Reduced-security deployment (LAN testing)

By default CCHP requires HTTPS for the console, a domain name for passkeys, and public addresses for providers and every other outbound request. The environment variable CCH_INSECURE_DEPLOYMENT turns all of these requirements off at once, so you can test CCHP on a LAN: open the console at http://192.168.1.20:8080, call the gateway at http://192.168.1.20:8081, and connect providers such as http://10.0.0.5:9080 or http://llm-box:8000. It accepts true or false and defaults to false. Any other value stops every role at start. Every role (control, gateway, worker) reads it once when it starts, so set the same value for all of them.

DownloadZoomA LAN test deploymentCCHP

What the switch turns off#

Console and gateway addresses#

• CCH_PUBLIC_BASE_URL, CCH_CONTROL_PLANE_ALLOWED_ORIGINS and CCH_GATEWAY_PUBLIC_URL may be http:// addresses with a LAN IP address or a host name without a public domain. CCHP starts with them instead of refusing.
• Sign-in, cross-site request checks and the setup wizard work over http. Browsers do not send the Fetch Metadata headers to http pages, so CCHP accepts requests without them that arrive over http; the Origin header must still match the console address.
• On requests that arrive over http, sign-in cookies drop Secure and the __Host- prefix, and SameSite=None becomes Lax. Requests that arrive over HTTPS (directly, or with X-Forwarded-Proto: https from a reverse proxy) keep secure cookies.
• Email links and domain binding links use http while the console address is http.

Providers and outbound requests#

• Provider endpoints, request forwarding, model discovery and model sync, key tests and upstream balance checks accept http://, IP addresses, host names without a public domain (such as llm-box), and private addresses: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), IPv6 ULA (fc00::/7), link-local and 100.64.0.0/10. The settings under Administration → System Management → Routing → Outbound Addresses no longer restrict them.
• Cloud metadata addresses such as 169.254.169.254 and fd00:ec2::254 stay blocked. Loopback addresses stay blocked in production.
• A redirect within the same site may go from https to http.

Other addresses and services#

• Notification webhooks (generic webhook, Mattermost and the like), third-party sign-in endpoints (OAuth, custom OIDC), organization SSO (OIDC issuer, SAML metadata), payment callback addresses, plugin upstream operations, the SIP webhook and Gemini media downloads accept http and LAN addresses.
• The OpenTelemetry collector uses plain gRPC unless its endpoint starts with https://.
• SMTP with Connection security set to None (plain text) accepts a user name and password.
• IP auto-block never counts or blocks LAN addresses.
• Embedded page entries in the sidebar, the embedded preview in site settings, and a home page, terms of service, or privacy page set up as embedded pages accept http addresses, LAN IPs, and host names without a public domain. See Customize the sidebar. After you turn the switch off, saved http embedded pages are no longer served, and saving settings that still contain such entries is rejected.

What stays on#

• Cloud metadata addresses are always blocked.
• Trusted proxy ranges cannot be 0.0.0.0/0; list the ranges of your LAN proxies.
• The DNS over HTTPS endpoint must be https, and encrypted DNS configured by IP address needs a server name.
• The Azure Entra ID authority host must be https: Azure’s own SDK refuses http.

What stops working in the browser over http#

A page opened over http at a LAN address is not a secure context, so browsers turn some features off. CCHP shows this in the console:

Turn it on#

Use one LAN address for the console and one for the gateway, and set all three address variables to them. The examples use 192.168.1.20; replace it with your server’s LAN address or a host name that your LAN resolves.

Docker Compose#

In .env next to compose.yml, add:

CCH_INSECURE_DEPLOYMENT=true
CCH_PUBLIC_BASE_URL=http://192.168.1.20:8080
CCH_CONTROL_PLANE_ALLOWED_ORIGINS=http://192.168.1.20:8080
CCH_GATEWAY_PUBLIC_URL=http://192.168.1.20:8081

Then recreate the container with docker compose up -d. No reverse proxy is needed: open http://192.168.1.20:8080 from any computer on the LAN.

k3s / k8s#

In cchp-k3s/02-config.yaml from Install on k3s / k8s, add the switch and use http addresses:

  CCH_INSECURE_DEPLOYMENT: "true"
  CCH_PUBLIC_BASE_URL: http://cchp.lan # Console address on the LAN
  CCH_CONTROL_PLANE_ALLOWED_ORIGINS: http://cchp.lan
  CCH_GATEWAY_PUBLIC_URL: http://api.cchp.lan # API address on the LAN

In cchp-k3s/10-ingress.yaml, delete the tls: block of both Ingresses, add the annotation nginx.ingress.kubernetes.io/ssl-redirect: "false" to both, and use the two LAN host names in the rules. Then run kubectl apply -f cchp-k3s/ and kubectl -n cchp rollout restart deployment/control deployment/worker statefulset/gateway. If you deploy from the CCHP repository, the deployments/k8s/components/insecure-deployment component makes the same changes, and deployments/k8s/overlays/lan-test is a complete LAN test overlay.

Binaries#

In /etc/cchp/cchp.env, add:

CCH_INSECURE_DEPLOYMENT=true
CCH_PUBLIC_BASE_URL=http://192.168.1.20:8080
CCH_CONTROL_PLANE_ALLOWED_ORIGINS=http://192.168.1.20:8080
CCH_GATEWAY_PUBLIC_URL=http://192.168.1.20:8081

Then restart every service: systemctl restart cchp-control cchp-gateway cchp-worker. The services listen on all interfaces by default, so other LAN computers reach ports 8080 and 8081 directly.

Check that it is on#

• Every role logs the warning insecure_deployment_enabled at start and again every 10 minutes.
• /readyz of the console and the gateway reports "insecure_deployment": true, and the worker’s /readyz adds an insecure_deployment line.
• The cchp_insecure_deployment{role} gauge is 1 on every role’s metrics port.
• Platform admins see a notice at the top of the console: “Reduced-security deployment is on: HTTPS, domain and private-address restrictions are off. For LAN testing only.”

Turn it off#

Set CCH_INSECURE_DEPLOYMENT=false (or remove it), set the three address variables back to HTTPS addresses, put the reverse proxy back, and restart every role. Provider endpoints on private addresses are rejected again unless you allow them under Administration → System Management → Routing → Outbound Addresses. Users sign in again on the HTTPS address.

Frequently asked questions#

Every role exits at start with “invalid CCH_INSECURE_DEPLOYMENT”#

The value must be exactly true or false. Values such as 1, yes or TRUE stop the process so that a typo never turns the switch on or off silently.

I want HTTPS for the console and providers on my LAN#

Leave the switch off. Allow the provider host names or IP ranges under Administration → System Management → Routing → Outbound Addresses; the console keeps HTTPS, secure cookies and passkeys.

The console opens, but sign-in fails with “You opened a different address”#

Open the console at exactly the address in CCH_PUBLIC_BASE_URL, including the port. An IP address and a host name that resolves to it count as different addresses.

Related pages#

• Installation overview
• Install with Docker Compose
• Install on k3s / k8s
• Install from binaries