Merge pull request #30 from evcc-io/fix/ocpp_cert

OCPP: make unencrypted default

Author: naltatis

README.md

@@ -58,20 +58,15 @@ For more detailed instructions, see the [full documentation](https://docs.evcc.i
 
 ## Available Services
 
-| Service    | Port | Protocol | URL                                 |
-| ---------- | ---- | -------- | ----------------------------------- |
-| evcc UI    | 443  | HTTPS    | `https://evcc.local/`               |
-| OCPP       | 8887 | WSS      | `wss://evcc.local:8887/<stationid>` |
-| Cockpit UI | 9090 | HTTPS    | `https://evcc.local:9090/`          |
-
-**Note:** The above services use self-signed certificates.
-You'll need to accept the certificate warning in your browser, or disable certificate verification in your EV charger's OCPP configuration.
-If you have compatibility problems, use the unencrypted alternatives below:
-
-| Service | Port | Protocol | URL                                |
-| ------- | ---- | -------- | ---------------------------------- |
-| evcc UI | 7070 | HTTP     | `http://evcc.local:7070/`          |
-| OCPP    | 8886 | WS       | `ws://evcc.local:8886/<stationid>` |
+| Service    | Port | Protocol | URL                                 | Note                           |
+| ---------- | ---- | -------- | ----------------------------------- | ------------------------------ |
+| evcc UI    | 443  | HTTPS    | `https://evcc.local/`               | self-signed cert **(default)** |
+|            | 7070 | HTTP     | `http://evcc.local:7070/`           | unencrypted                    |
+| OCPP       | 8888 | WSS      | `wss://evcc.local:8888/<stationid>` | self-signed cert               |
+|            | 8887 | WS       | `ws://evcc.local:8887/<stationid>`  | unencrypted **(default)**      |
+| Cockpit UI | 9090 | HTTPS    | `https://evcc.local:9090/`          | self-signed cert               |
+
+The image offers an encrypted version for all services. We recommend using encrypted connections even in local networks. For OCPP, some EV chargers don't support self-signed certificates. Use unencrypted WS as a fallback.
 
 ## Administration
 

userpatches/customize-image.sh

@@ -266,8 +266,6 @@ mkdir -p /etc/systemd/system/evcc.service.d
 cat >/etc/systemd/system/evcc.service.d/override.conf <<EVCCCONF
 [Service]
 Environment="EVCC_NETWORK_HOST=${EVCC_HOSTNAME}.local"
-Environment="EVCC_NETWORK_EXTERNALURL=https://${EVCC_HOSTNAME}.local"
-Environment="EVCC_OCPP_PORT=8886"
 EVCCCONF
 
 # Enable evcc service
@@ -386,13 +384,13 @@ https:// {
   reverse_proxy 127.0.0.1:7070
 }
 
-# OCPP port forwarding: 8886 (HTTP) -> 8887 (HTTPS)
-:8887 {
+# OCPP secure alternative: 8887 (WS) -> 8888 (WSS)
+:8888 {
   tls internal {
     protocols tls1.2 tls1.3
   }
   log
-  reverse_proxy 127.0.0.1:8886
+  reverse_proxy 127.0.0.1:8887
 }
 
 CADDY