mount CA bundle at Debian trust path

servers/unraid/supermemory-poc/README.md

@@ -37,8 +37,9 @@ checks its SHA-256, and stores it in the POC appdata directory. Subsequent
 starts only verify the existing binary. It also copies the CA bundle from the
 pinned fetch image so the slim runtime can download local embedding model
 artifacts over verified HTTPS. Both OpenSSL-style clients and the bundled Bun
-runtime are pointed at that bundle; TLS verification remains enabled. No
+runtime are pointed at that bundle, which is also mounted at Debian's standard
-custom image build is required.
+CA path for embedding workers. TLS verification remains enabled. No custom
+image build is required.
 
 ## First boot and authentication
 

servers/unraid/supermemory-poc/compose.yaml

@@ -62,6 +62,7 @@ services:
       SUPERMEMORY_EMBEDDING_RAM_LIMIT: 2gb
       SUPERMEMORY_INGEST_CONCURRENCY: "1"
       SSL_CERT_FILE: /opt/supermemory/bin/ca-certificates.crt
+      SSL_CERT_DIR: /etc/ssl/certs
       NODE_EXTRA_CA_CERTS: /opt/supermemory/bin/ca-certificates.crt
       OPENAI_API_KEY: ${OPENAI_API_KEY:?set OPENAI_API_KEY in Arcane environment}
       OPENAI_BASE_URL: ${OPENAI_BASE_URL:-}
@@ -84,6 +85,7 @@ services:
     cpus: 4
     volumes:
       - /mnt/user/appdata/supermemory-poc/bin:/opt/supermemory/bin:ro
+      - /mnt/user/appdata/supermemory-poc/bin/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
       - /mnt/user/appdata/supermemory-poc/data:/var/lib/supermemory
     networks:
       br0: