> For the complete documentation index, see [llms.txt](https://docs.alpha-security.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.alpha-security.app/deployment/tls.md).

# TLS Setup

Alpha does not terminate TLS itself. In production, put a reverse proxy in front that handles certificates. Here are three common options.

## Caddy (simplest)

Caddy gets certificates from Let's Encrypt automatically. No configuration beyond the domain name.

Create a `Caddyfile` next to your compose file:

```
alpha.yourfirm.com {
    reverse_proxy web:80
}
```

Add Caddy to your compose file:

```yaml
services:
  caddy:
    image: caddy:2-alpine
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
    networks:
      - default

volumes:
  caddy_data:
```

Remove the `ports` section from the `web` service so it's only reachable through Caddy.

## nginx (with certbot)

If you already have nginx running on the host, add a server block:

```nginx
server {
    listen 443 ssl;
    server_name alpha.yourfirm.com;

    ssl_certificate     /etc/letsencrypt/live/alpha.yourfirm.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/alpha.yourfirm.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
```

Use certbot to get and renew certificates:

```bash
certbot --nginx -d alpha.yourfirm.com
```

## Traefik

If you're already running Traefik, add labels to the `web` service in your compose file:

```yaml
web:
  labels:
    - "traefik.enable=true"
    - "traefik.http.routers.alpha.rule=Host(`alpha.yourfirm.com`)"
    - "traefik.http.routers.alpha.tls.certresolver=letsencrypt"
```

## Self-signed certificates (internal use)

For lab environments or internal networks where Let's Encrypt isn't available:

```bash
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout alpha.key -out alpha.crt \
  -subj "/CN=alpha.local"
```

Mount these into whichever reverse proxy you choose. Operators will need to accept the certificate warning on first visit.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.alpha-security.app/deployment/tls.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.