Reverse proxy
Put Rezepte behind Caddy or nginx with TLS
Rezepte itself only speaks plain HTTP. Terminate TLS at a reverse proxy in front of it and forward everything to its port (8060 by default).
rezepte.example.com {
reverse_proxy localhost:8060
}Caddy forwards Host and Origin unchanged and provisions TLS automatically. It sets no limit on the size of a request by default, so photo uploads need nothing extra.
The proxy must forward the Host and Origin headers unchanged. The API rejects a mutating request (POST/PUT/PATCH/DELETE) whose Origin header names a different host than the request's Host — this is what stops cross-site requests from acting on a logged-in session. A proxy that rewrites either header, or that terminates TLS without passing the original Host through, will lock the app's own login and editing out.
Once the app is reachable over HTTPS, set REZEPTE_SECURE_COOKIES=true so the session cookie gets the Secure attribute (see Configuration). It also tells Rezepte to link its preview image over https, so a link shared in a chat app shows the Rezepte logo.