M41: harden trust boundaries and delivery

deploy/unraid/README.md

@@ -9,7 +9,7 @@ existing shared n8n remains available on its established port 5678.
 
 - Directory: `/mnt/user/appdata/mobilityops`
 - Compose project: `mobilityops`
-- Web: `http://192.168.10.150:1236` (`1236` on the host to `80` in `web`)
+- Public web: `https://fleetops.itworx.tech` (TLS reverse proxy to host port `1236`)
 - API and PostgreSQL: Compose network only
 - Shared n8n: `http://192.168.10.150:5678` (outside the MobilityOps Compose project)
 
@@ -17,14 +17,15 @@ existing shared n8n remains available on its established port 5678.
 
 Create `.env` from `.env.example`, replace every placeholder secret, set
 `MOBILITYOPS_ENV=production`, set both public URLs to
-`http://192.168.10.150:1236`, and retain `KNOWLEDGE_PROVIDER=demo` while RAGcore is not
-available. Keep `MCP_HUB_REGISTRATION_ENABLED=false` until the central Hub is ready.
+`https://fleetops.itworx.tech`, set `SESSION_COOKIE_SECURE=true`, and retain
+`KNOWLEDGE_PROVIDER=demo` while RAGcore is not available. The internal `1236` listener is
+an upstream for the TLS proxy, not a user-facing URL.
 
 ```bash
 cd /mnt/user/appdata/mobilityops
 ./deploy/unraid/configure-env.sh \
-  http://192.168.10.150:1236 \
-  http://192.168.10.150:5678/webhook/mobilityops-return
+  https://fleetops.itworx.tech \
+  https://n8n.itworx.tech/webhook/mobilityops-return
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml up --build -d db api web backup
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec api \
   python -m app.cli seed --reset
@@ -36,7 +37,7 @@ workflow into the existing n8n container:
 ```bash
 ./deploy/unraid/setup-existing-n8n.sh \
   n8n \
-  http://192.168.10.150:1236/api/v1/integrations/n8n/return-callback
+  https://fleetops.itworx.tech/api/v1/integrations/n8n/return-callback
 ```
 
 The callback token remains server-side and is never written to the repository. The

deploy/unraid/configure-env.sh

@@ -1,8 +1,13 @@
 #!/bin/sh
 set -eu
 
-public_url="${1:-http://192.168.10.150:1236}"
-n8n_webhook_url="${2:-http://192.168.10.150:5678/webhook/mobilityops-return}"
+public_url="${1:-https://fleetops.itworx.tech}"
+n8n_webhook_url="${2:-https://n8n.itworx.tech/webhook/mobilityops-return}"
+
+case "$public_url" in
+  https://*) ;;
+  *) echo "Production public URL must use HTTPS" >&2; exit 1 ;;
+esac
 
 if [ -e .env ]; then
   echo "Refusing to overwrite existing .env" >&2
@@ -26,6 +31,7 @@ sed -i \
   -e "s|^DATABASE_URL=.*|DATABASE_URL=postgresql+psycopg://mobilityops:${db_password}@db:5432/mobilityops|" \
   -e "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=${db_password}|" \
   -e "s|^APP_SECRET=.*|APP_SECRET=${app_secret}|" \
+  -e "s|^SESSION_COOKIE_SECURE=.*|SESSION_COOKIE_SECURE=true|" \
   -e "s|^N8N_WEBHOOK_URL=.*|N8N_WEBHOOK_URL=${n8n_webhook_url}|" \
   -e "s|^N8N_ENCRYPTION_KEY=.*|N8N_ENCRYPTION_KEY=${n8n_key}|" \
   -e "s|^N8N_BASIC_AUTH_PASSWORD=.*|N8N_BASIC_AUTH_PASSWORD=${n8n_password}|" \

deploy/unraid/setup-existing-n8n.sh

@@ -2,7 +2,7 @@
 set -eu
 
 container_name="${1:-n8n}"
-callback_url="${2:-http://192.168.10.150:1236/api/v1/integrations/n8n/return-callback}"
+callback_url="${2:-https://fleetops.itworx.tech/api/v1/integrations/n8n/return-callback}"
 source_workflow="${3:-n8n/workflows/fleet-ops-vehicle-return.json}"
 
 if [ ! -f .env ]; then

deploy/unraid/setup-scheduled-scan.sh

@@ -2,7 +2,7 @@
 set -eu
 
 container_name="${1:-n8n}"
-scan_url="${2:-http://192.168.10.150:1236/api/v1/integrations/n8n/scheduled-scan}"
+scan_url="${2:-https://fleetops.itworx.tech/api/v1/integrations/n8n/scheduled-scan}"
 source_workflow="${3:-n8n/workflows/fleet-ops-data-quality-scan.json}"
 
 if [ ! -f .env ]; then