- Caddyfile: switch slab.local site block to :443 catch-all so
any SNI (IP or hostname) reaches the reverse proxy. Bare IP
HTTPS no longer fails with SSL_ERROR_INTERNAL_ERROR_ALERT.
- Cert: regenerate self-signed cert with SANs: DNS:slab.local,
IP:192.168.1.202, IP:100.64.0.9. IP SANs ensure cert is presented
for IP-based connections; :443 catch-all ensures Caddy routes
the request regardless of SNI.
- INVENTORY.md: document IP SANs, :443 catch-all, phone access
steps, and bare-IP test results.
Verified on ubuDual5060:
- curl -sk https://192.168.1.202/api/health → 200 ok
- curl -sk https://192.168.1.202/ → 200, frontend HTML
- curl -sk https://100.64.0.9/api/health → 200 ok
- curl -skI http://192.168.1.202/ → 308 redirect to HTTPS
- openssl s_client to 192.168.1.202:443 → TLS 1.3 handshake OK
grokbot_ty
f82287db78