Domain and HTTPS

Mintrix needs a domain name, not an IP address: the licence is bound to it. Point the domain's DNS at the server; the installer only warns when it does not point there yet.

Mintrix listens for HTTP on port 80 and HTTPS on port 443, both open to the network.

Choose a setup

Setup	Cloudflare SSL/TLS mode
Cloudflare in front, Cloudflare Origin Certificate in certs/	Full (strict): encrypted and checked all the way (recommended)
Cloudflare in front, self-signed certificate (none added)	Full
Cloudflare in front, over HTTP only	Flexible
No proxy, your own certificate in certs/	none

With --http, users open http://<domain> directly. That is fine for trying Mintrix out, but sign-ins and customer data then travel unencrypted.

Add a certificate

Put the certificate, with its intermediate chain appended, and its key in /opt/mintrix/certs/:

• mintrix.crt
• mintrix.key

Then:

cd /opt/mintrix && sudo docker compose restart nginx

Any certificate works: a free Cloudflare Origin Certificate (SSL/TLS > Origin Server, valid up to 15 years), a bought one, or Let's Encrypt. Without one, Mintrix serves a self-signed certificate. If yours is expired or does not match its key, Mintrix serves the self-signed one too and says why in docker compose logs nginx. It also warns there two weeks before the certificate expires.

Behind Cloudflare or another proxy

Set MINTRIX_TRUSTED_PROXIES=cloudflare in .env (the installer asks), or your proxy's addresses. Mintrix then sees each visitor's own IP address for sign-in limits, the IP whitelist and logs.

Firewall

Allow ports 80 and 443 only from Cloudflare's addresses, so nobody bypasses it.

Change the ports

Set the ports in /opt/mintrix/.env (see Settings), then apply them:

cd /opt/mintrix && sudo docker compose up -d

sudo mintrix-update --port <port> --https-port <port> does the same and checks that the ports are free.

Move to another domain

1. Move the licence to the new domain in your client area (see Servers, domains and keys).
2. Run sudo mintrix-update --license <key> --domain <new domain>.

A Ministra on another server calls Mintrix at its address, so it must be able to reach the new one; boxes use the new address as their portal.