Why do I have to use HTTPS to access hosts on my LAN?

[shockme]

I'm trying to use my strata deployment with graphicle and it appears I cannot do that because graphicle refuses to use an HTTP host that has an API key.

If you make yourselves responsible for my system's security, I will send you the bill in an eventual compromise :)

[VikramLex]

Fair point, and thanks for raising it.

An API key sent over plain HTTP crosses the network in clear text, so anyone who can see that traffic can read it. That is why HTTPS stays the default. On your own LAN, though, it should be your call, so 0.1.10 adds an explicit opt-in:

export GRAPHICLE_PROVIDER_HTTP_KEY_HOSTS=strata.lan

Use your server's exact host name or address (several are separated by commas; no scheme or port). A profile with key_env may then use plain HTTP to that host, and Graphicle prints a warning when it does. Details are in the base_url row of docs/configuration.md.

If you would rather keep the key off the wire, HTTPS with a local CA (for example mkcert) or an SSH tunnel to a localhost port also work.