From aaf72f82f6c9702c131daced2ced5a1d8b3bfc17 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Mon, 7 Sep 2026 22:07:50 -0700
Subject: [PATCH] mount CA bundle at Debian trust path

---
 servers/unraid/supermemory-poc/README.md    | 5 +++--
 servers/unraid/supermemory-poc/compose.yaml | 2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/servers/unraid/supermemory-poc/README.md b/servers/unraid/supermemory-poc/README.md
index 82f7eca..1205f8a 100644
--- a/servers/unraid/supermemory-poc/README.md
+++ b/servers/unraid/supermemory-poc/README.md
@@ -37,8 +37,9 @@ checks its SHA-256, and stores it in the POC appdata directory. Subsequent
 starts only verify the existing binary. It also copies the CA bundle from the
 pinned fetch image so the slim runtime can download local embedding model
 artifacts over verified HTTPS. Both OpenSSL-style clients and the bundled Bun
-runtime are pointed at that bundle; TLS verification remains enabled. No
-custom image build is required.
+runtime are pointed at that bundle, which is also mounted at Debian's standard
+CA path for embedding workers. TLS verification remains enabled. No custom
+image build is required.
 
 ## First boot and authentication
 
diff --git a/servers/unraid/supermemory-poc/compose.yaml b/servers/unraid/supermemory-poc/compose.yaml
index 36d244c..0626e08 100644
--- a/servers/unraid/supermemory-poc/compose.yaml
+++ b/servers/unraid/supermemory-poc/compose.yaml
@@ -62,6 +62,7 @@ services:
       SUPERMEMORY_EMBEDDING_RAM_LIMIT: 2gb
       SUPERMEMORY_INGEST_CONCURRENCY: "1"
       SSL_CERT_FILE: /opt/supermemory/bin/ca-certificates.crt
+      SSL_CERT_DIR: /etc/ssl/certs
       NODE_EXTRA_CA_CERTS: /opt/supermemory/bin/ca-certificates.crt
       OPENAI_API_KEY: ${OPENAI_API_KEY:?set OPENAI_API_KEY in Arcane environment}
       OPENAI_BASE_URL: ${OPENAI_BASE_URL:-}
@@ -84,6 +85,7 @@ services:
     cpus: 4
     volumes:
       - /mnt/user/appdata/supermemory-poc/bin:/opt/supermemory/bin:ro
+      - /mnt/user/appdata/supermemory-poc/bin/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
       - /mnt/user/appdata/supermemory-poc/data:/var/lib/supermemory
     networks:
       br0: