domain plus DNS/HTTP challenge handling.
Do not expose the CasaOS dashboard publicly just to obtain a certificate if only your own devices need access.
Cloudflare Tunnel Avoids Inbound Port Forwarding
A Cloudflare Tunnel connector makes an outbound connection to Cloudflare, so the home router does not need a normal inbound 443 forwarding rule. Cloudflare can provide HTTPS on the public hostname.
This moves part of the trust boundary to Cloudflare and should be paired with authentication/access policies for administrative services.
Keep the CasaOS Administration UI Private When Possible
The safest architecture is often to publish only the applications that need public access and keep the CasaOS management interface reachable only over the LAN or a private VPN/overlay.
TLS protects transport; it does not reduce the privilege of an administrator dashboard.
Pi-hole and WireGuard Do Not Require the Same Exposure Model
The source user planned to add Pi-hole and WireGuard later. Pi-hole's DNS service is usually intended for trusted LAN/VPN clients, not the open Internet. WireGuard deliberately exposes a VPN UDP listener but then provides a private path to other services.
Do not publish every CasaOS app just because one VPN port must be reachable.
CasaOS HTTPS FAQ
Can ZeroTier read the HTTP traffic inside my ZeroTier network?
Current ZeroTier documentation says no: traffic is end-to-end encrypted and its infrastructure cannot read packet contents.
Do I need HTTPS if I only connect through a private VPN?
The VPN already encrypts transport, but HTTPS can still add certificate identity and defense in depth.
Should the CasaOS admin dashboard be exposed publicly through a reverse proxy?
Prefer keeping the management UI private unless there is a specific, well-protected reason to publish it.
