Binions handles HTTPS in exactly one place. All encrypted traffic terminates at the edge — the built-in Traefik reverse proxy — which presents a main HTTPS edge on :8443 alongside a few dedicated admin entry points, every one of them secured by the same single long-lived certificate. Everything behind that edge runs as plain traffic on the host’s loopback interface, because it never leaves the machine.
One certificate, one place. You manage a single certificate for the whole platform — not one per service, and not one per entry point. Every HTTPS entry point on the edge uses it, which keeps configuration simple and renewals to a single, predictable step.
Binions uses an edge-termination model. Clients connect over HTTPS to the Traefik edge, Traefik decrypts the request, and it forwards plain HTTP to the daemon that handles it. The internal hops never go over the network — they stay on the host’s loopback interface (127.0.0.1):
:8443.localhost — never on the wire.| Encrypted (HTTPS) | Client on your network → Traefik edge at :8443 |
| Plain, on loopback | Traefik → daemon, and daemon → daemon / database / storage / tracing |
The platform’s bundled admin entry points — the Traefik dashboard (:8444), the MinIO console (:8445), and the Showman hub (:8446) — terminate TLS in exactly the same way, with the same certificate. The full list of edge entry points is in Network requirements.
Why plain traffic inside the host is safe. Binions runs as a single-host platform. The internal traffic between its parts never leaves the machine — it travels over the loopback interface, which no other computer can reach. Encrypting data that already stays inside one host would add cost and complexity without adding protection, so Binions deliberately encrypts only at the edge, where traffic actually crosses the network.
By default, Binions ships with a single self-signed certificate that covers the entire platform. It is long-lived (about ten years) and uses strong, modern parameters:
binions.local, any subdomain *.binions.local, the host’s configured bind address, and 127.0.0.1 — so it is valid however you reach the edge on your network, on any of its entry points.The certificate and its private key live alongside Traefik on the host:
| Certificate | /opt/binions/traefik/secrets/server.crt — mode 0640 |
| Private key | /opt/binions/traefik/secrets/server.key — mode 0600 |
| Owner | The Traefik service user |
Keep the key private. The private key is readable only by the Traefik service user, and it should stay that way. Never copy
server.keyoff the host or relax its permissions.
The certificate is created and refreshed by a single command. Run it on the host:
sudo binions-traefik-cert generateThe command lives at /usr/local/sbin/binions-traefik-cert. It is idempotent: if a valid certificate already exists and has more than 30 days of life left, it does nothing and leaves your current certificate in place. That makes it safe to run as often as you like — for example, from a scheduled job.
To replace the certificate before it is due (for instance, after changing the host’s bind address, or to rotate the key), force a fresh one:
sudo binions-traefik-cert generate --forceGood to know. After forcing a regeneration, clients that previously trusted the old certificate will need to trust the new one (see Trusting the certificate below). Reload or restart the edge if your deployment requires it to pick up the new files.
Binions also listens for plain HTTP on port :8081, but that entry point does only one thing: it sends every request straight to the secure one. Any plain http:// request receives a permanent redirect (HTTP 301) to the matching https://…:8443/ address.
http:// is upgraded automatically — nothing breaks.:8443 endpoint.Because the default certificate is self-signed, clients on your network need to trust it once. Browsers will show a security warning until you do — that warning is expected, not a sign of a problem.
For command-line tools, point the client at the certificate. For example, with curl:
curl --cacert /path/to/binions-edge.crt https://<host>:8443/Replace /path/to/binions-edge.crt with the certificate you copied from the host, and <host> with your host’s address. Once a client trusts the certificate, its connections to the edge are verified and warning-free.
Tip. Distribute the certificate (the
.crtfile only — never the key) to the machines and tools that need to call Binions, and add it to their trust store so connections are trusted automatically.
The self-signed certificate is the right default for a private, single-host deployment. When you later expose Binions through public DNS, you can switch to a publicly trusted certificate from Let’s Encrypt instead.