docs(01-04): complete HTTPS and backup plan

Tasks completed: 2/2
- Task 1: Configure Caddy reverse proxy with HTTPS
- Task 2: Create PostgreSQL backup script with retention

SUMMARY: .planning/phases/01-core-infrastructure-security/01-04-SUMMARY.md

.planning/STATE.md

@@ -10,28 +10,28 @@ See: .planning/PROJECT.md (updated 2026-01-25)
 ## Current Position
 
 Phase: 1 of 9 (Core Infrastructure & Security)
-Plan: 2 of 5 in current phase
+Plan: 4 of 5 in current phase
 Status: In progress
-Last activity: 2026-01-25 - Completed 01-02-PLAN.md
+Last activity: 2026-01-25 - Completed 01-04-PLAN.md
 
-Progress: [██░░░░░░░░] 4%
+Progress: [████░░░░░░] 9%
 
 ## Performance Metrics
 
 **Velocity:**
-- Total plans completed: 2
+- Total plans completed: 3
-- Average duration: 4.5 min
+- Average duration: 4 min
-- Total execution time: 9 min
+- Total execution time: 12 min
 
 **By Phase:**
 
 | Phase | Plans | Total | Avg/Plan |
 |-------|-------|-------|----------|
-| 01 | 2 | 9 min | 4.5 min |
+| 01 | 3 | 12 min | 4 min |
 
 **Recent Trend:**
-- Last 5 plans: 01-01 (3 min), 01-02 (6 min)
+- Last 5 plans: 01-01 (3 min), 01-02 (6 min), 01-04 (3 min)
-- Trend: N/A (not enough data)
+- Trend: Stable
 
 *Updated after each plan completion*
 
@@ -47,6 +47,9 @@ Recent decisions affecting current work:
 - [01-01]: Created root /health endpoint outside versioned API for simple health checks
 - [01-02]: Port 5433 for PostgreSQL (5432 in use by another container)
 - [01-02]: Connection pool settings from research: pool_size=10, max_overflow=20, pool_recycle=1800
+- [01-04]: Self-signed TLS (tls internal) for local development; production uses domain + Let's Encrypt
+- [01-04]: Host network mode for Caddy to reach localhost:8000
+- [01-04]: Daily backups at 2 AM with 30-day retention, weekly restore test on Mondays
 
 ### Pending Todos
 
@@ -66,6 +69,6 @@ None yet.
 
 ## Session Continuity
 
-Last session: 2026-01-25T20:12:01Z
+Last session: 2026-01-25T20:20:00Z
-Stopped at: Completed 01-02-PLAN.md
+Stopped at: Completed 01-04-PLAN.md
 Resume file: None

.planning/phases/01-core-infrastructure-security/01-04-SUMMARY.md

@@ -0,0 +1,126 @@
+---
+phase: 01-core-infrastructure-security
+plan: 04
+subsystem: infra
+tags: [caddy, https, tls, postgres, backup, cron, security]
+
+# Dependency graph
+requires:
+  - phase: 01-02
+    provides: PostgreSQL database container for backup
+provides:
+  - Caddy reverse proxy with automatic HTTPS
+  - HTTP to HTTPS redirect
+  - Security headers (HSTS, X-Content-Type-Options, X-Frame-Options)
+  - PostgreSQL backup script with 30-day retention
+  - Weekly backup restore test automation
+affects: [production-deployment, disaster-recovery]
+
+# Tech tracking
+tech-stack:
+  added: [caddy:2-alpine]
+  patterns: [reverse-proxy, tls-termination, database-backup]
+
+key-files:
+  created:
+    - Caddyfile
+    - scripts/backup-postgres.sh
+    - scripts/cron/postgres-backup
+    - .gitignore
+  modified:
+    - docker-compose.yml
+
+key-decisions:
+  - "Self-signed TLS (tls internal) for local development"
+  - "Host network mode for Caddy to reach localhost:8000"
+  - "Daily backups at 2 AM with 30-day retention"
+  - "Weekly restore test on Mondays for backup validation"
+  - "pg_dump custom format (-Fc) for selective restore capability"
+
+patterns-established:
+  - "Caddy as reverse proxy: All HTTPS termination at Caddy layer"
+  - "Database backup: Docker exec pg_dump to host filesystem"
+  - "Backup verification: pg_restore --list to validate archive integrity"
+
+# Metrics
+duration: 3min
+completed: 2026-01-25
+---
+
+# Phase 1 Plan 4: HTTPS and Backup Summary
+
+**Caddy reverse proxy with self-signed TLS for development, PostgreSQL daily backups with 30-day retention and weekly restore testing**
+
+## Performance
+
+- **Duration:** 3 min
+- **Started:** 2026-01-25T20:17:00Z
+- **Completed:** 2026-01-25T20:20:00Z
+- **Tasks:** 2
+- **Files modified:** 5
+
+## Accomplishments
+
+- Caddy reverse proxy with HTTPS termination and automatic HTTP redirect
+- Security headers configured (HSTS, X-Content-Type-Options, X-Frame-Options)
+- PostgreSQL backup script with integrity verification
+- 30-day backup retention with automatic cleanup
+- Weekly restore test to validate backup usability
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Configure Caddy reverse proxy with HTTPS** - `3c09e27` (feat)
+2. **Task 2: Create PostgreSQL backup script with retention** - `09f8961` (feat)
+
+## Files Created/Modified
+
+- `Caddyfile` - Caddy configuration with TLS, reverse proxy, and security headers
+- `docker-compose.yml` - Added Caddy service with host networking
+- `scripts/backup-postgres.sh` - Daily backup script with verification and retention
+- `scripts/cron/postgres-backup` - Cron configuration for 2 AM daily backups
+- `.gitignore` - Excludes pycache, env files, backup files
+
+## Decisions Made
+
+- **Self-signed TLS for development:** Used `tls internal` for local development; production will replace `:443` with actual domain and remove this directive
+- **Host network mode:** Caddy uses `network_mode: host` to reach FastAPI on localhost:8000
+- **Backup at 2 AM:** Low-traffic time for backup operations
+- **30-day retention:** Balanced between storage efficiency and recovery options
+- **Weekly restore test on Mondays:** Validates backups are actually restorable, not just created
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] Fixed pg_restore verification to run in container**
+- **Found during:** Task 2 (Backup script creation)
+- **Issue:** Plan used host pg_restore for verification, but pg_restore only exists in container
+- **Fix:** Changed verification to pipe backup into container via `docker exec -i`
+- **Files modified:** scripts/backup-postgres.sh
+- **Verification:** Backup script completes successfully with verification
+- **Committed in:** 09f8961 (Task 2 commit)
+
+---
+
+**Total deviations:** 1 auto-fixed (1 blocking)
+**Impact on plan:** Essential fix for backup verification to work. No scope creep.
+
+## Issues Encountered
+
+- Backend not running during HTTPS verification - expected behavior, Caddy correctly configured to proxy when backend is available
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+
+- HTTPS termination ready for production (replace domain and remove `tls internal`)
+- Backup script ready for cron installation (copy to /etc/cron.d/)
+- Caddy admin API exposed on localhost:2019 for future dynamic route management
+
+---
+*Phase: 01-core-infrastructure-security*
+*Completed: 2026-01-25*