Operating

Enable HTTPs for Blnk Server

Turn on server.ssl, point your domain at Core, and verify HTTPS before you put traffic on it.

Deploy your Blnk server with HTTPS so traffic between clients and Core is encrypted. Blnk issues a Let’s Encrypt certificate when you set server.ssl to true and point a domain at the server.

This guide helps you set up HTTPS for a Core instance you operate yourself. You need a basic understanding of Docker, Compose, and domain management.

Before you start

Make sure that the Blnk server has been successfully deployed and is running on your machine.

Update your configuration file

Set server.ssl to true and provide the domain, notification email, and certificate storage path.

BLNK_SERVER_SSL=true
BLNK_SERVER_SSL_DOMAIN=yourdomain.com
BLNK_SERVER_SSL_EMAIL=your-email@example.com
BLNK_CERT_STORAGE_PATH=/var/lib/blnk/certs
BLNK_SERVER_PORT=5001

{
  "server": {
    "ssl": true,
    "domain": "yourdomain.com",
    "ssl_email": "your-email@example.com",
    "cert_storage_path": "/var/lib/blnk/certs",
    "port": "5001"
  }
}

When ssl is true, Blnk starts an HTTPS listener on server.port, obtains a certificate for server.domain, and stores it in cert_storage_path.

If a certificate cannot be issued, the server fails to start. It does not fall back to HTTP.

See HTTPS settings for every field and default.

Ensure your domain points to your server

Confirm that the DNS settings for your domain point to the IP address of your server.

This is required for Let’s Encrypt to verify the domain and issue a certificate. If domain is empty, Blnk defaults to localhost, which cannot receive a public certificate.

Start your Blnk server

With your configuration file updated, start your Blnk server using Docker Compose.

docker compose up

The process validates domain ownership, issues a certificate, and starts the HTTPS listener. Startup logs include the scheme (https) so you can confirm TLS is on.

Verifying your HTTPs set-up

Once your Blnk server is running, verify the HTTPS setup with curl:

curl https://yourdomain.com:5001 -I

You should see a successful HTTPS response. An HTTP client against the same port will fail the TLS handshake.

Next steps

With HTTPS enabled, traffic to your Blnk server is encrypted. Consider the following as you continue:

Monitor and renew certificates: Blnk automates issuance. Monitor your domain and certificates for expiry and keep cert_storage_path writable so renewals can be stored.
Security best practices: Keep software up to date, manage access controls, and monitor for unauthorized access. Enable secure mode for API authentication.