DNS & TLS Setup

This guide is only necessary if you want to make FD Commander accessible over the internet. If you're running it on a LAN at your Field Day site with no outside access, you can skip this entirely. FD Commander works perfectly on a local network over plain HTTP.

But if you want club members to register equipment and sign up for shifts before the event, or let people follow the live score from home during the event, you need a domain name and TLS. There is no good reason to put FD Commander on the public internet without HTTPS.

What You Need

• A domain name you control. You can register one from any registrar (Namecheap, Cloudflare, Porkbun, etc.). Something like yourcallsign.com works well.
• A public IP address at the location where FD Commander will run, or the ability to set one up (most home/club internet connections have one).
• Access to your router to set up port forwarding.
• FD Commander already deployed and running on your Pi or server.

How It Fits Together

When someone types fd.yourcallsign.com in their browser, three things happen in sequence:

1. DNS translates the domain name into your public IP address.
2. Your router forwards incoming traffic on ports 80 and 443 to the Pi on your local network.
3. TLS encrypts the connection so passwords and session data can't be intercepted.

This guide walks through each piece.

Step 1: Get Your Public IP

From any computer on the network where FD Commander will run, find your public IP address:

This is the IP address the rest of the internet uses to reach your network. Write it down. You'll enter it in your DNS settings.

Step 2: Create a DNS Record

Log into your domain registrar or DNS provider and create an A record pointing your chosen subdomain to your public IP.

Verify DNS

After a few minutes, confirm the record is working:

If it returns your public IP, DNS is set up correctly.

Step 3: Port Forwarding

Your router needs to know that incoming web traffic should go to the Pi. Log into your router's admin page (usually 192.168.1.1 or 192.168.0.1) and set up port forwarding rules:

• Forward port 80 (HTTP) to your Pi's local IP address, port 80.
• Forward port 443 (HTTPS) to your Pi's local IP address, port 443.

Port 80 is needed temporarily so Let's Encrypt can verify you own the domain. After TLS is set up, all real traffic goes through port 443.

Step 4: Deploy with TLS Enabled

FD Commander uses Caddy as its built-in web server. Caddy automatically obtains and renews TLS certificates from Let's Encrypt. You don't need to install anything extra or manage certificates manually.

When you run the deploy script, include the --ssl and --email flags:

If you've already deployed without TLS, you'll need to redeploy with these flags to enable it.

The script sets APP_URL to https://fd.yourcallsign.com, configures the Caddyfile with your domain, and starts the service on port 443. Caddy contacts Let's Encrypt, proves you own the domain (using the port 80 you forwarded earlier), obtains a TLS certificate, and starts serving HTTPS. It also renews the certificate before it expires, so you never have to think about it again.

Verify HTTPS

Open a browser and go to https://fd.yourcallsign.com. You should see FD Commander load with a padlock icon in the address bar. If you get a certificate warning, check the logs: sudo journalctl -u fd-commander --no-pager.

Caddy automatically redirects HTTP to HTTPS, so if someone types http://fd.yourcallsign.com they'll be sent to the secure version automatically.

Summary

Once all the pieces are in place, the setup looks like this:

1. DNS - an A record points fd.yourcallsign.com to your public IP.
2. Router - ports 80 and 443 forward to your Pi's local IP.
3. Deploy script - --ssl --email tells Caddy to obtain a Let's Encrypt certificate automatically.
4. Caddy - handles HTTPS, certificate renewal, and HTTP-to-HTTPS redirects.

Club members can now visit https://fd.yourcallsign.com to register equipment, sign up for shifts, follow the live score, and sign the guestbook, all over an encrypted connection.