TLS termination belongs to the trusted reverse proxy in front
(nginx/caddy/...), not the app. run.py now binds plain HTTP to
127.0.0.1 (HOST/PORT configurable) and the dirty rollback of the
reverted self-signed-cert logic was cleaned up. README updated.
Verified: all endpoints 200 over HTTP, integrity tests 3/3 passing.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
run.py now ensures a self-signed TLS certificate exists (openssl,
SAN localhost/127.0.0.1, 365 days) and serves on https://127.0.0.1:8443.
Falls back to plain HTTP with a loud warning only when openssl is
unavailable. Verified end-to-end with curl over TLS.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Exposes a ciphertext-only REST API: list/get/create/update/delete of
records as opaque base64 blobs. Enforces base64/size validation,
rejects duplicates, and uses patch-version checks server-side so
replayed or stale updates are refused. Includes run.py entry point
that enables TLS when certs/ are present. Verified via test client.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
jhkaktus