From 4f01c3d2d417e58632b0a10db76eac875a4a3e3f Mon Sep 17 00:00:00 2001
From: "benjamin.baker" <benjamin.baker@geaerospace.com>
Date: Sun, 30 Aug 2026 14:41:22 -0400
Subject: [PATCH] Serve the dev/test stack over HTTPS with a mounted
 self-signed cert

Terminate TLS in gunicorn using a host-generated cert mounted read-only under ./certs, so the browser sees a secure context. Secure-context-only web APIs (navigator.clipboard and others) refuse to run over plain http on a non-localhost origin, which the FQDN-accessed test box hits. Healthcheck now probes https with -k to match the TLS listener. A site swaps in its own cert or fronts this with its own IIS/nginx proxy.
---
 docker-compose.yml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index b8d54715..dc2e63e3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -65,8 +65,43 @@ services:
       COLLECTOR_API_KEY_ENDPOINTS: ${COLLECTOR_API_KEY_ENDPOINTS:-}
     ports:
       - "${API_PORT:-5001}:5001"
+    # Terminate TLS in gunicorn with the mounted self-signed cert so the browser
+    # sees a secure context. navigator.clipboard and other secure-context-only
+    # web APIs refuse to run over plain http on a non-localhost origin, so the
+    # test box (accessed by FQDN) needs real https. A site swaps in its own cert
+    # under ./certs or fronts this with its IIS/nginx proxy.
+    command:
+      - gunicorn
+      - --bind
+      - 0.0.0.0:5001
+      - --workers
+      - "4"
+      - --timeout
+      - "60"
+      - --access-logfile
+      - "-"
+      - --error-logfile
+      - "-"
+      - --certfile
+      - /app/certs/server.crt
+      - --keyfile
+      - /app/certs/server.key
+      - wsgi:app
+    healthcheck:
+      # Match the TLS listener: probe over https and accept the self-signed cert
+      # (-k). The Dockerfile default probes http and would stay red once gunicorn
+      # only speaks TLS.
+      test: ["CMD", "curl", "--silent", "--insecure", "https://localhost:5001/api/auth/login",
+             "-X", "POST", "-H", "Content-Type: application/json", "-d", "{}"]
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
     volumes:
       - ./plugins:/app/plugins:ro
+      # Self-signed TLS material for the dev/test https listener. Read-only;
+      # generated on the host under ./certs and never baked into the image.
+      - ./certs:/app/certs:ro
       # /app/instance is WRITTEN state, not code: plugins.json (which plugins
       # this site has enabled), uploaded floor plans, branding, model and
       # application images, employee photos, warranty proofs, slides,