# Edge & TLS (Caddy)
The “front door” that gives every site its HTTPS.
## Primary edge — pi4 (`.2`)
- Native Caddy at `/etc/caddy/Caddyfile`, listens `:80` + `:443`. - Terminates TLS for every `*.tomasetti.online` / `*.tomasetti.shop` / leebens host. - Self-healing since 2026-08-19: `Restart=on-failure` + a 2-minute health-check cron restarts it if it dies.
## Standby edge — mini1 (`.4`)
- Second Caddy, `:443` only (`http_port 81` so nginx keeps `:80`). - TLS certs are rsync'd nightly from pi4. - LAN clients reach it via dual-A DNS when pi4 is down.
## Deploying changes
`scripts/sync-edge.ps1` pushes the canonical `infra/edge/Caddyfile` to both pi4 and mini1, validates, and reloads. Edit the Caddyfile in the vault, then run the script.
## Certificates
Caddy auto-issues/refreshes Let's Encrypt / ZeroSSL certs per hostname over ACME. As long as a name resolves publicly to the edge, the cert “just works.”
## Retired services (410)
`stats.tomasetti.online`, `omnitools.tomasetti.online`, `pdftools.tomasetti.online`, `habitica.tomasetti.online`, `moodist.tomasetti.online`, `plants.tomasetti.online` — retired 2026-08-19.
These names now return 410 Gone instead of a site — kept as clean “gone” responses rather than errors.