Voice commands on your other devices

The Golden Lanthorn can let a phone, a tablet or another computer on your home network play your library, with the same games and saves. This page is about the one thing that needs extra setup there: https.

On the computer running the app, everything works. On another device, the game plays fine over a plain http:// address, but two things don't work: voice commands, because the page can't use the microphone, and keeping the screen awake while you play. Browsers allow both only on a secure (https://) page, or on the computer the page comes from. That's true of every browser on every system: Safari, Chrome, Edge and Firefox, on iPhone, iPad, Android, Mac, Windows and Linux.

So The Golden Lanthorn can serve your library over https itself. You turn it on once, and trust its certificate once on each device.

Turn on https in the app

1. Open Settings and find the Sharing group. Turn on Let other devices on my network play if it isn't on already.
2. Turn on Use https. The app makes its own certificate the first time; this takes a moment.
3. The Sharing group now lists the https:// addresses to open on your other devices, on the standard https port, so there's no port number to type. (On Linux, or if another program already uses that port, it's 7691, and the address ends in :7691.) The old http:// address still works: it sends you on to the https one.
4. On each device, trust the certificate once (below), then open the https address.

Under Trust the certificate on each device, once, the Sharing group has a QR code. Scan it with the device you want to set up: it opens a short page with the certificate to download. The Get the certificate link there is the same file.

Trust the certificate, once per device

Websites on the internet get their certificates from companies your devices already trust. A computer at home can't, so The Golden Lanthorn makes its own certificate authority and signs its certificate with it. Your devices don't know that authority until you tell them to trust it. Until then, they show a warning such as "Your connection is not private" and won't use the microphone.

You only do this once for each device. When your computer's address changes, or a certificate gets old, the app makes a new one from the same authority, and your devices keep trusting it.

iPhone and iPad

These take two steps, and the second is easy to miss.

1. Open the Get the certificate link in Safari (other browsers can't install it) and tap Allow.
2. Open Settings. Tap Profile Downloaded near the top (or go to General › VPN & Device Management), then Install, and enter your passcode.
3. Go to Settings › General › About › Certificate Trust Settings and turn on full trust for The Golden Lanthorn local CA.

Every browser on an iPhone or iPad uses the same trust settings, Chrome included.

Android

1. Open the Get the certificate link and save the file.
2. In Settings, find Install a certificate › CA certificate. It's usually under Security (or Security & privacy) › More security settings › Encryption & credentials, but phone makers move it around; searching Settings for "CA certificate" finds it.
3. Accept the warning, then pick the file you saved.

Chrome and most Android browsers then trust it. Firefox for Android uses only its own certificates unless you turn on "Use third party CA certificates" in its hidden settings, so Chrome is the easier choice there.

Mac

1. Open the Get the certificate link and open the downloaded file. Keychain Access asks where to add it: choose login.
2. In Keychain Access, double-click The Golden Lanthorn local CA, open Trust, and set "When using this certificate" to Always Trust. Close the window and enter your password.

Safari, Chrome and Edge use it. You don't need this on the Mac running the app: its own window doesn't need https.

Windows

1. Open the Get the certificate link and open the downloaded file. Click Install Certificate.
2. Choose Current User, then Place all certificates in the following store › Browse › Trusted Root Certification Authorities.
3. Click Finish, and Yes at the security warning.

Edge and Chrome use it.

Linux, and Firefox anywhere

Firefox keeps its own list of trusted authorities. In Firefox, open Settings › Privacy & Security, scroll to Certificates, click View Certificates, then the Authorities tab › Import. Pick the downloaded file and tick Trust this CA to identify websites.

Chrome on Linux has its own list too: Settings › Privacy and security › Security › Manage certificates, then import the file as a trusted authority.

Is it safe?

The certificate authority is made on your computer and its private key never leaves it. It can only vouch for home-network addresses: names ending in .local and the private address ranges a home or office network uses: 10.x.x.x, 172.16.x.x to 172.31.x.x, 192.168.x.x, 100.64.x.x to 100.127.x.x (Tailscale's), and their IPv6 equivalents. A device that trusts it can't be fooled by it about any website on the internet.

When you no longer play from a device, you can remove the certificate: on an iPhone or iPad under Settings › General › VPN & Device Management, on Android under Encryption & credentials › User credentials, on a Mac in Keychain Access, and on Windows with Manage user certificates. Make a new certificate in the app's Sharing settings replaces the authority, and every device then needs to trust the new one.

Docker and home servers

The Docker image's own server speaks plain http. Its README shows how to put Caddy in front of it for https. Caddy makes its own certificate authority in the same way, so each device trusts Caddy's certificate once, with the same steps as above. The file to install is caddy/caddy/pki/authorities/local/root.crt, next to compose.yaml.

Without the trust step

A device trusts a certificate without any setup only when it comes from a public authority such as Let's Encrypt, and that needs a name on the internet. Two ways, if you already use them:

• Your own domain. Caddy can get a Let's Encrypt certificate for a name such as lanthorn.example.com that points to your server at home, using your DNS provider's plugin for the check. This is for people who already run a home server with a domain.
• Tailscale. On a Tailscale network, tailscale serve can give the server a real https address ending in .ts.net, reachable from your devices on that network.

If something goes wrong

• "Your connection is not private" or "This connection is not private". The device doesn't trust the certificate yet. On an iPhone or iPad, check the second step (Certificate Trust Settings). If you made a new certificate in the app, trust the new one.
• The page loads but voice commands say they need https. You opened the http:// address and https is off. Turn on Use https in the app's Sharing settings.
• The address doesn't open at all. Check that the device is on the same network as the computer, and that the computer's firewall allows The Golden Lanthorn (Windows asks the first time sharing starts).
• Firefox still warns after the system trusts the certificate. Import it in Firefox too (above).