grokbot_ty
f82287db78
- Caddyfile: switch slab.local site block to :443 catch-all so any SNI (IP or hostname) reaches the reverse proxy. Bare IP HTTPS no longer fails with SSL_ERROR_INTERNAL_ERROR_ALERT. - Cert: regenerate self-signed cert with SANs: DNS:slab.local, IP:192.168.1.202, IP:100.64.0.9. IP SANs ensure cert is presented for IP-based connections; :443 catch-all ensures Caddy routes the request regardless of SNI. - INVENTORY.md: document IP SANs, :443 catch-all, phone access steps, and bare-IP test results. Verified on ubuDual5060: - curl -sk https://192.168.1.202/api/health → 200 ok - curl -sk https://192.168.1.202/ → 200, frontend HTML - curl -sk https://100.64.0.9/api/health → 200 ok - curl -skI http://192.168.1.202/ → 308 redirect to HTTPS - openssl s_client to 192.168.1.202:443 → TLS 1.3 handshake OK
17 lines
472 B
Caddyfile
17 lines
472 B
Caddyfile
# Caddy config for slab.local with file-based TLS.
|
|
# Uses pre-generated self-signed certs from certs/ directory.
|
|
# Caddy's internal CA is NOT used; file-based certs avoid CA trust setup.
|
|
# :443 catch-all ensures IP-based SNI does not fail; slab.local is the primary name.
|
|
|
|
:443 {
|
|
tls /etc/caddy/certs/slab.crt /etc/caddy/certs/slab.key
|
|
handle /api/* {
|
|
reverse_proxy fastapi:8000
|
|
}
|
|
handle {
|
|
reverse_proxy frontend:80 {
|
|
header_up X-Real-IP {remote_host}
|
|
}
|
|
}
|
|
}
|