chore: Remove SSL cert handling - use external reverse proxy

- Nginx now listens on HTTP only (port 80)
- Remove SSL cert volume mounts from docker-compose
- Remove SSL troubleshooting sections
- Update docs to indicate SSL handled by Caddy/reverse proxy
- Simplify nginx.conf to remove HTTPS server block

README.md

@@ -37,16 +37,9 @@ cp .env.example .env
 # Edit .env with your values (see docs/SETUP-INFRASTRUCTURE.md)
 
 # 3. Create required directories
-mkdir -p docker/nginx/ssl
 mkdir -p frontend/public
 
-# 4. Generate SSL certificates (self-signed for local dev)
+# 4. Start with Docker Compose
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-  -keyout docker/nginx/ssl/key.pem \
-  -out docker/nginx/ssl/cert.pem \
-  -subj "/CN=localhost"
-
-# 5. Start with Docker Compose
 docker-compose up -d --build
 
 # 6. Initialize database (first time only)

SETUP.md

@@ -104,20 +104,15 @@ npm run dev:frontend # Next.js on port 3000
 ### 8. Production Deployment
 
 ```bash
-# Setup SSL certificates (self-signed for local dev, or use real certs)
-mkdir -p docker/nginx/ssl
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-  -keyout docker/nginx/ssl/key.pem \
-  -out docker/nginx/ssl/cert.pem \
-  -subj "/CN=coop.hobokenchicken.com"
-
 # Create public directory (required for build)
 mkdir -p frontend/public
 
-# Deploy
+# Deploy (Caddy handles SSL termination)
 docker-compose up -d --build
 ```
 
+**Note:** This setup runs HTTP only on port 80. Place behind Caddy or another reverse proxy for SSL termination.
+
 ## Architecture Overview
 
 ```

docker-compose.yml

@@ -96,10 +96,8 @@ services:
     container_name: coop-nginx
     ports:
       - "80:80"
-      - "443:443"
     volumes:
       - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./docker/nginx/ssl:/etc/nginx/ssl:ro
     depends_on:
       frontend:
         condition: service_started

docker/nginx/nginx.conf

@@ -33,35 +33,10 @@ http {
         server backend:3001;
     }
 
-    # HTTP server - redirect to HTTPS
+    # HTTP server (Caddy handles SSL termination)
     server {
         listen 80;
-        server_name coop.hobokenchicken.com;
+        server_name _;
-        
-        location /.well-known/acme-challenge/ {
-            root /var/www/certbot;
-        }
-        
-        location / {
-            return 301 https://$server_name$request_uri;
-        }
-    }
-
-    # HTTPS server
-    server {
-        listen 443 ssl http2;
-        server_name coop.hobokenchicken.com;
-
-        # SSL certificates (replace with your actual certificates)
-        ssl_certificate /etc/nginx/ssl/cert.pem;
-        ssl_certificate_key /etc/nginx/ssl/key.pem;
-
-        # SSL settings
-        ssl_protocols TLSv1.2 TLSv1.3;
-        ssl_ciphers HIGH:!aNULL:!MD5;
-        ssl_prefer_server_ciphers on;
-        ssl_session_cache shared:SSL:10m;
-        ssl_session_timeout 10m;
 
         # Security headers
         add_header X-Frame-Options "SAMEORIGIN" always;

docs/INFRASTRUCTURE.md

@@ -13,13 +13,13 @@
 │                           CoopCredits Server                              │
 │  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  │
 │  │    Nginx     │  │   Frontend   │  │    Backend   │  │  PostgreSQL  │  │
-│  │   (80/443)   │──│  (Next.js)   │──│  (Express)   │──│   (5432)     │  │
+│  │    (80)      │──│  (Next.js)   │──│  (Express)   │──│   (5432)     │  │
 │  └──────────────┘  └──────────────┘  └──────┬───────┘  └──────────────┘  │
 │                                              │                           │
-│  ┌──────────────┐  ┌──────────────┐         │          ┌──────────────┐  │
+│                    ┌──────────────┐         │          ┌──────────────┐  │
-│  │   Certbot    │  │    Redis     │◀────────┘          │  Anchor CLI  │  │
+│                    │    Redis     │◀────────┘          │  Anchor CLI  │  │
-│  │   (SSL)      │  │   (6379)     │                     │ (Optional)   │  │
+│                    │   (6379)     │                     │ (Optional)   │  │
-│  └──────────────┘  └──────────────┘                     └──────────────┘  │
+│                    └──────────────┘                     └──────────────┘  │
 └──────────────────────────────────┬──────────────────────────────────────┘
                                    │
                                    │ Local Network (172.20.1.0/24)
@@ -132,26 +132,9 @@ sudo ufw deny 6379/tcp    # Redis
 - Subnet: 172.20.2.0/24
 - Used for: backend → Tautulli/Overseer/Plex
 
-## SSL/TLS Setup
+## SSL/TLS
 
-### Let's Encrypt (Recommended)
+SSL/TLS is handled by an external reverse proxy (e.g., Caddy). The application stack runs HTTP only on port 80 internally.
-```bash
-# Initial certificate
-docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
-  --webroot -w /var/www/certbot \
-  -d coop.hobokenchicken.com \
-  --agree-tos --no-eff-email
-
-# Auto-renewal (configured in docker-compose)
-```
-
-### Self-Signed (Testing only)
-```bash
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-  -keyout docker/nginx/ssl/key.pem \
-  -out docker/nginx/ssl/cert.pem \
-  -subj '/CN=coop.hobokenchicken.com'
-```
 
 ## Monitoring and Logging
 

docs/SETUP-INFRASTRUCTURE.md

@@ -47,9 +47,10 @@ cd coop-credits
 This script will:
 - Test connectivity to your services (Plex, Tautulli, Overseer)
 - Generate a secure `.env` file
-- Check SSL certificate status
 - Output configuration instructions
 
+**Note:** SSL/TLS is handled by your external reverse proxy (Caddy). The application runs HTTP on port 80 internally.
+
 ### 3. Configure Environment
 
 Edit the generated `.env` file:
@@ -96,40 +97,7 @@ anchor deploy
 
 Update `SOLANA_PROGRAM_ID` in `.env` with the deployed program ID.
 
-### 6. Setup SSL Certificates
+### 6. Deploy
-
-#### Option A: Let's Encrypt (Recommended)
-
-```bash
-# Obtain certificate
-docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
-  --webroot -w /var/www/certbot \
-  -d coop.hobokenchicken.com \
-  --agree-tos --no-eff-email
-
-# Update nginx config to use Let's Encrypt paths
-# Edit docker/nginx/nginx.prod.conf:
-#   ssl_certificate /etc/letsencrypt/live/coop.hobokenchicken.com/fullchain.pem;
-#   ssl_certificate_key /etc/letsencrypt/live/coop.hobokenchicken.com/privkey.pem;
-```
-
-#### Option B: Existing Certificates
-
-```bash
-cp /path/to/your/cert.pem docker/nginx/ssl/cert.pem
-cp /path/to/your/key.pem docker/nginx/ssl/key.pem
-```
-
-#### Option C: Self-Signed (Testing only)
-
-```bash
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-  -keyout docker/nginx/ssl/key.pem \
-  -out docker/nginx/ssl/cert.pem \
-  -subj '/CN=coop.hobokenchicken.com'
-```
-
-### 7. Deploy
 
 ```bash
 ./deployment/deploy-production.sh
@@ -304,20 +272,6 @@ sudo ufw enable
    docker-compose -f docker-compose.prod.yml exec postgres pg_isready -U coop
    ```
 
-### SSL certificate issues
-
-1. Check certificate:
-   ```bash
-   openssl s_client -connect coop.hobokenchicken.com:443 -servername coop.hobokenchicken.com
-   ```
-
-2. Verify certificate paths in nginx config
-
-3. Check certificate expiry:
-   ```bash
-   openssl x509 -in docker/nginx/ssl/cert.pem -noout -dates
-   ```
-
 ## Maintenance
 
 ### Update Application
@@ -354,7 +308,7 @@ docker-compose -f docker-compose.prod.yml restart backend
 ## Security Checklist
 
 - [ ] Changed all default passwords in `.env`
-- [ ] SSL certificates installed and valid
+- [ ] External reverse proxy (Caddy) configured for SSL
 - [ ] Firewall rules configured
 - [ ] Tautulli webhook secret set
 - [ ] Overseer webhook secret set

docs/TROUBLESHOOTING.md

@@ -123,25 +123,6 @@ solana balance
 solana airdrop 2
 ```
 
-### SSL Certificate Errors
-
-**Error:** Browser shows certificate warnings
-
-**Solution:**
-```bash
-# Check certificate
-openssl s_client -connect coop.hobokenchicken.com:443
-
-# Renew Let's Encrypt
-docker-compose -f docker-compose.prod.yml run --rm certbot renew
-
-# Or use self-signed for testing:
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-  -keyout docker/nginx/ssl/key.pem \
-  -out docker/nginx/ssl/cert.pem \
-  -subj '/CN=coop.hobokenchicken.com'
-```
-
 ### CORS Errors in Browser
 
 **Error:** `Access-Control-Allow-Origin` errors
@@ -219,19 +200,6 @@ cd frontend
 npm install next-themes
 ```
 
-### Nginx: SSL Certificate Error
-
-**Error:** `cannot load certificate "/etc/nginx/ssl/cert.pem"`
-
-**Solution:**
-```bash
-mkdir -p docker/nginx/ssl
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-  -keyout docker/nginx/ssl/key.pem \
-  -out docker/nginx/ssl/cert.pem \
-  -subj "/CN=coop.hobokenchicken.com"
-```
-
 ### Docker Compose: Public Directory Not Found
 
 **Error:** `failed to calculate checksum: "/app/frontend/public": not found`