Run On The Internet

Run on the internet

SIEMLite can get a certificate from Let's Encrypt for your domain and renew it by itself, so browsers and apps trust it with no warning and nothing else to install. Before you start:

• A DNS name (an A or AAAA record) that points at this server's public address, such as siem.example.com.
• Port 443 reachable from the internet and forwarded to SIEMLite: Let's Encrypt connects to it to check you control the name. With Docker, publish it with SIEMLITE_HTTPS_PORT=443 in .env (and leave SIEMLITE_BIND empty, or set it to the public address), then docker compose up -d. Without Docker, use -addr :443 (as root, or after sudo setcap cap_net_bind_service=+ep ./siemlite).

Then on the System page, under HTTPS certificate, choose Let's Encrypt, enter the domain, choose Check this address (it confirms that the name and port 443 really lead to this SIEMLite), and Save. The status shows the certificate being obtained, usually within seconds, then who issued it and until when. Or set it from the start in .env with SIEMLITE_TLS_MODE=letsencrypt and SIEMLITE_DOMAIN=siem.example.com; what you save on the System page takes precedence.

• Nothing is lost if it fails. Only visitors who ask for that domain get its certificate. Anyone using another address (an IP or a LAN name), and the domain itself until its certificate arrives, still gets the self-signed one, so you can always get back in and switch back. The status says what went wrong (DNS, port 443, Let's Encrypt's rate limit).
• Renewal is automatic, well before the certificate expires. The certificate and the Let's Encrypt account are kept in an acme folder next to the database (/data/acme with Docker, so in the volume); keep it, or a rebuild asks Let's Encrypt again and can hit its rate limits.
• Syslog over TLS uses the same certificate for senders that ask for the domain.
• Apps sending logs use https://siem.example.com/api/v1/logs. The certificate is trusted everywhere, so the snippets on the Connect screen work without siemlite.crt; remove those lines.
• Microsoft sign-in: set the SIEMLite address on the Entra card to https://siem.example.com.
• Only port 443 is needed; there is no plain-HTTP port to redirect from. Syslog keeps its own ports, and senders outside loopback and private networks are refused unless you list them in SIEMLITE_SYSLOG_ALLOW. Don't open syslog to the internet: it has no authentication.
• To test without using up Let's Encrypt's limits, point -acme-directory at its staging server (https://acme-staging-v02.api.letsencrypt.org/directory; its certificates aren't trusted by browsers). -acme-directory also works with other ACME CAs, and -acme-ca-root adds a private CA for talking to one.
• Behind your own reverse proxy (nginx, Traefik, a load balancer) that does the HTTPS instead: give SIEMLite a private plain-HTTP port with -http-addr and name the proxy in -trusted-proxies, so visitors' real addresses reach the sign-in lockout and the audit log. SIEMLite believes X-Forwarded-For only from those proxies, reading it from the right so a visitor can't forge it, and the plain port refuses everyone else.