@@ -86,4 +86,4 @@ description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8901${CL}"
+echo -e "${GATEWAY}${BGN}https://${IP}${CL}"
@@ -72,8 +72,8 @@ intel | amd) KYOO_HWACCEL="vaapi" ;;
 *) KYOO_HWACCEL="disabled" ;;
 esac
 cat <<EOF >/opt/kyoo_data/.env
-PUBLIC_URL=http://${LOCAL_IP}:8901
-JWT_ISSUER=http://${LOCAL_IP}:8901
+PUBLIC_URL=https://${LOCAL_IP}
+JWT_ISSUER=https://${LOCAL_IP}
 EXTRA_OIDC_REDIRECT_URLS=kyoo
 
 PGHOST=127.0.0.1
@@ -115,7 +115,9 @@ chmod 600 /opt/kyoo_data/.env /opt/kyoo_data/keibi.pem
 msg_ok "Configured Kyoo"
 
 msg_info "Configuring Nginx"
+create_self_signed_cert "kyoo"
 # Upstream's Traefik routes; auth_request replaces its forwardAuth that swaps tokens/API keys for a JWT.
+# HTTPS so browsers honour COOP/COEP (SharedArrayBuffer for subtitles); 127.0.0.1:8901 is plain HTTP for the scanner.
 cat <<'EOF' >/etc/nginx/sites-available/kyoo
 map $http_upgrade $kyoo_connection_upgrade {
     default upgrade;
@@ -133,11 +135,21 @@ map $http_x_forwarded_host $kyoo_forwarded_host {
 }
 
 server {
-    listen 8901;
+    listen 80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl default_server;
+    listen 127.0.0.1:8901;
     server_name _;
     charset utf-8;
     client_max_body_size 0;
 
+    ssl_certificate /etc/ssl/kyoo/kyoo.crt;
+    ssl_certificate_key /etc/ssl/kyoo/kyoo.key;
+
     root /opt/kyoo/front/dist;
     index index.html;
 
 
@@ -12,7 +12,7 @@
     "amd64",
     "arm64"
   ],
-  "interface_port": 8901,
+  "interface_port": 443,
   "documentation": "https://github.com/zoriya/Kyoo/blob/master/INSTALLING.md",
   "website": "https://kyoo.zoriya.dev/",
   "repository": "https://github.com/zoriya/Kyoo",
@@ -38,9 +38,21 @@
   },
   "notes": [
     {
-      "text": "There is no default account. The first account registered at http://<IP>:8901 becomes the administrator, so create it right after the install. Later sign-ups have to be verified by the administrator before they can play anything.",
+      "text": "Kyoo is served over HTTPS with a self-signed certificate (http:// redirects to it): open https://<IP> and accept the certificate warning. HTTPS is needed because the player's subtitle renderer uses SharedArrayBuffer, which browsers only allow on a secure page.",
+      "type": "info"
+    },
+    {
+      "text": "There is no default account. The first account registered at https://<IP> becomes the administrator, so create it right after the install. Later sign-ups have to be verified by the administrator before they can play anything.",
       "type": "warning"
     },
+    {
+      "text": "Until the first video has been scanned and matched, the home page shows only \"Resource not found.\". That, and a 403 on /auth/users/me in the browser console when the settings page is opened while logged out, is how upstream Kyoo behaves with an empty library and guest access.",
+      "type": "info"
+    },
+    {
+      "text": "A login that answers \"Field validation for 'Login' failed on the 'required' tag\" reached Kyoo with empty fields, which happens when the browser autofills the form without the page noticing. Type or edit the username and password, then log in again.",
+      "type": "info"
+    },
     {
       "text": "Visitors who are not logged in can browse the library but not play it (GUEST_CLAIMS in /opt/kyoo_data/.env). Set GUEST_CLAIMS= to require a login for everything, then run systemctl restart kyoo-auth.",
       "type": "info"
@@ -50,7 +62,7 @@
       "type": "info"
     },
     {
-      "text": "PUBLIC_URL and JWT_ISSUER in /opt/kyoo_data/.env must stay identical. Change both when Kyoo is reached under another address (needed for OIDC logins), then run systemctl restart kyoo-auth kyoo-api kyoo-scanner.",
+      "text": "PUBLIC_URL and JWT_ISSUER in /opt/kyoo_data/.env (https://<IP>) must stay identical. Change both when Kyoo is reached under another address, e.g. a domain behind a reverse proxy (needed for OIDC logins), then run systemctl restart kyoo-auth kyoo-api kyoo-scanner.",
       "type": "info"
     },
     {