# TLS / HTTPS for the coordinator

The Android app and web node already speak `https://` and `wss://` when the coordinator base URL uses HTTPS
(WebSocket derivation maps `https` → `wss`, `http` → `ws`). The coordinator also returns `wss://` in
heartbeat replies when the request arrives with `X-Forwarded-Proto: https` (or host port 443).

## Recommended production setup

Put nginx or Caddy in front of port 9334 with a real certificate (Let’s Encrypt) on a hostname, e.g.
`https://node.sarmad.pro`, then set:

- `ProtocolConstants.COORDINATOR_BASE_URL` (Android) to that HTTPS URL
- web `DEFAULT_COORD` (or open the node from the same HTTPS origin)

Until that proxy exists, the public IP on `:9334` stays HTTP — fine for testing, not ideal for mainnet traffic.

## APK integrity

Each published APK on sarmad.pro should ship as `downloads/SRMD{version}.apk`
(e.g. `SRMD1.3.apk`) with a matching `downloads/SRMD{version}.apk.sha256` so users can verify:

```
sha256sum -c SRMD1.3.apk.sha256
```
