The force-HTTPS snippet was 'redir https://{host}{uri} permanent':
- every Host was redirected, including a bare IP that the tls-internal
block has no certificate for — devices reaching the box by IP (no mDNS
on Android / older Windows, the console IP fallback) couldn't load the
UI at all
- 301 is cached by browsers, so switching HTTPS off kept bouncing them to
a dead :443
Now a host matcher limits the redirect to <hostname>.local and <hostname>
and it's a 302. Self-update rewrites the old snippet if it is still the
untouched legacy content. Browsers that already cached the old 301 keep it
until their cache is cleared.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wq1hzUp4ZmCKHDuLKCnu73
Daniel Maksymilian Syrnicki
2468cb3ded