added https for client and managment

README.md

@@ -24,6 +24,14 @@ The node agent must run on every Incus host with permission to access Incus, ZFS
 
 Set `API_TOKEN` in `backend/.env`; the management server uses that token when calling the agent. The token is required and must be at least 32 characters long.
 
+The agent can serve HTTPS directly for private networks:
+
+```env
+HTTPS_ENABLED=true
+TLS_CERT_FILE="/etc/incus-backup-agent/tls.crt"
+TLS_KEY_FILE="/etc/incus-backup-agent/tls.key"
+```
+
 Required commands:
 
 - `incus`
@@ -46,6 +54,8 @@ The management API stores nodes, users, sessions, and central schedules in SQLit
 
 Agent URLs must use `https://` by default. For local development only, set `ALLOW_INSECURE_AGENT_HTTP=true` in `management/.env` to permit `http://` node URLs.
 
+For internal/self-signed agent certificates, set `AGENT_CA_FILE` in `management/.env` to the CA certificate that signed the agent certificates.
+
 The management API uses Node's built-in SQLite module and requires Node.js 22.5 or newer.
 
 Reset an existing admin password without deleting the database: