gate-b: Caddy TLS fix, self-signed RSA cert, SLAB_WOO_BASE_URL, absolute DB path

deploy/Caddyfile

@@ -0,0 +1,18 @@
+slab.local {
+	tls /data/certs/slab.crt /data/certs/slab.key
+	handle /api/* {
+		reverse_proxy fastapi:8000 {
+			transport http {
+				tls_insecure_skip_verify
+			}
+		}
+	}
+	handle {
+		reverse_proxy frontend:80 {
+			header_up X-Real-IP {remote_host}
+			transport http {
+				tls_insecure_skip_verify
+			}
+		}
+	}
+}

deploy/docker-compose.yml

@@ -1,9 +1,9 @@
-# Implementable compose for SlabUploader (docs/refactor-v2).
+# Implementable compose for SlabUploader.
 # From repo root:
 #   cp deploy/.env.example deploy/.env && chmod 600 deploy/.env
 #   docker compose -f deploy/docker-compose.yml --env-file deploy/.env up -d
 # Bind loopback only. Caddy is the TLS edge. Services on the compose network
-# are named `frontend` and `fastapi` (must match Caddyfile.fragment).
+# are named `frontend` and `fastapi` (must match Caddyfile).
 #
 # WOO_BASE_URL is deploy-time SoT, HTTPS only. FastAPI must refuse http://
 # at startup. Settings UI displays the URL read-only.
@@ -25,7 +25,7 @@ services:
       - .env
     environment:
       SLAB_AES_KEY: ${SLAB_AES_KEY}
-      WOO_BASE_URL: ${WOO_BASE_URL}
+      SLAB_WOO_BASE_URL: ${WOO_BASE_URL}
       APP_HOSTNAME: ${APP_HOSTNAME:-}
       # Woo Application Password + inference keys: AES-GCM in SQLite via Settings UI
     volumes:
@@ -36,6 +36,19 @@ services:
     mem_limit: 2g
     restart: unless-stopped
 
+  caddy:
+    image: caddy:2.8.4
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:80:80"
+      - "127.0.0.1:443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./certs:/data/certs:ro
+    depends_on:
+      - frontend
+      - fastapi
+
 volumes:
   slab_db:
   slab_images: