- Caddyfile: switch from :80 catch-all to slab.local with file-based TLS
using self-signed cert from deploy/certs/
- docker-compose.yml: publish 443, mount certs volume read-only
- INVENTORY.md: update smoke section with HTTPS results, note phone CA TBD
Host fix: added slab.local → 192.168.1.202 to /etc/hosts,
Caddy now serves HTTPS with HTTP→HTTPS redirect,
curl -k https://slab.local/api/health returns 200 ok.
Root cause: Caddy on :80 returned 308 → HTTPS, and TLS handshake failed
(Go/OpenSSL compat). Phones hung on HTTPS redirect loop.
Fix: Caddyfile serves all HTTP on :80 without TLS/redirect. Docker
compose drops port 443 and cert mount. Interim — post-POC restores
proper TLS.
grokbot_ty