Serve HTTPS on a public host

A server that has a public name can serve HTTPS itself, so Cinchapi or any OpenAI-compatible tool can reach it without the link:

pasture https models.example.com
pasture key create relay
pasture install

pasture https saves the name, and pasture serves https://<name>/v1 on port 443 once it starts again. It gets the certificate from Let's Encrypt and renews it on its own. Let's Encrypt must reach the server as that name on port 443. Turning on HTTPS accepts Let's Encrypt's subscriber agreement. Set https.email in the config for Let's Encrypt to write to you about the certificate, and https.listen to serve another port, with port 443 forwarded to it. On Linux, a user may not listen on port 443 unless net.ipv4.ip_unprivileged_port_start allows it.

API keys

Each caller sends an API key as Authorization: Bearer <key>. pasture key create prints a new key once, and pasture keeps only its hash. A request without a valid key gets 401. HTTPS serves the same requests as the link and answers 403 to any other. In Cinchapi, add the server under Private models with the base URL https://models.example.com/v1 and the key.

An API key and pasture's admin token are separate. An API key opens only those requests, never pasture's own commands, and HTTPS refuses the admin token. HTTPS serves other servers, not web pages, so its answers carry no CORS headers, and pasture allow does not apply to it.