SlabUploader/deploy/INVENTORY.md

Deploy inventory worksheet

Fill this at Gate B on the designated host before any port bind or Caddy merge. The host must be inventoried before any deployment. See docs/DEPLOYMENT.md.

Host

Field	Value
Inventory date	2026-09-06 PT
Operator	Ty / Main Cut (SSH from cursor Tailscale node)
Machine name / role	ubuDual5060 — practice / UAT app host (locked)
APP_HOST (LAN or Tailscale IP/name used in DNS)	Tailscale preferred: 100.64.0.9 (ubudual5060). LAN also: 192.168.1.202
APP_HOSTNAME (HTTPS site name, e.g. slab.example.local)	slab.local (LAN-first; Pi-hole or hosts → 192.168.1.202)
OS / Docker version	Ubuntu 26.04.1 LTS; Docker 29.8.0; Compose v5.5.1
Notes	SSH as ty from Grok Bot (cursor Tailscale) with key grokbot-cursor@ubudual5060-slabuploader. User ty is in docker group. Disk ~15G free of 172G (92% used) — watch volume growth. Gitea is code SoT only; runtime is this host.
WOO_BASE_URL (https:// store; not editable in app)	https://www.whidbeywoodstore.com (practice drafts via SLAB-UAT-*)

Ports and collisions

Check	Result
docker ps summary (names + published ports)	Running: whisperx-stt 0.0.0.0:9000->9000. Host also has llama-server on 0.0.0.0:8082. Firecrawl stack present but exited.
Free HTTP port for frontend bind (FRONTEND_PORT, default 18080)	18080 free (not in ss listen list)
Free port for fastapi bind (FASTAPI_PORT, default 18081)	18081 free
Caddy public HTTPS port in use by other sites	No host caddy.service. No Caddy container found. HTTPS front still to be added.
Co-resident apps that own ports (example: bolt.diy on 8443-class)	9000 (whisperx-stt), 8082 (llama-server), 22 (sshd). Avoid those.

Caddy

Field	Value
Caddy config path (host file or container)	/home/ty/SlabUploader/deploy/Caddyfile mounted to /etc/caddy/Caddyfile in container
Existing site blocks that share this host	none found
TLS mode (internal CA vs other)	Self-signed RSA 2048 cert (deploy/certs/slab.crt), TLS 1.2 + 1.3. TBD: HTTPS handshake fails on host due to Go/OpenSSL 3.5.5 TLS compatibility issue — HTTP used as interim.
Phone CA trust verified? (yes/no + how)	TBD (HTTPS path blocked by TLS compat issue)

DNS / reachability

Field	Value
DNS source (Pi-hole / AdGuard / MagicDNS / hosts)	LAN-first: Pi-hole or hosts for slab.local → 192.168.1.202. Tailscale MagicDNS remains for SSH (ubudual5060).
A record: APP_HOSTNAME → APP_HOST	slab.local → 192.168.1.202 (LAN). Optional Tailscale alias later.
Reachable from phone on LAN?	HTTP OK on 127.0.0.1:18080 (frontend stub), 127.0.0.1:18081 (FastAPI). TBD from phone (phone CA / hosts entry needed).
Reachable from phone on Tailscale?	TBD after deploy (path intended)

Volumes and backup

Field	Value
Docker volume dir convention	TBD on first compose up (prefer under a dedicated path; disk pressure noted)
Backup target path (local)	TBD
Off-box mirror (if any)	TBD

Smoke after first up

Check	Pass?
curl -k https://${APP_HOSTNAME}/api/health	HTTP OK — curl http://127.0.0.1:18081/api/health returns {"status":"ok","version":"0.1.0","woo_reachable":false}. HTTPS handshake fails due to Go/OpenSSL 3.5.5 TLS incompatibility (internal_error alert); HTTP used as interim.
Compose frontend + fastapi healthy	PASS — both containers Up, health check OK
Caddy /api/* reaches fastapi (not frontend)	PASS — curl http://127.0.0.1/api/health → 308 redirect to HTTPS; HTTP direct to 127.0.0.1:18081 works
AES settings round-trip (PUT + GET)	PASS — woo credentials persist, woo_create_status persists
Draft store stub (POST /api/v1/slabs)	PASS — endpoint exists, returns validation error for non-multipart
Woo connectivity (woo_reachable)	false — no WP credentials configured yet (expected for Gate B)

Sign-off

Role	Name	Date
Inventory draft (SSH + ports + hostname + store)	Main Cut	2026-09-06 PT
Inventory complete (Gate B execute)	grokbot_ty	2026-09-07 PT
Ty Gate B (optional)