[{"data":1,"prerenderedAt":918},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Flocal-https":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":60,"body":141,"description":911,"extension":912,"meta":913,"navigation":914,"path":59,"seo":915,"stem":916,"__hash__":917},"docs\u002Fdocs\u002Flocal-https.md",{"type":142,"value":143,"toc":899},"minimark",[144,157,162,173,210,233,247,251,258,266,280,330,335,363,381,396,399,433,440,465,472,476,485,488,528,534,538,542,545,568,589,592,614,651,654,723,727,730,848,859,866,872,876,892,895],[145,146,147,148,152,153,156],"p",{},"mm creates a local certificate authority (CA) so browsers can trust your\ndevelopment HTTPS sites. Setup installs its public certificate; private keys\nstay under ",[149,150,151],"code",{},"MM_HOME\u002Fca"," (normally ",[149,154,155],{},"~\u002F.mm\u002Fca",").",[158,159,161],"h2",{"id":160},"set-up-certificates","Set up certificates",[145,163,164,165,168,169,172],{},"The Linux checkout installer sets up DNS, trusted TLS, and shared ingress by\ndefault. Retry just that setup with ",[149,166,167],{},".\u002Finstall.sh --setup-only"," from the mm\ncheckout. Bare ",[149,170,171],{},"mm"," also detects missing local TLS and offers setup before opening\nthe workspace, including interactive sudo authorization when required.",[174,175,180],"pre",{"className":176,"code":177,"language":178,"meta":179,"style":179},"language-sh shiki shiki-themes mm","mm dev setup\nmm dev tls status\n","sh","",[149,181,182,197],{"__ignoreMap":179},[183,184,187,190,194],"span",{"class":185,"line":186},"line",1,[183,188,171],{"class":189},"svrjQ",[183,191,193],{"class":192},"sv8ni"," dev",[183,195,196],{"class":192}," setup\n",[183,198,200,202,204,207],{"class":185,"line":199},2,[183,201,171],{"class":189},[183,203,193],{"class":192},[183,205,206],{"class":192}," tls",[183,208,209],{"class":192}," status\n",[145,211,212,213,216,217,220,221,224,225,228,229,232],{},"Linux uses the system trust store and requires preauthorized ",[149,214,215],{},"sudo",". Supported\nlayouts are Debian\u002FUbuntu (",[149,218,219],{},"update-ca-certificates",") and Fedora\u002FRHEL\n(",[149,222,223],{},"update-ca-trust","). macOS and Windows use current-user trust by default. Use\n",[149,226,227],{},"mm dev setup --system"," or ",[149,230,231],{},"mm dev tls --system ..."," on macOS\u002FWindows only when\nsystem-wide trust is intentional and privileges are available.",[145,234,235,238,239,242,243,246],{},[149,236,237],{},"mm dev setup --no-trust"," still generates certificates but intentionally leaves\nbrowsers and system clients unable to trust them. ",[149,240,241],{},"mm doctor"," reports this\ndegraded mode until setup is rerun without ",[149,244,245],{},"--no-trust",".",[158,248,250],{"id":249},"routes-and-name-resolution","Routes and name resolution",[145,252,253,254,257],{},"For an eligible service in ",[149,255,256],{},"project.development-environment",", local ingress\nuses:",[174,259,264],{"className":260,"code":262,"language":263,"meta":179},[261],"language-text","https:\u002F\u002F{service-slug}.{project-slug}.test\n","text",[149,265,262],{"__ignoreMap":179},[145,267,268,269,272,273,276,277,279],{},"Shared service routes include ",[149,270,271],{},"https:\u002F\u002Fmm.test"," and ",[149,274,275],{},"https:\u002F\u002Fmail.mm.test",".\nFollow project dashboard links from ",[149,278,271],{},". Explicit ingress\nconfiguration still takes precedence over automatic routing. Inspect the\nresult with:",[174,281,283],{"className":176,"code":282,"language":178,"meta":179,"style":179},"mm config ingress list\nmm config ingress explain web\nmm --output json config ingress list\n",[149,284,285,298,312],{"__ignoreMap":179},[183,286,287,289,292,295],{"class":185,"line":186},[183,288,171],{"class":189},[183,290,291],{"class":192}," config",[183,293,294],{"class":192}," ingress",[183,296,297],{"class":192}," list\n",[183,299,300,302,304,306,309],{"class":185,"line":199},[183,301,171],{"class":189},[183,303,291],{"class":192},[183,305,294],{"class":192},[183,307,308],{"class":192}," explain",[183,310,311],{"class":192}," web\n",[183,313,315,317,321,324,326,328],{"class":185,"line":314},3,[183,316,171],{"class":189},[183,318,320],{"class":319},"sbRf1"," --output",[183,322,323],{"class":192}," json",[183,325,291],{"class":192},[183,327,294],{"class":192},[183,329,297],{"class":192},[331,332,334],"h3",{"id":333},"minimal-project-configuration","Minimal project configuration",[145,336,337,345,346,349,350,272,353,356,357,272,360,246],{},[338,339,340,341,344],"strong",{},"Do not add ",[149,342,343],{},"domains"," entries or explicit ingress routes just to enable local\nservice names."," For ",[149,347,348],{},"project.name: store"," and services named ",[149,351,352],{},"web",[149,354,355],{},"api",", the\nautomatic URLs are ",[149,358,359],{},"https:\u002F\u002Fweb.store.test",[149,361,362],{},"https:\u002F\u002Fapi.store.test",[145,364,365,366,369,370,373,374,376,377,380],{},"The project slug (sometimes called the project key) is the normalized\n",[149,367,368],{},"project.name","; there is no separate ",[149,371,372],{},"project-key"," field. Set\n",[149,375,256],{}," to the environment you run locally, and set\n",[149,378,379],{},"default-environment"," to that name if it should be selected automatically. The\nselected target must use local transport.",[145,382,383,384,387,388,391,392,395],{},"Each service must be declared under a module and attached to a Compose stack.\nmm infers an unambiguous container HTTP port from Compose ",[149,385,386],{},"expose","\u002F",[149,389,390],{},"ports","; set\nthe service's ",[149,393,394],{},"http-port"," only when inference is ambiguous. Automatic ingress\nand local HTTPS default to enabled. Non-HTTP roles, explicit ingress routes,\nand per-service\u002Fproject opt-outs affect eligibility.",[145,397,398],{},"Routing, DNS, and TLS are separate:",[400,401,402,413,427],"ul",{},[403,404,405,408,409,412],"li",{},[338,406,407],{},"Routing:"," mm generates ",[149,410,411],{},"{service-slug}.{project-slug}.test"," routes from the\nproject contract, without per-project domain declarations.",[403,414,415,418,419,422,423,426],{},[338,416,417],{},"DNS:"," installer workstation setup resolves wildcard ",[149,420,421],{},".test"," names to\n",[149,424,425],{},"127.0.0.1","; it reuses a working resolver or installs mm's dedicated DNS service.",[403,428,429,432],{},[338,430,431],{},"TLS:"," setup installs and trusts the local CA. Deployment generates and\npublishes the leaf certificates for the actual project routes.",[145,434,435,436,439],{},"If you used ",[149,437,438],{},"--no-setup",", run workstation setup before opening these URLs, or\nuse a client override to diagnose routing separately from DNS:",[174,441,443],{"className":176,"code":442,"language":178,"meta":179,"style":179},"curl --resolve web.file-factory.test:443:127.0.0.1 \\\n  https:\u002F\u002Fweb.file-factory.test\u002F\n",[149,444,445,460],{"__ignoreMap":179},[183,446,447,450,453,456],{"class":185,"line":186},[183,448,449],{"class":189},"curl",[183,451,452],{"class":319}," --resolve",[183,454,455],{"class":192}," web.file-factory.test:443:127.0.0.1",[183,457,459],{"class":458},"s1Wbj"," \\\n",[183,461,462],{"class":185,"line":199},[183,463,464],{"class":192},"  https:\u002F\u002Fweb.file-factory.test\u002F\n",[145,466,467,468,471],{},"The CLI does not rewrite ",[149,469,470],{},"\u002Fetc\u002Fhosts",". The installer manages its own DNS service;\nproject configuration stays independent of workstation resolver settings.",[331,473,475],{"id":474},"traefik-shows-its-default-certificate","Traefik shows its default certificate",[145,477,478,481,482,484],{},[149,479,480],{},"TRAEFIK DEFAULT CERT"," means the proxy has no matching loaded certificate for\nthat hostname. If ",[149,483,271],{}," works but a project hostname does not, check\nthe project's deployment rather than reinstalling the workstation CA.",[145,486,487],{},"Workstation setup creates shared-service certificates. Project certificates and\nroutes are published by a reviewed project deployment. Running containers alone\ndoes not register their routes. From the project directory, prepare a matching\npublished build and apply a fresh deployment plan:",[174,489,491],{"className":176,"code":490,"language":178,"meta":179,"style":179},"mm build --publish\nmm deploy plan\nmm deploy apply --plan PLAN_HASH\n",[149,492,493,503,513],{"__ignoreMap":179},[183,494,495,497,500],{"class":185,"line":186},[183,496,171],{"class":189},[183,498,499],{"class":192}," build",[183,501,502],{"class":319}," --publish\n",[183,504,505,507,510],{"class":185,"line":199},[183,506,171],{"class":189},[183,508,509],{"class":192}," deploy",[183,511,512],{"class":192}," plan\n",[183,514,515,517,519,522,525],{"class":185,"line":314},[183,516,171],{"class":189},[183,518,509],{"class":192},[183,520,521],{"class":192}," apply",[183,523,524],{"class":319}," --plan",[183,526,527],{"class":192}," PLAN_HASH\n",[145,529,530,531,533],{},"Use the same runtime and environment for all three commands. Once the project's\nHTTPS route and certificate are published, its HTTP route redirects to HTTPS\nautomatically. There is no need to add a ",[149,532,343],{}," entry for the conventional\nservice hostname. An unknown\u002Funpublished hostname is not redirected to a broken\nHTTPS endpoint.",[158,535,537],{"id":536},"rotation-and-repair","Rotation and repair",[331,539,541],{"id":540},"temporarily-release-public-ports","Temporarily release public ports",[145,543,544],{},"To let another development stack use ports 80 and 443, stop only mm's global\npublic ingress forwarder:",[174,546,548],{"className":176,"code":547,"language":178,"meta":179,"style":179},"mm ingress stop\nmm ingress start\n",[149,549,550,559],{"__ignoreMap":179},[183,551,552,554,556],{"class":185,"line":186},[183,553,171],{"class":189},[183,555,294],{"class":192},[183,557,558],{"class":192}," stop\n",[183,560,561,563,565],{"class":185,"line":199},[183,562,171],{"class":189},[183,564,294],{"class":192},[183,566,567],{"class":192}," start\n",[145,569,570,571,574,575,228,578,581,582,585,586,588],{},"Run the first command to stop forwarding, and the second when you want it back.\nStopping an absent or already stopped forwarder succeeds with “Public ingress\nis not running.” and does not request sudo.\n",[149,572,573],{},"start"," is idempotent: it checks the installed forwarder, shared ingress services,\nand local TLS. If installation is absent, interrupted, or unhealthy, it prepares\nthe forwarder prerequisites, sets up TLS when needed, and offers reviewed repair\nand installation plans. A healthy running installation is left alone. It reuses\nthe runtime recorded for the shared services; on first installation, pass\n",[149,576,577],{},"--runtime docker-compose",[149,579,580],{},"--runtime podman-compose"," if both are available.\nJSON and noninteractive use never prompt. For noninteractive installation or\nrepair, pass ",[149,583,584],{},"mm ingress start --yes",". This does not configure workstation DNS;\n",[149,587,167],{}," does that. Project containers, volumes, DNS, and CA\ntrust are retained. These commands control all mm sites on the workstation, not\none site's route. An operation that explicitly reconciles host ingress can start\nthe forwarder again.",[145,590,591],{},"To check forwarding without changing anything, or to reconcile and restart it:",[174,593,595],{"className":176,"code":594,"language":178,"meta":179,"style":179},"mm ingress status\nmm ingress restart\n",[149,596,597,605],{"__ignoreMap":179},[183,598,599,601,603],{"class":185,"line":186},[183,600,171],{"class":189},[183,602,294],{"class":192},[183,604,209],{"class":192},[183,606,607,609,611],{"class":185,"line":199},[183,608,171],{"class":189},[183,610,294],{"class":192},[183,612,613],{"class":192}," restart\n",[145,615,616,619,620,623,624,627,628,228,631,623,634,637,638,627,641,644,645,648,649,246],{},[149,617,618],{},"status"," reports forwarding separately from the shared services and local TLS\nit depends on, so a deliberately stopped forwarder is not reported as broken.\nWith ",[149,621,622],{},"--output json",", ",[149,625,626],{},"state"," is ",[149,629,630],{},"running",[149,632,633],{},"stopped",[149,635,636],{},"forwarder.failed","\nmarks a forwarder that exited with an error, and ",[149,639,640],{},"ready",[149,642,643],{},"true"," only when\nforwarding is running and the services and TLS are healthy. ",[149,646,647],{},"restart"," follows\nthe same approval rules as ",[149,650,573],{},[145,652,653],{},"How the forwarder runs depends on the workstation:",[400,655,656,686],{},[403,657,658,661,662,665,666,272,668,671,672,674,675,678,679,682,683,246],{},[338,659,660],{},"Linux:"," HAProxy runs as the ",[149,663,664],{},"mm-ingress-forwarder.service"," system unit.\n",[149,667,573],{},[149,669,670],{},"stop"," request sudo only for that fixed operation; the ",[149,673,171],{},"\nprocess remains your user. Authorize with ",[149,676,677],{},"sudo -v"," first for noninteractive\nuse. To also change boot startup, use\n",[149,680,681],{},"sudo systemctl disable --now mm-ingress-forwarder.service"," and\n",[149,684,685],{},"sudo systemctl enable --now mm-ingress-forwarder.service",[403,687,688,691,692,695,696,272,698,700,701,703,704,707,708,711,712,715,716,719,720,246],{},[338,689,690],{},"macOS:"," HAProxy runs as your user in the ",[149,693,694],{},"local.mm.ingress-forwarder","\nlaunchd agent; macOS lets any user listen on ports 80 and 443 on all\naddresses, so ",[149,697,573],{},[149,699,670],{}," never use sudo. ",[149,702,670],{}," unloads the agent but\nkeeps it installed, so it starts again at your next login. To keep it off\nacross logins, run\n",[149,705,706],{},"launchctl disable gui\u002F$(id -u)\u002Flocal.mm.ingress-forwarder"," after\n",[149,709,710],{},"mm ingress stop",", and ",[149,713,714],{},"launchctl enable gui\u002F$(id -u)\u002Flocal.mm.ingress-forwarder","\nbefore ",[149,717,718],{},"mm ingress start",". Forwarder output is in\n",[149,721,722],{},"~\u002FLibrary\u002FLogs\u002Fmm\u002Fingress-forwarder.log",[331,724,726],{"id":725},"rotate-certificates","Rotate certificates",[145,728,729],{},"Leaf certificates are valid for 30 days and renew within seven days of expiry\nwhen deployments or shared services update their routes. To replace the root:",[174,731,733],{"className":176,"code":732,"language":178,"meta":179,"style":179},"mm dev tls rotate\n# Reapply each local deployment and verify every HTTPS route.\nmm deploy plan\nmm deploy apply --plan DEPLOY_PLAN_HASH --yes\n# Reissue and publish certificates for managed service routes.\nmm --runtime podman-compose dev services plan --operation repair\nmm --runtime podman-compose dev services repair --plan SERVICES_PLAN_HASH --yes\n# Remove the old root only after all routes pass verification.\nmm dev tls repair\n",[149,734,735,746,752,760,777,783,808,831,837],{"__ignoreMap":179},[183,736,737,739,741,743],{"class":185,"line":186},[183,738,171],{"class":189},[183,740,193],{"class":192},[183,742,206],{"class":192},[183,744,745],{"class":192}," rotate\n",[183,747,748],{"class":185,"line":199},[183,749,751],{"class":750},"sP7nD","# Reapply each local deployment and verify every HTTPS route.\n",[183,753,754,756,758],{"class":185,"line":314},[183,755,171],{"class":189},[183,757,509],{"class":192},[183,759,512],{"class":192},[183,761,763,765,767,769,771,774],{"class":185,"line":762},4,[183,764,171],{"class":189},[183,766,509],{"class":192},[183,768,521],{"class":192},[183,770,524],{"class":319},[183,772,773],{"class":192}," DEPLOY_PLAN_HASH",[183,775,776],{"class":319}," --yes\n",[183,778,780],{"class":185,"line":779},5,[183,781,782],{"class":750},"# Reissue and publish certificates for managed service routes.\n",[183,784,786,788,791,794,796,799,802,805],{"class":185,"line":785},6,[183,787,171],{"class":189},[183,789,790],{"class":319}," --runtime",[183,792,793],{"class":192}," podman-compose",[183,795,193],{"class":192},[183,797,798],{"class":192}," services",[183,800,801],{"class":192}," plan",[183,803,804],{"class":319}," --operation",[183,806,807],{"class":192}," repair\n",[183,809,811,813,815,817,819,821,824,826,829],{"class":185,"line":810},7,[183,812,171],{"class":189},[183,814,790],{"class":319},[183,816,793],{"class":192},[183,818,193],{"class":192},[183,820,798],{"class":192},[183,822,823],{"class":192}," repair",[183,825,524],{"class":319},[183,827,828],{"class":192}," SERVICES_PLAN_HASH",[183,830,776],{"class":319},[183,832,834],{"class":185,"line":833},8,[183,835,836],{"class":750},"# Remove the old root only after all routes pass verification.\n",[183,838,840,842,844,846],{"class":185,"line":839},9,[183,841,171],{"class":189},[183,843,193],{"class":192},[183,845,206],{"class":192},[183,847,807],{"class":192},[145,849,850,851,854,855,858],{},"Rotation temporarily trusts both old and new roots because existing ingress\nvolumes may still serve old-generation leaves. Do not run the final repair\nuntil every local deployment and the shared service stack have been reconciled\nand checked. ",[149,852,853],{},"mm dev tls status"," reports a pending rotation during this overlap;\n",[149,856,857],{},"repair"," then removes only the exact owned old root.",[145,860,861,862,865],{},"Use ",[149,863,864],{},"docker-compose"," in both service commands if Docker Compose owns the\ninstallation.",[145,867,861,868,871],{},[149,869,870],{},"mm dev tls repair"," for missing trust, incorrect key permissions, or an\ninterrupted rotation. Renew application certificates by applying a fresh\ndeployment; renew shared-service certificates with the repair flow above.\nmm checks certificate ownership and will not replace another tool's certificate.",[158,873,875],{"id":874},"uninstall","Uninstall",[174,877,879],{"className":176,"code":878,"language":178,"meta":179,"style":179},"mm dev tls uninstall\n",[149,880,881],{"__ignoreMap":179},[183,882,883,885,887,889],{"class":185,"line":186},[183,884,171],{"class":189},[183,886,193],{"class":192},[183,888,206],{"class":192},[183,890,891],{"class":192}," uninstall\n",[145,893,894],{},"Uninstall removes exact mm-owned trust entries and local CA\u002Fprivate leaf\nmaterial. Remove or reconfigure dependent local services first if you still\nneed their HTTPS routes. Uninstall does not alter DNS, the hosts file, or\nunrelated certificates.",[896,897,898],"style",{},"html pre.shiki code .svrjQ, html code.shiki .svrjQ{--shiki-default:var(--mm-code-function)}html pre.shiki code .sv8ni, html code.shiki .sv8ni{--shiki-default:var(--mm-code-string)}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sbRf1, html code.shiki .sbRf1{--shiki-default:var(--mm-code-option)}html pre.shiki code .s1Wbj, html code.shiki .s1Wbj{--shiki-default:var(--mm-code-constant)}html pre.shiki code .sP7nD, html code.shiki .sP7nD{--shiki-default:var(--mm-code-comment)}",{"title":179,"searchDepth":199,"depth":199,"links":900},[901,902,906,910],{"id":160,"depth":199,"text":161},{"id":249,"depth":199,"text":250,"children":903},[904,905],{"id":333,"depth":314,"text":334},{"id":474,"depth":314,"text":475},{"id":536,"depth":199,"text":537,"children":907},[908,909],{"id":540,"depth":314,"text":541},{"id":725,"depth":314,"text":726},{"id":874,"depth":199,"text":875},"Set up, trust, rotate, repair, and remove the local certificate authority.","md",{},true,{"title":60,"description":911},"docs\u002Flocal-https","pKwt3mGltBkdcnFMD3XsVhCWD6fsMjTy7UQRY30GCcU",1794512545912]