# HTTPS and remote access

The browser can use the outpost locally at `http://127.0.0.1:8080`. The iOS App needs a reachable **HTTPS origin with a trusted certificate**. On your phone, `localhost` refers to the phone itself.

## Choose an address

Use a hostname that resolves to the outpost server from the networks where you will use Mailwake. A private network or VPN is suitable when both phone and server can reach it. Check DNS, firewall rules and certificate validity from the phone before creating an invitation.

Keep the outpost's port 8080 bound to loopback or a private Docker network. Publish the reverse proxy's HTTPS endpoint. Use a dedicated origin such as `https://mail.example.org`, serving the outpost at `/`.

## Reverse proxy on the host

With Caddy installed on the same host, replace the example hostname and configure DNS and ports 80/443 for certificate issuance:

```caddyfile
mail.example.org {
    reverse_proxy 127.0.0.1:8080
}
```

For nginx, supply the certificate and its key and preserve the original Host:

```nginx
server {
    listen 443 ssl;
    server_name mail.example.org;
    ssl_certificate /etc/letsencrypt/live/mail.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mail.example.org/privkey.pem;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}
```

A proxy in a container must reach the outpost through their shared Docker network; `127.0.0.1` inside that container reaches only the proxy container. Expose the outpost only to the proxy or trusted clients, because private-network proxy peers can supply forwarding headers.

## Verify from the phone

Open the HTTPS origin in Safari. Confirm that the page loads with a valid certificate, sign in, and save a harmless setting to check proxy headers and write requests. Then [connect the App](connect-app.md). If Safari fails, resolve DNS, routing or certificate problems first.

After changing the public address, create a fresh invitation with the new origin and reconnect the App. Your connection's stored address must match the address you intend to trust.