diff --git a/README.md b/README.md
index c526386..41bfa72 100644
--- a/README.md
+++ b/README.md
@@ -17,9 +17,14 @@ The recommended way to deploy FilePizza is as a [Docker container](https://hub.d
 
     $ docker run -p 8080:8080 -e PORT=8080 -it kern/filepizza:master
 
-You can also use [zeit/now](https://zeit.co/now):
-
-    $ now --npm --public -e NODE_ENV=production
+WebRTC only works over HTTPS, so you'll either have to get a signed HTTPS key/certificate from a CA such as [Let's Encrypt](https://letsencrypt.org/getting-started/)) or generate your own [self-signed pair](https://devcenter.heroku.com/articles/ssl-certificate-self) and trust it. Then, to run FilePizza with HTTPS termination:
+
+    $ docker run \
+        -p 8080:8080 -e PORT=8080 \
+        -e HTTPS_KEY=/config/server.key \
+        -e HTTPS_CERT=/config/server.crt \
+        -v mylocalpath:/config \
+        -it kern/filepizza:master
 
 You can specify your own ICE STUN/TURN servers for better connectivity behind NATs by passing a JSON encoding of the array via env var `ICE_SERVERS`. Alternatively, if you'd like to use [Twilio's STUN/TURN service](https://www.twilio.com/stun-turn), you can specify your SID and token using the `TWILIO_SID` and `TWILIO_TOKEN` environment variables, respectively.
 
diff --git a/src/server.js b/src/server.js
index 8726268..8649dba 100644
--- a/src/server.js
+++ b/src/server.js
@@ -2,25 +2,14 @@ var db = require("./db");
 var express = require("express");
 var expressWinston = require("express-winston");
 var fs = require("fs");
-var http = require("http");
-var https = require("https");
 var ice = require("./ice");
 var socketIO = require("socket.io");
 var winston = require("winston");
 
 var app = express();
-var server = http.Server(app);
 var port =
   process.env.PORT || (process.env.NODE_ENV === "production" ? 80 : 3000);
 
-var io = socketIO(server);
-io.set("transports", ["polling"]);
-
-server.on("error", function(err) {
-  winston.error(err.message);
-  process.exit(1);
-});
-
 process.on("unhandledRejection", (reason, p) => {
   p.catch(err => {
     log.error("Exiting due to unhandled rejection!");
@@ -35,52 +24,77 @@ process.on("uncaughtException", err => {
   process.exit(1);
 });
 
-server.listen(port, function(err) {
-  var host = server.address().address;
-  var port = server.address().port;
-  winston.info("FilePizza listening on %s:%s", host, port);
-});
+function bootServer(server) {
+  var io = socketIO(server);
+  io.set("transports", ["polling"]);
 
-if (!process.env.QUIET) {
-  app.use(
-    expressWinston.logger({
-      winstonInstance: winston,
-      expressFormat: true
-    })
-  );
-}
+  if (!process.env.QUIET) {
+    app.use(
+      expressWinston.logger({
+        winstonInstance: winston,
+        expressFormat: true
+      })
+    );
+  }
 
-app.get("/app.js", require("./middleware/javascript"));
-app.use(require("./middleware/static"));
+  app.get("/app.js", require("./middleware/javascript"));
+  app.use(require("./middleware/static"));
 
-app.use([
-  require("./middleware/bootstrap"),
-  require("./middleware/error"),
-  require("./middleware/react")
-]);
+  app.use([
+    require("./middleware/bootstrap"),
+    require("./middleware/error"),
+    require("./middleware/react")
+  ]);
 
-io.on("connection", function(socket) {
-  var upload = null;
+  io.on("connection", function(socket) {
+    var upload = null;
 
-  socket.on("upload", function(metadata, res) {
-    if (upload) return;
-    db.create(socket).then(u => {
-      upload = u;
-      upload.fileName = metadata.fileName;
-      upload.fileSize = metadata.fileSize;
-      upload.fileType = metadata.fileType;
-      upload.infoHash = metadata.infoHash;
-      res({ token: upload.token, shortToken: upload.shortToken });
+    socket.on("upload", function(metadata, res) {
+      if (upload) return;
+      db.create(socket).then(u => {
+        upload = u;
+        upload.fileName = metadata.fileName;
+        upload.fileSize = metadata.fileSize;
+        upload.fileType = metadata.fileType;
+        upload.infoHash = metadata.infoHash;
+        res({ token: upload.token, shortToken: upload.shortToken });
+      });
+    });
+
+    socket.on("rtcConfig", function(_, res) {
+      ice.getICEServers().then(function(iceServers) {
+        res({ iceServers: iceServers });
+      });
     });
-  });
 
-  socket.on("rtcConfig", function(_, res) {
-    ice.getICEServers().then(function(iceServers) {
-      res({ iceServers: iceServers });
+    socket.on("disconnect", function() {
+      db.remove(upload);
     });
   });
 
-  socket.on("disconnect", function() {
-    db.remove(upload);
+  server.on("error", function(err) {
+    winston.error(err.message);
+    process.exit(1);
   });
-});
+
+  server.listen(port, function(err) {
+    var host = server.address().address;
+    var port = server.address().port;
+    winston.info("FilePizza listening on %s:%s", host, port);
+  });
+}
+
+if (process.env.HTTPS_KEY && process.env.HTTPS_CERT) {
+  // user-supplied HTTPS key/cert
+  var https = require("https");
+  var server = https.createServer({
+    key: fs.readFileSync(process.env.HTTPS_KEY),
+    cert: fs.readFileSync(process.env.HTTPS_CERT),
+  })
+  bootServer(server)
+} else {
+  // no HTTPS
+  var http = require("http");
+  var server = http.Server(app)
+  bootServer(server)
+}