From e13bbedda88ef9c14e431eec801f0a87525b23fe Mon Sep 17 00:00:00 2001
From: grokbot_ty <grokbot_ty@slabuploader.local>
Date: Mon, 7 Sep 2026 16:39:35 +0000
Subject: [PATCH] fix: HTTP-only Caddy for Gate B LAN phone hang
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root cause: Caddy on :80 returned 308 → HTTPS, and TLS handshake failed
(Go/OpenSSL compat). Phones hung on HTTPS redirect loop.

Fix: Caddyfile serves all HTTP on :80 without TLS/redirect. Docker
compose drops port 443 and cert mount. Interim — post-POC restores
proper TLS.
---
 deploy/Caddyfile          | 18 ++++++++----------
 deploy/docker-compose.yml |  2 --
 2 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/deploy/Caddyfile b/deploy/Caddyfile
index 2e23729..4e9ade5 100644
--- a/deploy/Caddyfile
+++ b/deploy/Caddyfile
@@ -1,18 +1,16 @@
-slab.local {
-	tls /data/certs/slab.crt /data/certs/slab.key
+# Interim HTTP-only Caddy config for Gate B UAT.
+# Serves frontend + API over plain HTTP on all hostnames/IPs.
+# No TLS, no HTTPS redirect. Phone CA trust is not required.
+#
+# Post-POC: restore slab.local with proper TLS and ACME.
+
+:80 {
 	handle /api/* {
-		reverse_proxy fastapi:8000 {
-			transport http {
-				tls_insecure_skip_verify
-			}
-		}
+		reverse_proxy fastapi:8000
 	}
 	handle {
 		reverse_proxy frontend:80 {
 			header_up X-Real-IP {remote_host}
-			transport http {
-				tls_insecure_skip_verify
-			}
 		}
 	}
 }
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 96b7b92..0058c4b 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -41,10 +41,8 @@ services:
     restart: unless-stopped
     ports:
       - "0.0.0.0:80:80"
-      - "0.0.0.0:443:443"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile
-      - ./certs:/data/certs:ro
     depends_on:
       - frontend
       - fastapi