From f966fbe690b9c5efd30930dda005221dae83e765 Mon Sep 17 00:00:00 2001
From: grokbot_ty <grokbot_ty@slabuploader.local>
Date: Mon, 7 Sep 2026 16:13:29 +0000
Subject: [PATCH] gate-b: Caddy TLS fix, self-signed RSA cert,
 SLAB_WOO_BASE_URL, absolute DB path

---
 .gitignore                |  1 +
 backend/app/db/engine.py  |  2 +-
 deploy/Caddyfile          | 18 ++++++++++++++++++
 deploy/docker-compose.yml | 19 ++++++++++++++++---
 4 files changed, 36 insertions(+), 4 deletions(-)
 create mode 100644 deploy/Caddyfile

diff --git a/.gitignore b/.gitignore
index fc5c1f6..88c3c92 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,4 @@ images/
 
 # Logs
 *.log
+deploy/certs/
diff --git a/backend/app/db/engine.py b/backend/app/db/engine.py
index bff8add..a6973f6 100644
--- a/backend/app/db/engine.py
+++ b/backend/app/db/engine.py
@@ -15,7 +15,7 @@ from app.db.models import Base
 logger = logging.getLogger(__name__)
 
 # Default DB path for production
-DEFAULT_DB_URL = "sqlite+aiosqlite:///data/slab.db"
+DEFAULT_DB_URL = "sqlite+aiosqlite:////data/slab.db"
 
 _engine: object = None
 _session_factory: object = None
diff --git a/deploy/Caddyfile b/deploy/Caddyfile
new file mode 100644
index 0000000..2e23729
--- /dev/null
+++ b/deploy/Caddyfile
@@ -0,0 +1,18 @@
+slab.local {
+	tls /data/certs/slab.crt /data/certs/slab.key
+	handle /api/* {
+		reverse_proxy fastapi:8000 {
+			transport http {
+				tls_insecure_skip_verify
+			}
+		}
+	}
+	handle {
+		reverse_proxy frontend:80 {
+			header_up X-Real-IP {remote_host}
+			transport http {
+				tls_insecure_skip_verify
+			}
+		}
+	}
+}
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index f1f17d4..3066cd9 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -1,9 +1,9 @@
-# Implementable compose for SlabUploader (docs/refactor-v2).
+# Implementable compose for SlabUploader.
 # From repo root:
 #   cp deploy/.env.example deploy/.env && chmod 600 deploy/.env
 #   docker compose -f deploy/docker-compose.yml --env-file deploy/.env up -d
 # Bind loopback only. Caddy is the TLS edge. Services on the compose network
-# are named `frontend` and `fastapi` (must match Caddyfile.fragment).
+# are named `frontend` and `fastapi` (must match Caddyfile).
 #
 # WOO_BASE_URL is deploy-time SoT, HTTPS only. FastAPI must refuse http://
 # at startup. Settings UI displays the URL read-only.
@@ -25,7 +25,7 @@ services:
       - .env
     environment:
       SLAB_AES_KEY: ${SLAB_AES_KEY}
-      WOO_BASE_URL: ${WOO_BASE_URL}
+      SLAB_WOO_BASE_URL: ${WOO_BASE_URL}
       APP_HOSTNAME: ${APP_HOSTNAME:-}
       # Woo Application Password + inference keys: AES-GCM in SQLite via Settings UI
     volumes:
@@ -36,6 +36,19 @@ services:
     mem_limit: 2g
     restart: unless-stopped
 
+  caddy:
+    image: caddy:2.8.4
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:80:80"
+      - "127.0.0.1:443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./certs:/data/certs:ro
+    depends_on:
+      - frontend
+      - fastapi
+
 volumes:
   slab_db:
   slab_images: