davideandClaude Sonnet 5
d35784d574
Caddy's site address comes from SITE_ADDRESS (defaults to "localhost"). Left at that default, Caddy detects it isn't a public hostname and issues a self-signed cert from its own internal CA — no domain needed for local/dev testing. Set to a real domain, it gets a genuine Let's Encrypt certificate automatically instead. DB, encrypted master key and logs are bind-mounted from ./data/ on the host (not opaque Docker-managed volumes), so they survive container restarts/rebuilds and stay reachable for manual inspection/backup directly from the repo root. ./data/ is gitignored. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>