Secure mode (HTTPS + mTLS)

The default is plain HTTP (no cert files required, easiest for local dev). Do this before running the Python experiment script to enable HTTPS between the browser and the UI server, and mTLS between the UI server and the backend:

  1. Generate TLS certificates once:

    weightslab se

    Certificates are placed in ~/.weightslab-certs (or $WEIGHTSLAB_CERTS_DIR). Follow the printed instructions to export WEIGHTSLAB_CERTS_DIR globally.

  2. Start the UI in secure mode:

    weightslab start --certs

    --certs reads $WEIGHTSLAB_CERTS_DIR (single source of truth) and:

    • Serves HTTPS using ui-server.crt / ui-server.key

    • Presents ui-client.crt / ui-client.key to the backend (mTLS)

    • Expects the backend CA at ca.crt

  3. Configure the backend to require mTLS::
    Should be automatic if certs have been created to default directory “~/.weightslab-certs”.

    export GRPC_TLS_ENABLED=1 export GRPC_TLS_REQUIRE_CLIENT_AUTH=1 export WEIGHTSLAB_CERTS_DIR=~/.weightslab-certs

Certificate files (all in $WEIGHTSLAB_CERTS_DIR)

File

Purpose

ca.crt

CA certificate (trusted by all parties)

ui-server.crt/.key

UI server TLS cert (browser to server)

ui-client.crt/.key

UI client mTLS cert (server to backend)

backend-server.crt/.key

Backend gRPC TLS cert (loaded by backend)

.grpc_auth_token

Optional token for gRPC metadata auth

Regenerate certificates at any time with weightslab se --force-certs.