- Caddyfile: switch slab.local site block to :443 catch-all so
any SNI (IP or hostname) reaches the reverse proxy. Bare IP
HTTPS no longer fails with SSL_ERROR_INTERNAL_ERROR_ALERT.
- Cert: regenerate self-signed cert with SANs: DNS:slab.local,
IP:192.168.1.202, IP:100.64.0.9. IP SANs ensure cert is presented
for IP-based connections; :443 catch-all ensures Caddy routes
the request regardless of SNI.
- INVENTORY.md: document IP SANs, :443 catch-all, phone access
steps, and bare-IP test results.
Verified on ubuDual5060:
- curl -sk https://192.168.1.202/api/health → 200 ok
- curl -sk https://192.168.1.202/ → 200, frontend HTML
- curl -sk https://100.64.0.9/api/health → 200 ok
- curl -skI http://192.168.1.202/ → 308 redirect to HTTPS
- openssl s_client to 192.168.1.202:443 → TLS 1.3 handshake OK
- Caddyfile: switch from :80 catch-all to slab.local with file-based TLS
using self-signed cert from deploy/certs/
- docker-compose.yml: publish 443, mount certs volume read-only
- INVENTORY.md: update smoke section with HTTPS results, note phone CA TBD
Host fix: added slab.local → 192.168.1.202 to /etc/hosts,
Caddy now serves HTTPS with HTTP→HTTPS redirect,
curl -k https://slab.local/api/health returns 200 ok.
Record phone LAN hang root cause (308 HTTPS redirect + TLS handshake fail),
HTTP-only Caddy fix, and verified smoke results for 100.64.0.9 and
192.168.1.202. Caddy :80 catch-all returns 200, /api/health ok.
Check in implementable deploy/docker-compose.yml, .env.example, and Caddy
fragment. Store URL is env SoT (not a settings row). Application Password
setup stays in DEPLOYMENT §5 (issue #5).
DEPLOYMENT is host-variable: APP_HOST/APP_HOSTNAME/ports, inventory
worksheet, corrected Caddy handle /api/* before frontend. Drop RemBG
and output_px 1000 as deploy SoT. AGENTS §9, README, IMPL host wording
match. Historical .201 lab is a non-normative callout only.
grokbot_ty
grokbot_ty