Feature Request: Option to Disable HTTPS Redirection/Force HTTP for LAN Access

Services Support
1

Problem:
The Jellyfin Android TV app (used on NVIDIA Shield and other Android TV devices) does not support self-signed certificates. When attempting to connect to a StartOS Jellyfin instance, the app fails with SSL handshake errors because it cannot validate the StartOS-generated certificate.

Impact:

  • NVIDIA Shield TV users cannot use the official Jellyfin app to access their StartOS server
  • The only current workarounds are:
    1. Root the Shield to install the StartOS CA certificate system-wide — which breaks Widevine L1 DRM, disabling HD/4K streaming from Netflix, Disney+, Amazon Prime, etc.
    2. Use HTTP: but StartOS currently redirects HTTP to HTTPS, making this impossible

Requested Solution:
Add a toggle in StartOS 0.4 Service Settings to disable automatic HTTPS redirection for specific services (like Jellyfin), allowing HTTP connections on the local network.

Justification:

  • For LAN-only access, HTTP is an acceptable trade-off when the alternative is breaking DRM capabilities or being unable to use the app at all
  • Users accessing via LAN are already behind their firewall; the encryption benefit is minimal for this specific use case
  • The Jellyfin developers have explicitly declined to add self-signed certificate support to the Android TV app, making this a permanent compatibility issue
2

On StartOS 0.4.0.2 you can do this, though as a per-network switch rather than per-service. StartOS only offers a service’s plain-HTTP address on a network you’ve marked as trusted.

SSH in, find your LAN gateway with start-cli net gateway list, then run start-cli net gateway set-secure <GATEWAY>.

Jellyfin’s interface page will then list an http://<LAN-IP>:<port> address. Point the Android TV app at that address, using the IP rather than .local.

The catch: this applies to every service on that network, not just Jellyfin, and anything on that LAN can read that traffic, including passwords. Only do it on a network where you control every device. It never exposes anything to the internet. unset-secure undoes it. On 0.4.0.1 and earlier there’s no supported way to do this.