TLS

RunTLSServer starts Ply with TLS using a PEM certificate and private key.

app := ply.New()
app.Get("/", func(c *core.Context) {
	c.Text(200, "secure")
})

err := app.RunTLSServer(":8443", "cert.pem", "key.pem")
if err != nil {
	log.Fatal(err)
}

The method blocks until the server stops or fails.

Files

Both files must be PEM encoded:

• the certificate, which may include intermediate certificates,
• the private key.

The certificate must be valid for the hostname clients use. For local development, generate one with mkcert and trust its local CA.

Production

TLS in the application is optional. Many deployments terminate TLS at a reverse proxy or load balancer and forward plain HTTP to Ply on a private network. That setup centralizes certificate renewal and HTTP-to-HTTPS redirects.

If Ply handles TLS itself:

• keep the key readable only by the service user,
• renew certificates before expiry,
• redirect HTTP to HTTPS at the edge,
• add HSTS only after HTTPS works for every subdomain,
• do not serve the key from a static directory.

No automatic redirect

RunTLSServer does not start an HTTP listener and does not redirect HTTP requests. Run a separate HTTP server or configure the proxy for redirects.

Graceful shutdown with TLS

RunWithGracefulShutdown calls RunServer, so it does not use TLS. For a TLS server with graceful shutdown, start RunTLSServer in a goroutine and call Shutdown from your signal handler.

go func() {
	if err := app.RunTLSServer(":8443", "cert.pem", "key.pem"); err != nil {
		log.Printf("server stopped: %v", err)
	}
}()

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
if err := app.Shutdown(ctx); err != nil {
	log.Printf("shutdown: %v", err)
}

Notes

• Ply does not reload certificates at runtime. Restart the process or use the proxy for rotation.
• The certificate and key paths are read at startup.
• TLS adds CPU work. Terminate at the edge when that cost matters.