HTTPS, names and certificates

The box works over plain http://, and everything in Crewbox works that way except two things browsers only allow on HTTPS:

• the microphone, so browsers can only listen on voice, not talk;
• installing the app to the home screen, with its offline shell.

If your crew use the Android app for voice and nobody needs the home-screen install, skip this page. The Android app is exempt from the microphone rule.

HTTPS needs a certificate, and a certificate needs a name.

Two names

The box name resolves to a private address, which is why the venue's (or your own) router has to be taught about it.

1. Get a certificate

Issue a certificate for the box name. A Let's Encrypt DNS-01 challenge works: it never needs the box to be reachable from the internet. Save it as cert.pem and its key as key.pem.

2. Put it on the box

Copy cert.pem and key.pem into the box's data folder (~/.crewbox/data) and restart the box. It serves HTTPS itself; there's no proxy to set up.

• Broken or expired files never stop the box. It logs why, serves plain HTTP, and the readiness list says what's wrong. A certificate problem on show day costs you browser microphones, not comms.
• With a certificate installed, the box leads with its name: the terminal banner, the browser it opens and the menu-bar or tray item all show https://chat.example.com first, with the plain addresses after it.

3. Make the name resolve on site

Crew phones have to turn the box name into the box's address with no internet. In order of preference:

1. The venue router runs dnsmasq (most do). Add one line mapping the name to the box's address. Admin → This network offers Download DNS config (crewbox-dns.conf) with exactly that line when it sees the name isn't resolving. Hand it to whoever runs the router.
2. Your own event router: the same line, on your own kit.
3. No DNS control at all: crew use the address over plain HTTP. Everything works except browser microphones and home-screen install, and the readiness list says so.

Reserve the box's address in the router's DHCP, or the line points at last week's address.

4. Print the poster from the name

The /connect poster's QR code encodes whatever address you opened the page at. Open it at https://chat.example.com/connect before you print, or the poster sends crew to a raw address that browsers won't give a microphone to.

Checking it worked

• Admin → This network: the Crew can reach … by name check turns green, and the Certificate row shows when it expires.
• Admin → This box: Push-to-talk voice says browsers can talk, and Install to home screen, offline shell is Working.

Renew before an event, not during it: the readiness list starts warning as expiry approaches.

Keeping iPhones on a network with no internet

Every phone tests a new Wi-Fi network by fetching a fixed web address. On a network with no internet the test fails, and iPhones quietly move traffic to mobile data, which can't reach the box. The phone still shows the Wi-Fi as joined; Crewbox sits on Connecting.

The box can answer those tests itself, which needs two things. The readiness row Phones stay on this Wi-Fi says which is missing:

1. Phones can reach the box on port 80. Only an administrator process may take port 80. A box that can't get it takes port 8880 and says so, and Admin → This box offers Download port 80 config: one redirect rule, filled in for this machine. On Linux, sudo setcap 'cap_net_bind_service=+ep' /path/to/crewbox lets the box take port 80 itself, but the capability belongs to the file, and a self-update replaces the file: re-run it after each update, or use the redirect rule.
2. The router's DNS points the test addresses at the box. The crewbox-dns.conf from Admin → This network has a second, clearly marked optional block for this. Add it alongside the first.

Once both are in, phones stop warning that the network has no internet. CREWBOX_CAPTIVE=0 turns the responder off.