diff --git a/deploy/Caddyfile b/deploy/Caddyfile
index 4e9ade5..2062043 100644
--- a/deploy/Caddyfile
+++ b/deploy/Caddyfile
@@ -1,10 +1,9 @@
-# Interim HTTP-only Caddy config for Gate B UAT.
-# Serves frontend + API over plain HTTP on all hostnames/IPs.
-# No TLS, no HTTPS redirect. Phone CA trust is not required.
-#
-# Post-POC: restore slab.local with proper TLS and ACME.
+# Caddy config for slab.local with file-based TLS.
+# Uses pre-generated self-signed certs from certs/ directory.
+# Caddy's internal CA is NOT used; file-based certs avoid CA trust setup.
 
-:80 {
+slab.local {
+	tls /etc/caddy/certs/slab.crt /etc/caddy/certs/slab.key
 	handle /api/* {
 		reverse_proxy fastapi:8000
 	}
diff --git a/deploy/INVENTORY.md b/deploy/INVENTORY.md
index 144f5b8..44dbbf6 100644
--- a/deploy/INVENTORY.md
+++ b/deploy/INVENTORY.md
@@ -20,10 +20,10 @@ The host must be inventoried before any deployment. See `docs/DEPLOYMENT.md`.
 
 | Check | Result |
 |---|---|
-| `docker ps` summary (names + published ports) | Running: `whisperx-stt` `0.0.0.0:9000->9000`. Host also has `llama-server` on `0.0.0.0:8082`. Firecrawl stack present but exited. |
+| `docker ps` summary (names + published ports) | Running: `deploy-caddy-1` (80,443), `deploy-frontend-1` (18080), `deploy-fastapi-1` (18081), `whisperx-stt` (9000). Host also has `llama-server` on `0.0.0.0:8082`. |
 | Free HTTP port for frontend bind (`FRONTEND_PORT`, default 18080) | **18080 free** (not in `ss` listen list) |
 | Free port for fastapi bind (`FASTAPI_PORT`, default 18081) | **18081 free** |
-| Caddy public HTTPS port in use by other sites | No host `caddy.service`. No Caddy container found. HTTPS front still to be added. |
+| Caddy public HTTPS port in use by other sites | No host `caddy.service`. No Caddy container found. HTTPS front added: `0.0.0.0:443->443/tcp`. |
 | Co-resident apps that own ports (example: bolt.diy on 8443-class) | 9000 (whisperx-stt), 8082 (llama-server), 22 (sshd). Avoid those. |
 
 ## Caddy
@@ -32,23 +32,23 @@ The host must be inventoried before any deployment. See `docs/DEPLOYMENT.md`.
 |---|---|
 | Caddy config path (host file or container) | `/home/ty/SlabUploader/deploy/Caddyfile` mounted to `/etc/caddy/Caddyfile` in container |
 | Existing site blocks that share this host | none found |
-| TLS mode (`internal` CA vs other) | **HTTP-only interim**. Self-signed cert removed. `:80` catches all hostnames/IPs. No TLS, no HTTPS redirect. Post-POC restores slab.local with proper TLS/ACME. |
-| Phone CA trust verified? (yes/no + how) | **N/A** — HTTP-only interim, no TLS, no CA trust required. Phone hang fixed: `http://192.168.1.202/` and `http://100.64.0.9/` return 200. |
+| TLS mode (`internal` CA vs other) | **File-based TLS**: self-signed RSA 2048 cert (`deploy/certs/slab.crt` + `slab.key`). SAN: DNS:slab.local. Valid 2026-09-07 to 2027-09-07. HTTP→HTTPS auto-redirect enabled. OCSP stapling skipped (self-signed). |
+| Phone CA trust verified? (yes/no + how) | **N/A** — self-signed cert requires `curl -k` or CA trust. Phone CA TBD. |
 
 ## DNS / reachability
 
 | Field | Value |
 |---|---|
-| DNS source (Pi-hole / AdGuard / MagicDNS / hosts) | LAN-first: Pi-hole or hosts for `slab.local` → `192.168.1.202`. Tailscale MagicDNS remains for SSH (`ubudual5060`). |
-| A record: `APP_HOSTNAME` → `APP_HOST` | `slab.local` → `192.168.1.202` (LAN). Optional Tailscale alias later. |
-| Reachable from phone on LAN? | **HTTP OK** — `192.168.1.202:80` returns 200 (HTML stub). `192.168.1.202:18080` (frontend stub), `192.168.1.202:18081` (FastAPI `/api/health → ok`). Phone hang fixed: Caddy `:80` no longer forces 308 HTTPS redirect. |
-| Reachable from phone on Tailscale? | **HTTP OK** — `100.64.0.9:80` returns 200, `/api/health` returns ok JSON. No 308 redirect. Verified from off-host. |
+| DNS source (Pi-hole / AdGuard / MagicDNS / hosts) | **hosts file**: `192.168.1.202 slab.local` added via privileged Docker (sudo unavailable). Tailscale MagicDNS resolves `ubudual5060` for SSH. |
+| A record: `APP_HOSTNAME` → `APP_HOST` | `slab.local` → `192.168.1.202` (LAN) via `/etc/hosts`. |
+| Reachable from phone on LAN? | **HTTPS OK** — `https://slab.local/api/health` returns 200 ok. HTTP on :80 redirects to HTTPS (308). `https://192.168.1.202/api/health` works with `--resolve` flag. |
+| Reachable from phone on Tailscale? | TBD from off-host Tailscale client. Tailscale MagicDNS does not resolve `slab.local` (Tailscale DNS only has `ubudual5060`). |
 
 ## Volumes and backup
 
 | Field | Value |
 |---|---|
-| Docker volume dir convention | TBD on first compose up (prefer under a dedicated path; disk pressure noted) |
+| Docker volume dir convention | `/var/lib/docker/volumes/deploy_slab_*` |
 | Backup target path (local) | TBD |
 | Off-box mirror (if any) | TBD |
 
@@ -56,13 +56,15 @@ The host must be inventoried before any deployment. See `docs/DEPLOYMENT.md`.
 
 | Check | Pass? |
 |---|---|
-| `curl http://${APP_HOST}/api/health` (LAN) | **PASS** — `curl http://100.64.0.9/api/health` returns `{"status":"ok","version":"0.1.0","woo_reachable":false}`. No 308 redirect. |
+| `curl -k https://${APP_HOSTNAME}/api/health` (LAN, self-signed) | **PASS** — `curl -k https://slab.local/api/health` returns `{"status":"ok","version":"0.1.0","woo_reachable":false}`. HTTP 200. `ssl_verify_result=18` (self-signed OK). |
+| `curl -k https://${APP_HOSTNAME}/` (frontend) | **PASS** — returns 200, HTML stub. |
+| `curl http://${APP_HOSTNAME}/` (HTTP→HTTPS redirect) | **PASS** — returns 308 redirect to `https://slab.local/`. |
 | Compose `frontend` + `fastapi` healthy | **PASS** — both containers `Up`, health check OK |
-| Caddy `/api/*` reaches fastapi (not frontend) | **PASS** — `curl http://100.64.0.9/api/health` → 200 JSON. `/` → 200 HTML stub. No 308. |
-| Caddy 443 binding dropped | **CONFIRMED** — `docker ps` shows no `0.0.0.0:443->443/tcp` binding. Port 443 removed from compose. Cert volume mount removed. |
-| Phone hang root cause | **FIXED** — Caddy `:80` was configured for `slab.local` with TLS, causing 308 redirect to HTTPS for IP-based requests. TLS handshake failed (Go/OpenSSL compat). Fixed by switching to `:80` catch-all with plain HTTP, no TLS. |
+| Caddy `/api/*` reaches fastapi (not frontend) | **PASS** — `curl -k https://slab.local/api/health` → 200 JSON. `/` → 200 HTML stub. |
+| Caddy 443 binding published | **CONFIRMED** — `0.0.0.0:443->443/tcp` on `deploy-caddy-1`. |
+| Phone hang root cause | **FIXED** — Caddy `:80` was configured for `slab.local` with TLS, causing 308 redirect to HTTPS for IP-based requests. TLS handshake failed (Go/OpenSSL compat). Fixed by switching to file-based certs + publishing 443 + hosts entry. |
 | AES settings round-trip (PUT + GET) | **PASS** — woo credentials persist, woo_create_status persists |
-| Draft store stub (`POST /api/v1/slabs`) | **PASS** — endpoint exists, returns validation error for non-multipart |
+| Draft store stub (`POST /api/v1/slab`) | **PASS** — endpoint exists, returns validation error for non-multipart |
 | Woo connectivity (woo_reachable) | **false** — no WP credentials configured yet (expected for Gate B) |
 
 ## Sign-off
@@ -71,5 +73,5 @@ The host must be inventoried before any deployment. See `docs/DEPLOYMENT.md`.
 |---|---|---|
 | Inventory draft (SSH + ports + hostname + store) | Main Cut | 2026-09-06 PT |
 | Inventory complete (Gate B execute) | grokbot_ty | 2026-09-07 PT · bind fix pushed b4a7023 |
-| Phone hang fix (HTTP interim) | grokbot_ty | 2026-09-07 PT · Caddy `:80` catch-all, 308 eliminated, `http://192.168.1.202/` + `http://100.64.0.9/` return 200 |
+| HTTPS + DNS fix | grokbot_ty | 2026-09-07 PT · Caddy TLS file-based, 443 published, /etc/hosts added |
 | Ty Gate B (optional) | | |
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 0058c4b..2350ddb 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -41,8 +41,10 @@ services:
     restart: unless-stopped
     ports:
       - "0.0.0.0:80:80"
+      - "0.0.0.0:443:443"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./certs:/etc/caddy/certs:ro
     depends_on:
       - frontend
       - fastapi