gate-b: Caddy TLS fix, self-signed RSA cert, SLAB_WOO_BASE_URL, absolute DB path

deploy/docker-compose.yml

@@ -1,9 +1,9 @@
-# Implementable compose for SlabUploader (docs/refactor-v2).
+# Implementable compose for SlabUploader.
 # From repo root:
 #   cp deploy/.env.example deploy/.env && chmod 600 deploy/.env
 #   docker compose -f deploy/docker-compose.yml --env-file deploy/.env up -d
 # Bind loopback only. Caddy is the TLS edge. Services on the compose network
-# are named `frontend` and `fastapi` (must match Caddyfile.fragment).
+# are named `frontend` and `fastapi` (must match Caddyfile).
 #
 # WOO_BASE_URL is deploy-time SoT, HTTPS only. FastAPI must refuse http://
 # at startup. Settings UI displays the URL read-only.
@@ -25,7 +25,7 @@ services:
       - .env
     environment:
       SLAB_AES_KEY: ${SLAB_AES_KEY}
-      WOO_BASE_URL: ${WOO_BASE_URL}
+      SLAB_WOO_BASE_URL: ${WOO_BASE_URL}
       APP_HOSTNAME: ${APP_HOSTNAME:-}
       # Woo Application Password + inference keys: AES-GCM in SQLite via Settings UI
     volumes:
@@ -36,6 +36,19 @@ services:
     mem_limit: 2g
     restart: unless-stopped
 
+  caddy:
+    image: caddy:2.8.4
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:80:80"
+      - "127.0.0.1:443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./certs:/data/certs:ro
+    depends_on:
+      - frontend
+      - fastapi
+
 volumes:
   slab_db:
   slab_images: