# Edge & TLS (Caddy)

The "front door" that gives every site its HTTPS.

## Primary edge — pi4 (`.2`)

- Native Caddy at `/etc/caddy/Caddyfile`, listens `:80` + `:443`.
- Terminates TLS for every `*.tomasetti.online` / `*.tomasetti.shop` / leebens host.
- **Self-healing** since 2026-08-19: `Restart=on-failure` + a 2-minute health-check cron restarts it if it dies.

## Standby edge — mini1 (`.4`)

- Second Caddy, `:443` only (`http_port 81` so nginx keeps `:80`).
- TLS certs are rsync'd nightly from pi4.
- LAN clients reach it via **dual-A DNS** when pi4 is down.

## Deploying changes

`scripts/sync-edge.ps1` pushes the canonical `infra/edge/Caddyfile` to **both** pi4 and mini1, validates, and reloads. Edit the Caddyfile in the vault, then run the script.

## Certificates

Caddy auto-issues/refreshes Let's Encrypt / ZeroSSL certs per hostname over ACME. As long as a name resolves publicly to the edge, the cert "just works."

## Retired services (410)

`stats.tomasetti.online`, `omnitools.tomasetti.online`, `pdftools.tomasetti.online`, `habitica.tomasetti.online`, `moodist.tomasetti.online`, `plants.tomasetti.online` — retired 2026-08-19.

These names now return **410 Gone** instead of a site — kept as clean "gone" responses rather than errors.