Pi bundle: Kvitt on port 443 through NPM (D-124)

KVITT_PUBLIC_URL=https://${KVITT_PUBLIC_HOST} with no port; the health check
through NPM prints the port-less URL; publish-apk.sh's summary drops :8443.
README: no new router rule (the existing external 443 forward to the Home
Assistant Pi serves Kvitt, NPM selects by name), NPM listens on 443, the
fallback, operations and APK-abuse notes, and every :8443 URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/.env.example

@@ -10,9 +10,9 @@ KVITT_REGISTRY=gitea.lan/jacobh2
 # or the short git SHA that infra/build-images.sh printed.
 KVITT_TAG=CHANGE_ME_TAG
 # Kvitt's own public host name (D-120), owner-chosen: a domain or DuckDNS name pointing at the home's public address.
-# NPM holds its Let's Encrypt certificate; the router forwards external 8443 to NPM's 443. Invite links and the
-# landing page use https://<KVITT_PUBLIC_HOST>:8443 (KVITT_PUBLIC_URL). Not icehack.asuscomm.com: that name is
-# NPM's proxy host for Home Assistant.
+# NPM holds its Let's Encrypt certificate and serves it on the default HTTPS port 443, which the router already
+# forwards to NPM for Home Assistant (D-124). Invite links and the landing page use https://<KVITT_PUBLIC_HOST>
+# (KVITT_PUBLIC_URL, no port). Not icehack.asuscomm.com: that name is NPM's proxy host for Home Assistant.
 KVITT_PUBLIC_HOST=CHANGE_ME_KVITT_PUBLIC_HOST
 # LAN IPv4 address of the Home Assistant Pi, where Nginx Proxy Manager terminates TLS and forwards to this Pi's port
 # 8080 (D-120). The server trusts X-Forwarded-For only from this address (KVITT_TRUSTED_PROXY), so it must be the

infra/pi/compose.yaml

@@ -30,7 +30,7 @@ services:
     environment:
       TZ: Europe/Stockholm
       KVITT_DATA_DIR: /data
-      KVITT_PUBLIC_URL: https://${KVITT_PUBLIC_HOST:?set KVITT_PUBLIC_HOST in .env}:8443
+      KVITT_PUBLIC_URL: https://${KVITT_PUBLIC_HOST:?set KVITT_PUBLIC_HOST in .env}
       # NPM's LAN address: only a request whose TCP peer is this address may set X-Forwarded-For, whose last entry
       # is then the client IP of the rate limits (SPEC §8.5, §8.6, D-120). An IP literal (install.sh checks it).
       KVITT_TRUSTED_PROXY: ${HA_HOST:?set HA_HOST in .env}

infra/pi/lib.sh

@@ -6,7 +6,8 @@
 KVITT_DIR=${KVITT_DIR:-/opt/kvitt}
 # The server's port, published on the Pi's LAN interfaces; Nginx Proxy Manager forwards to it (D-120).
 SERVER_URL=http://localhost:8080
-# Nginx Proxy Manager's HTTPS port on the Home Assistant Pi (the router forwards external 8443 to it, D-120).
+# Nginx Proxy Manager's HTTPS port on the Home Assistant Pi, the default HTTPS port that Kvitt's public URL uses
+# (the router's existing external 443 forward reaches it, D-124).
 NPM_HTTPS_PORT=443
 
 say() { printf '%s\n' "$*"; }
@@ -76,11 +77,11 @@ print_proxy_health() {
   local out ha_host host
   ha_host=$(env_value HA_HOST)
   host=$(env_value KVITT_PUBLIC_HOST)
-  if out=$(curl -fsS --max-time 15 --resolve "$host:$NPM_HTTPS_PORT:$ha_host" "https://$host:$NPM_HTTPS_PORT/health" 2>&1); then
-    say "GET https://$host:$NPM_HTTPS_PORT/health (via NPM at $ha_host): $out"
+  if out=$(curl -fsS --max-time 15 --resolve "$host:$NPM_HTTPS_PORT:$ha_host" "https://$host/health" 2>&1); then
+    say "GET https://$host/health (via NPM at $ha_host:$NPM_HTTPS_PORT): $out"
     return 0
   fi
-  say "GET https://$host:$NPM_HTTPS_PORT/health (via NPM at $ha_host) failed: $out"
+  say "GET https://$host/health (via NPM at $ha_host:$NPM_HTTPS_PORT) failed: $out"
   return 1
 }