# BMCLI HTTPS reverse proxy

BMCLI intentionally listens on loopback HTTP. This profile terminates TLS in
Nginx and forwards HTTP, SSE, and WebSocket traffic to that loopback listener.
It does not weaken browser HTTPS-first policy.

1. Start BMCLI on loopback, for example `bmcli web start --listen=127.0.0.1:8080`.
2. Obtain a certificate whose subject alternative names cover the browser URL.
3. Render and install the profile:

   ```sh
   sudo ./configure-nginx.sh \
     --certificate=/etc/ssl/certs/bmcli.crt \
     --private-key=/etc/ssl/private/bmcli.key \
     --server-name=localhost --install
   ```

4. Open `https://localhost:8443/` and verify `/api/v1/health`, an SSE stream,
   and a WebSocket connection without bypassing certificate validation.

For LAN access, use a certificate issued by the organization's trusted CA and
keep BMCLI itself bound to `127.0.0.1`. Protect the proxy listener according to
the engineering network policy. Do not place bearer tokens in project files.
