- Caddyfile: switch slab.local site block to :443 catch-all so
any SNI (IP or hostname) reaches the reverse proxy. Bare IP
HTTPS no longer fails with SSL_ERROR_INTERNAL_ERROR_ALERT.
- Cert: regenerate self-signed cert with SANs: DNS:slab.local,
IP:192.168.1.202, IP:100.64.0.9. IP SANs ensure cert is presented
for IP-based connections; :443 catch-all ensures Caddy routes
the request regardless of SNI.
- INVENTORY.md: document IP SANs, :443 catch-all, phone access
steps, and bare-IP test results.
Verified on ubuDual5060:
- curl -sk https://192.168.1.202/api/health → 200 ok
- curl -sk https://192.168.1.202/ → 200, frontend HTML
- curl -sk https://100.64.0.9/api/health → 200 ok
- curl -skI http://192.168.1.202/ → 308 redirect to HTTPS
- openssl s_client to 192.168.1.202:443 → TLS 1.3 handshake OK
- Caddyfile: switch from :80 catch-all to slab.local with file-based TLS
using self-signed cert from deploy/certs/
- docker-compose.yml: publish 443, mount certs volume read-only
- INVENTORY.md: update smoke section with HTTPS results, note phone CA TBD
Host fix: added slab.local → 192.168.1.202 to /etc/hosts,
Caddy now serves HTTPS with HTTP→HTTPS redirect,
curl -k https://slab.local/api/health returns 200 ok.
Root cause: Caddy on :80 returned 308 → HTTPS, and TLS handshake failed
(Go/OpenSSL compat). Phones hung on HTTPS redirect loop.
Fix: Caddyfile serves all HTTP on :80 without TLS/redirect. Docker
compose drops port 443 and cert mount. Interim — post-POC restores
proper TLS.
grokbot_ty