Securing JanusEye with SSL
SSL Security Certificate
Encrypt your communications for maximum protection
By default, JanusEye operates over HTTP. To protect your PIN code and images from prying eyes, it is highly recommended to switch to HTTPS using one of the three methods below.
If you are already using a VPN (WireGuard or Tailscale) to access JanusEye, installing an SSL certificate is not strictly necessary. The VPN tunnel already creates a security shield that encrypts all data between your phone and your Raspberry Pi.
1. Certbot Method (Let's Encrypt)
This is the most professional method. It provides a green padlock in the browser and is recognized globally.
sudo apt install certbot python3-certbot-nginx Once Certbot is installed, start the certificate generation. This command automatically configures your web server (Nginx or Apache) and enables HTTPS:
sudo certbot --nginx -d your-domain.org Note: If you are using Apache, replace --nginx with --apache.
If you choose Certbot, ensure that port 80 is temporarily open on your router so Let's Encrypt can verify domain ownership. Once the certificate is obtained, you can close it and only keep 443 (HTTPS) open.
Certbot generates a free certificate and renews it automatically every 3 months.
2. Self-Signed Method
Ideal for strictly personal use. You create your own security "key" without depending on a third party.
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout janus.key -out janus.crt 3. Importing from another Raspberry Pi
If you already have a Raspberry Pi acting as a main server (Nginx Reverse Proxy), you can reuse its certificate.
Simply copy the fullchain.pem and privkey.pem files to your JanusEye folder using the scp command or via FileZilla.
4. Using an existing Apache2 server
If you already have a Raspberry Pi running Apache2 with an SSL certificate, you can use it to "serve" JanusEye securely.
sudo a2enmod proxy proxy_http ssl Edit your Apache configuration file (usually /etc/apache2/sites-available/000-default-le-ssl.conf) and add these lines inside the <VirtualHost *:443> block:
ProxyPreserveHost On
ProxyPass / http://JANUSEYE_PI_IP:5000/
ProxyPassReverse / http://JANUSEYE_PI_IP:5000/
This configuration allows accessing JanusEye via https://your-domain.com while leaving JanusEye internally on port 5000.
sudo systemctl restart apache2 5. Comparison Table
| Method | Pros | Cons |
|---|---|---|
| Certbot | Green padlock, Free, Automatic. | Requires a domain name. |
| Self-Signed | Fast, works without a domain. | Browser security warnings. |
| Pi Transfer | Centralized, no new certificate needed. | Manual synchronization required. |
Once the certificate is installed, you will need to modify your app.py file to enable SSL mode (ssl_context='adhoc' or pointing to your .crt/.key files).
⚠️ FLASK CONFIGURATION:
If you use the Apache2 (Reverse Proxy) method or another Raspberry Pi as a front-end server, you do not need to make any changes to your app.py file. The remote server handles the encryption for you.
Modifying the app.py script (adding ssl_context) is only necessary if you want JanusEye to handle the certificate itself without an intermediary server.