First run

Running a real local HTTPS stack means touching three things macOS protects: DNS resolution, the certificate trust store, and the privileged ports. rexenv asks once for each, the first time it actually needs it.

None of them phone home. All of them are undone by a single Settings → Remove system changes — see Uninstall.

1. Admin password — the DNS resolver

What it writes: /etc/resolver/rex

Why: so https://yoursite.rex resolves to your own machine, in every browser and every terminal, without you editing /etc/hosts for each new site. rexenv runs a small DNS server that answers *.rex with 127.0.0.1; the resolver file is what tells macOS to ask it.

If you configure another TLD in Settings — .test, or anything else — it installs its own resolver file the same way, and asks again at that point.

The DNS outlives the app

The resolver keeps working when rexenv is closed, and so does the DNS server behind it. That is deliberate: a site that stops resolving because you quit an app is a worse experience than one that keeps answering.

2. Keychain — trusting the local certificate authority

What it writes: a trust setting for rexenv’s own certificate authority, in your login keychain.

Why: so your local sites get a real green lock instead of an interstitial warning. rexenv generates a CA on your machine, trusts it for you, and signs one leaf certificate per site domain with it.

That CA signs only your local sites. It never leaves your Mac, it is not shared between machines, and removing the trust is part of the uninstall step.

macOS will ask for your login password rather than an admin password here — the login keychain is a user-level store, which is exactly why rexenv uses it.

3. Admin password — ports 80 and 443

What it does: lets rexenv’s edge proxy bind the privileged ports.

Why: because https://yoursite.rex with no port number means port 443, and on macOS only root may bind below 1024. The edge is the only privileged piece of rexenv; everything else — PHP, the databases, the mail catcher — runs unprivileged on high ports.

The edge’s admin interface is a unix socket with 0600 permissions, never a TCP port. A TCP admin API on a root-owned proxy would be arbitrary file read and write as root for anything that could reach it.

After the prompts

You should be able to create a site and open it immediately. Quickstart walks the first one.

If a prompt was dismissed by accident, nothing is broken — rexenv asks again the next time it needs that capability, and Settings can trigger each one on demand.