# sslconfig.ai

> TLS, strong authentication, and MFA setup guides for AI development assistants. Start with the README for the decision guide, the full index, and the verification checklist, then fetch the guide matching the stack. Every guide concatenated into one file: https://sslconfig.ai/llms-full.txt . All content is dedicated to the public domain (CC0 1.0).

## Start here

- [README](https://raw.githubusercontent.com/jposluns/sslconfig/main/README.md): baseline rules for AI assistants, decision guide, index, verification checklist
- [common-mistakes](https://raw.githubusercontent.com/jposluns/sslconfig/main/common-mistakes.md): the recurring findings, each linked to its fix

## Certificates and access

- [free-certificates](https://raw.githubusercontent.com/jposluns/sslconfig/main/free-certificates.md): free publicly trusted certificates via ACME (Let's Encrypt, ZeroSSL), automated renewal
- [self-signed](https://raw.githubusercontent.com/jposluns/sslconfig/main/self-signed.md): OpenSSL and mkcert certificates, distributing trust to clients
- [cloudflare](https://raw.githubusercontent.com/jposluns/sslconfig/main/cloudflare.md): Cloudflare Tunnel and Zero Trust Access, no open inbound ports
- [tailscale](https://raw.githubusercontent.com/jposluns/sslconfig/main/tailscale.md): tailscale serve (tailnet-only) and funnel (public), automatic TLS

## Authentication and secrets

- [authentication](https://raw.githubusercontent.com/jposluns/sslconfig/main/authentication.md): password storage, sessions, API keys, rate limiting
- [mfa](https://raw.githubusercontent.com/jposluns/sslconfig/main/mfa.md): MFA options: identity layers with QR-code TOTP enrolment, app libraries, SSH modules, Duo
- [secrets](https://raw.githubusercontent.com/jposluns/sslconfig/main/secrets.md): keeping keys out of repositories, scanning, rotation after a leak

## Web servers and proxies

- [apache](https://raw.githubusercontent.com/jposluns/sslconfig/main/apache.md)
- [nginx](https://raw.githubusercontent.com/jposluns/sslconfig/main/nginx.md)
- [lighttpd](https://raw.githubusercontent.com/jposluns/sslconfig/main/lighttpd.md)
- [caddy](https://raw.githubusercontent.com/jposluns/sslconfig/main/caddy.md)
- [haproxy](https://raw.githubusercontent.com/jposluns/sslconfig/main/haproxy.md)
- [traefik](https://raw.githubusercontent.com/jposluns/sslconfig/main/traefik.md)

## Runtimes, containers, and clusters

- [nodejs](https://raw.githubusercontent.com/jposluns/sslconfig/main/nodejs.md): Node.js and Express
- [python](https://raw.githubusercontent.com/jposluns/sslconfig/main/python.md): Flask, FastAPI/Uvicorn, Gunicorn, Django
- [docker](https://raw.githubusercontent.com/jposluns/sslconfig/main/docker.md): safe port publishing, the UFW bypass problem
- [kubernetes](https://raw.githubusercontent.com/jposluns/sslconfig/main/kubernetes.md): cert-manager, ingress TLS, ingress auth

## Hosts and platforms

- [host](https://raw.githubusercontent.com/jposluns/sslconfig/main/host.md): SSH hardening, firewall baseline, updates
- [cloud-firewalls](https://raw.githubusercontent.com/jposluns/sslconfig/main/cloud-firewalls.md): security groups and network rules
- [paas](https://raw.githubusercontent.com/jposluns/sslconfig/main/paas.md): Render, Fly.io, Vercel, and similar: what stays yours

## Databases, storage, and messaging

- [postgresql](https://raw.githubusercontent.com/jposluns/sslconfig/main/postgresql.md)
- [mysql](https://raw.githubusercontent.com/jposluns/sslconfig/main/mysql.md)
- [mongodb](https://raw.githubusercontent.com/jposluns/sslconfig/main/mongodb.md)
- [redis](https://raw.githubusercontent.com/jposluns/sslconfig/main/redis.md)
- [elasticsearch](https://raw.githubusercontent.com/jposluns/sslconfig/main/elasticsearch.md): Elasticsearch and OpenSearch
- [minio](https://raw.githubusercontent.com/jposluns/sslconfig/main/minio.md)
- [rabbitmq](https://raw.githubusercontent.com/jposluns/sslconfig/main/rabbitmq.md)
- [mosquitto](https://raw.githubusercontent.com/jposluns/sslconfig/main/mosquitto.md): MQTT

## AI, data, and dev tools

- [jupyter](https://raw.githubusercontent.com/jposluns/sslconfig/main/jupyter.md)
- [ollama](https://raw.githubusercontent.com/jposluns/sslconfig/main/ollama.md): no built-in auth or TLS; protect with a proxy or tunnel
- [open-webui](https://raw.githubusercontent.com/jposluns/sslconfig/main/open-webui.md): signup control and fronting TLS
- [litellm](https://raw.githubusercontent.com/jposluns/sslconfig/main/litellm.md): master key and virtual keys
- [model-servers](https://raw.githubusercontent.com/jposluns/sslconfig/main/model-servers.md): llama.cpp and vLLM
- [gradio](https://raw.githubusercontent.com/jposluns/sslconfig/main/gradio.md)
- [streamlit](https://raw.githubusercontent.com/jposluns/sslconfig/main/streamlit.md)
- [n8n](https://raw.githubusercontent.com/jposluns/sslconfig/main/n8n.md)
- [code-server](https://raw.githubusercontent.com/jposluns/sslconfig/main/code-server.md)

## Web app controls

- [cors](https://raw.githubusercontent.com/jposluns/sslconfig/main/cors.md): allow your origins, not everyone's
- [headers](https://raw.githubusercontent.com/jposluns/sslconfig/main/headers.md): HSTS, CSP, and companions
- [firebase-supabase](https://raw.githubusercontent.com/jposluns/sslconfig/main/firebase-supabase.md): security rules and row-level security
- [admin-uis](https://raw.githubusercontent.com/jposluns/sslconfig/main/admin-uis.md): phpMyAdmin, pgAdmin, mongo-express, Grafana, Prometheus

## Optional

- [Repository](https://github.com/jposluns/sslconfig): source for all guides and this site
- [Contributing](https://raw.githubusercontent.com/jposluns/sslconfig/main/CONTRIBUTING.md): scope and the bar for new guides