TLS termination belongs to the trusted reverse proxy in front
(nginx/caddy/...), not the app. run.py now binds plain HTTP to
127.0.0.1 (HOST/PORT configurable) and the dirty rollback of the
reverted self-signed-cert logic was cleaned up. README updated.
Verified: all endpoints 200 over HTTP, integrity tests 3/3 passing.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Adds the base project setup (requirements, README, gitignore entries)
and a SQLite storage layer that persists only encrypted records:
uuid, ciphertext, nonce, salt, plus a monotonic version counter used
later for tamper/replay detection. Includes a smoke test run.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
jhkaktus
