provide CA bundle to Supermemory runtime

servers/unraid/supermemory-poc/README.md

@@ -34,7 +34,9 @@ directory and re-ingest when comparing a different embedding plan.
 
 The `supermemory-fetch` init service downloads the exact release asset once,
 checks its SHA-256, and stores it in the POC appdata directory. Subsequent
-starts only verify the existing binary. No custom image build is required.
+starts only verify the existing binary. It also copies the CA bundle from the
+pinned fetch image so the slim runtime can download local embedding model
+artifacts over verified HTTPS. No custom image build is required.
 
 ## First boot and authentication
 

servers/unraid/supermemory-poc/compose.yaml

@@ -13,8 +13,18 @@ services:
     command:
       - |
         target=/opt/supermemory/bin/supermemory-server
+        ca_target=/opt/supermemory/bin/ca-certificates.crt
         checksum="$${SUPERMEMORY_BINARY_SHA256}  $${target}"
         mkdir -p /opt/supermemory/bin
+        if [ -f /cacert.pem ]; then
+          cp /cacert.pem "$${ca_target}"
+        elif [ -f /etc/ssl/certs/ca-certificates.crt ]; then
+          cp /etc/ssl/certs/ca-certificates.crt "$${ca_target}"
+        else
+          echo "curl image CA bundle not found" >&2
+          exit 1
+        fi
+        chmod 0644 "$${ca_target}"
         if [ -f "$${target}" ] && echo "$${checksum}" | sha256sum -c - >/dev/null 2>&1; then
           exit 0
         fi
@@ -51,6 +61,7 @@ services:
       SUPERMEMORY_LOCAL_EMBEDDING_BATCH_SIZE: "4"
       SUPERMEMORY_EMBEDDING_RAM_LIMIT: 2gb
       SUPERMEMORY_INGEST_CONCURRENCY: "1"
+      SSL_CERT_FILE: /opt/supermemory/bin/ca-certificates.crt
       OPENAI_API_KEY: ${OPENAI_API_KEY:?set OPENAI_API_KEY in Arcane environment}
       OPENAI_BASE_URL: ${OPENAI_BASE_URL:-}
       OPENAI_MODEL: ${OPENAI_MODEL:-gpt-5.1}