configure Bun CA trust for local embeddings

servers/unraid/supermemory-poc/README.md

@@ -36,7 +36,9 @@ The `supermemory-fetch` init service downloads the exact release asset once,
 checks its SHA-256, and stores it in the POC appdata directory. Subsequent
 starts only verify the existing binary. It also copies the CA bundle from the
 pinned fetch image so the slim runtime can download local embedding model
-artifacts over verified HTTPS. No custom image build is required.
+artifacts over verified HTTPS. Both OpenSSL-style clients and the bundled Bun
+runtime are pointed at that bundle; TLS verification remains enabled. No
+custom image build is required.
 
 ## First boot and authentication
 

servers/unraid/supermemory-poc/compose.yaml

@@ -62,6 +62,7 @@ services:
       SUPERMEMORY_EMBEDDING_RAM_LIMIT: 2gb
       SUPERMEMORY_INGEST_CONCURRENCY: "1"
       SSL_CERT_FILE: /opt/supermemory/bin/ca-certificates.crt
+      NODE_EXTRA_CA_CERTS: /opt/supermemory/bin/ca-certificates.crt
       OPENAI_API_KEY: ${OPENAI_API_KEY:?set OPENAI_API_KEY in Arcane environment}
       OPENAI_BASE_URL: ${OPENAI_BASE_URL:-}
       OPENAI_MODEL: ${OPENAI_MODEL:-gpt-5.1}