Undo HTTPS changes

Short answer: I don’t have a perfect “memory dump” of the exact edits we made line-by-line, but I do remember the shape of what we did:

• We disabled HTTPS/Caddy+mkcert so everything ran plain HTTP on the LAN.
• We also forced Hugging Face into offline mode, which incidentally breaks anything that needs HF to fetch stuff (models/certs/metadata).
• And we moved/renamed or permission-blocked the cert/key that Caddy was using (ougway.local.pem / ougway.local-key.pem), which gave the permission denied error you saw from systemctl status caddy.

So to “put the HTTPS stuff back in place,” we basically need to undo those three things.

---

1. Put the certs back where Caddy can see them

If we renamed or moved the mkcert files, put them back and fix ownership:

# If we had renamed them to .bak or moved them, adjust as needed:
sudo mv /etc/ssl/caddy/ougway.local.pem.bak /etc/ssl/caddy/ougway.local.pem 2>/dev/null || true
sudo mv /etc/ssl/caddy/ougway.local-key.pem.bak /etc/ssl/caddy/ougway.local-key.pem 2>/dev/null || true

# Make sure Caddy can read them
sudo chown caddy:ssl-cert /etc/ssl/caddy/ougway.local*.pem
sudo chmod 640 /etc/ssl/caddy/ougway.local*.pem

If those files simply don’t exist anymore, we’d recreate them with mkcert roughly like:

cd /etc/ssl/caddy
sudo mkcert ougway.local
# mkcert outputs something like:
#   ougway.local.pem
#   ougway.local-key.pem
sudo chown caddy:ssl-cert ougway.local*.pem
sudo chmod 640 ougway.local*.pem

(Names may vary slightly, but that’s the pattern we used.)

---

2. Restore the HTTPS server block in /etc/caddy/Caddyfile

We had switched from https:// to plain http:// (or commented the TLS bits out) so Caddy would stop trying to do cert stuff.

Open the Caddyfile:

sudo nano /etc/caddy/Caddyfile

Make sure you have something like this again:

ougway.local {
    tls /etc/ssl/caddy/ougway.local.pem /etc/ssl/caddy/ougway.local-key.pem
    reverse_proxy 127.0.0.1:7860
}

Or, if we used Caddy’s internal CA instead of mkcert:

ougway.local {
    tls internal
    reverse_proxy 127.0.0.1:7860
}

Save, then reload:

sudo systemctl daemon-reload
sudo systemctl restart caddy
sudo systemctl status caddy --no-pager -l | tail -n 20

If the status still complains about permission denied on /etc/ssl/caddy/...-key.pem, it’s almost always just ownership/permissions on that directory/file.

---

3. Re-enable Hugging Face network access

When we were trying to keep things fully local, we likely did one (or more) of these:

• Set HF_HUB_OFFLINE=1 somewhere
• Added --offline or similar flags to a launch script
• Possibly added a /etc/hosts entry or firewall rule (less likely, but possible).

3a. Check your shell / service environment

In your user shell:

grep -n "HF_HUB_OFFLINE" ~/.bashrc ~/.profile ~/.bash_profile 2>/dev/null

If you see something like:

export HF_HUB_OFFLINE=1

Delete that line and reload:

sed -i '/HF_HUB_OFFLINE/d' ~/.bashrc
source ~/.bashrc

If we put it in a systemd service for WebUI/HF:

grep -n "HF_HUB_OFFLINE" /etc/systemd/system/*.service 2>/dev/null

Then edit that service file and remove the Environment=HF_HUB_OFFLINE=1 line, followed by:

sudo systemctl daemon-reload
sudo systemctl restart <your-webui-service-name>

3b. Remove --offline style flags

If you’re launching a Hugging Face-using app via a script (e.g. start-webui.sh / launch_hf.sh), open it:

nano ~/Desktop/start-webui.sh   # adjust path/name

Look for flags like:

--offline
--local-only

Remove them, save, and relaunch the app.

3c. Sanity-check /etc/hosts

We might have played with ougway.local or HF endpoints in /etc/hosts:

sudo nano /etc/hosts

You do want something like:

127.0.0.1   ougway.local

You do not want to be black-holing huggingface.co or similar (unless you still intend to):

# BAD if you want HF online:
# 127.0.0.1 huggingface.co

If you see that, comment it out or remove it.

---

4. Bring it all back online in order

Once the pieces are reversed:

1. Ensure HF is allowed online
   – No HF_HUB_OFFLINE=1
   – No --offline in your HF/WebUI launch
   – No /etc/hosts black hole for huggingface.co

2. Start the HF/OpenWebUI side
   – Make sure it’s listening on 127.0.0.1:7860 (or whatever port we used):

bash
ss -tulpn | grep 7860

3. Start Caddy with HTTPS again

bash
sudo systemctl restart caddy
sudo systemctl status caddy --no-pager -l | tail -n 20

4. From your browser on the LAN machine, hit:

text
https://ougway.local

If that all works, we’ve effectively reversed the “turn it all off and go plain HTTP/offline” move.

---

If you want, you can paste your current /etc/caddy/Caddyfile and the contents of /etc/ssl/caddy (just filenames + ls -l, not the key contents), and I’ll adapt the above to your exact state so you don’t have to guess at any of it.