make certs # if needed
make secure
curl -skf https://127.0.0.1:8443/readyz
Console: https://127.0.0.1:8443/ (self-signed). curl -k is expected.
Overlay sets LATTICE_TRUSTED_RELAYS to RFC1918 + loopback. Plain make up stays HTTP on 8080 for soaks.
Production: real certificates at the load balancer, sslmode=verify-full on the DSN.