v0.9.51-alpha — Bring-your-own TLS certificate + cleaner service removal

Bring your own TLS certificate

You can now use your own TLS certificate instead of Let's Encrypt. When you set up your domain — or later on the Caddy page — choose Custom certificate and upload your full-chain PEM + private key. It's applied to every subdomain and to TAK Server's enrollment endpoint (8446), so infra-TAK works behind a corporate gateway/WAF, on government domains, or anywhere automatic (ACME) certificates can't be issued. In custom mode the box never even attempts Let's Encrypt.

• Validated before it's applied — the key must match the certificate, it must not be expired, and it must cover your hostnames. Bad uploads are rejected with a clear reason; nothing breaks.
• Choose at first deploy or switch anytime — pick Automatic vs Custom right on the domain-setup screen, or toggle later. Caddy reloads with no downtime, and there's a one-click switch back to automatic.
• Renewal is a manual re-upload; the certificate-expiry indicator and Guard Dog alert keep watching the date.

Tip: use a wildcard (e.g. *.yourdomain.com) so one certificate covers all the service subdomains.

Cleaner service removal

Uninstalling a service (MediaMTX, TAK Video Restreamer, Node-RED) now removes it cleanly from Authentik instead of leaving a dead application/provider behind. Any box that already had a leftover is tidied up automatically on the next restart. The TAK Video Restreamer "update available" check is also now reliable.

Upgrade

Applied automatically on update — no action required.