Chapter 6: TLS certificates

← Back to Index | Previous: Install Deslicer AI | Next: Install DAP →

6.1 Deslicer-managed Caddy

Both Deslicer AI and DAP terminate public HTTPS with Deslicer-supplied Caddy (the shared edge proxy role). Application containers stay on loopback; Caddy owns the public listeners and certificates.

Product	Public listeners (typical)	Upstream
Deslicer AI	`:443` for `<dai-host>`	`/` → `127.0.0.1:13000`, `/control` → `127.0.0.1:13001`
DAP	`:443` (Observer API), `:8443` (Observer UI)	Loopback Observer API / Observer UI

You do not need to place a separate corporate reverse proxy in front of ports 13000 / 13001 for the primary install path. If a corporate load balancer sits in front of Caddy, treat that as an advanced overlay; Deslicer still configures Caddy on the product host.

6.2 Certificate modes

Mode	When to use
ACME (automatic HTTPS)	Default for internet-reachable hostnames. Host must answer HTTP-01 on port 80 (and serve HTTPS on 443 for DAI).
Provided PEM	You supply a certificate and private key issued by your PKI or a third-party CA.

PEM files on the host land under:

/etc/caddy/certs/fullchain.pem
/etc/caddy/certs/privkey.pem

6.3 Deslicer AI Web certificates

Sign in to Control at https://<dai-host>/control
Open Platform integrations → Deslicer AI → Web certificates
Choose ACME or PEM, save, and write any YAML fragment Control prints to a local overlay file (for example edge-tls.yml)
Run the host apply command Control displays on the AI host (includes --update --proxy-only)

Example shape (use Control’s exact output):

bash /opt/deslicer/bin/deslicer-dai-install.sh \
  --provision ./provision.yml \
  --age-identity ~/.config/age/keys.txt \
  --overlay ./edge-tls.yml \
  --update \
  --proxy-only

The apply path updates Caddy without recreating application containers. Prefer Control’s generated command over hand-editing /etc/caddy/Caddyfile. For full product image updates, use Control → Updates (Chapter 5).

6.4 DAP Web certificates

After DAP is enrolled (and the public Observer hostname resolves to the DAP host):

In Control, open Platform integrations → DAP
Select the backend and open Web certificates
Choose ACME or PEM, save, and run the host apply command Control shows on the DAP host

DAP install and update support a proxy-only apply when Control requests it, for example:

bash /opt/deslicer/bin/deslicer-dap-install.sh --update --proxy-only ...

Use the exact flags and enroll context Control prints—do not invent arguments. If ACME failed while DNS was wrong, fix DNS first, then restart Caddy (or re-run the Control proxy-only command) so issuance can leave backoff.

6.5 Routing checklist

Deslicer AI

[ ] https://<dai-host>/ serves the application
[ ] https://<dai-host>/control serves Control
[ ] Browser shows a trusted certificate for the DAI hostname
[ ] 13000 / 13001 are not published on 0.0.0.0

DAP

[ ] Observer health URL from Control returns success over HTTPS
[ ] Observer UI URL from Control loads over HTTPS
[ ] Certificate mode matches what you configured in Control

6.6 Corporate load balancer (optional overlay)

If your security standard requires a corporate LB/WAF in front of Deslicer:

Terminate TLS on the LB or pass through to Caddy—pick one model and keep certificates consistent
Forward to the Deslicer Caddy listeners (DAI :443, DAP edge ports), not to raw Compose ports
Preserve Host headers so ACME and application routing continue to work when Caddy remains the origin TLS terminator

← Back to Index | Previous: Install Deslicer AI | Next: Install DAP →