HTTPS

For a self-hosted VPS, use a reverse proxy to terminate TLS rather than adding TLS configuration to Uvicorn. Caddy is a concise option because it can obtain and renew certificates automatically when DNS points to the server and ports 80 and 443 are reachable. This is not the current production architecture: the public API is served through the Cloudflare Worker behind https://api.aakashsharma.com.np.

Create /etc/caddy/Caddyfile:

api.example.com {
    reverse_proxy 127.0.0.1:8000
}

Replace api.example.com with your self-hosted hostname, validate the configuration, then reload Caddy using the commands appropriate to your Caddy installation. Verify:

curl -I https://api.example.com/health
curl https://api.example.com/health

Caddy automatically manages certificates and redirects HTTP to HTTPS for eligible hostnames. Your DNS must point at the host and the public ports must reach Caddy. See Caddy’s automatic HTTPS documentation  and reverse-proxy quick start  for operational detail.

Use HTTPS for public clients, especially Home Assistant instances outside the same trusted LAN. Certificate issuance, DNS, firewall configuration, and reverse-proxy maintenance are deployment responsibilities, not API configuration.