HTTPS and app install

Konkat works in any browser on a plain http:// address. But two things only work on https://: installing Konkat on a phone’s home screen, and keeping copies of screens for weak signal. This article explains why and shows common ways to set up HTTPS.

What changes with HTTPS#

	http://	https://
Use Konkat in the browser	Yes	Yes
Install on phone or computer	No — the install button only shows a message	Yes
Screens and photos kept for weak signal	No	Yes
“New version is ready — Reload” bar	No	Yes
Login and data encrypted on the network	No	Yes

The reason is the service worker — the small background script that makes Konkat installable and keeps offline copies. Browsers only run service workers on https:// sites (and on localhost for testing). On http:// Konkat shows “Installing needs the site on https://. Ask your administrator to switch on HTTPS for this address” when someone taps install.

What you need#

• A domain or sub-domain, for example erp.sunrisebuilders.in.
• A server with a public IP address and ports 80 and 443 open in its firewall (and in the cloud provider’s security group).
• A bench in production mode (nginx in front of Frappe). A development bench (bench start on port 8000) is not suitable for real users.

Option 1: Let’s Encrypt on the bench (most common)#

These commands are examples for a typical Ubuntu server; adjust names to yours. Run them from the bench folder.

1. Point the domain at the server — at your domain registrar or DNS provider, add an A record for erp.sunrisebuilders.in with the server’s public IP. Wait until ping erp.sunrisebuilders.in shows that IP.
2. Turn on name-based sites — bench config dns_multitenant on
3. Connect the domain to the site — if your site is already named erp.sunrisebuilders.in, skip this. Otherwise: bench setup add-domain erp.sunrisebuilders.in --site <site>
4. Set up production (if not done yet) — sudo bench setup production <bench-user>. This configures nginx and supervisor.
5. Get the certificate — sudo bench setup lets-encrypt <site>, or for an added domain sudo bench setup lets-encrypt <site> --custom-domain erp.sunrisebuilders.in. Answer the questions; bench sets up automatic renewal.
6. Test — open https://erp.sunrisebuilders.in/konkat. The browser should show a padlock, and More → Install Konkat on this phone should offer to install.

Let’s Encrypt needs port 80 reachable from the internet to check the domain, both the first time and on every renewal.

Option 2: A proxy in front (Cloudflare, Caddy, a load balancer)#

If you already use a proxy, let it handle HTTPS and pass requests to nginx/Frappe:

• Cloudflare — add the domain to Cloudflare, create a proxied A record to the server, and set SSL/TLS to Full (or Full (strict) with an origin certificate on the server).
• Caddy — a minimal example: a site block erp.sunrisebuilders.in { reverse_proxy 127.0.0.1:80 }. Caddy gets and renews the certificate by itself.

Whatever proxy you use, make sure it passes the original host name to Frappe (so the right site is found) and does not cache or block these addresses at the site root: /konkat, /konkat-sw.js, /konkat.webmanifest, the /konkat-icon-…png files and /api/….

After switching on HTTPS#

• Send everyone the new https:// address. Optionally redirect http to https in nginx or your proxy.
• People sign in once more on the new address — the old http:// login does not carry over.
• Ask them to install the app: Install the app.

Common questions#

Can I test installing on my own network without a domain?#

Not on phones. Browsers treat only https:// and localhost as secure. A self-signed certificate usually isn’t trusted by phones, so the app won’t install. Use a real domain, even a sub-domain of your company website.

The padlock shows but Install is still missing.#

Check that the phone is on the https:// address, reload once so the service worker can start, and check that https://<domain>/konkat-sw.js opens as a script and not an error page. See Troubleshooting.

Related: Installing Konkat · Weak signal and offline · Security and access