diff --git a/app-catalog/catalog.json b/app-catalog/catalog.json
index d42cc11d..4688db41 100644
--- a/app-catalog/catalog.json
+++ b/app-catalog/catalog.json
@@ -373,7 +373,7 @@
     {
       "id": "pine",
       "title": "Pine",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.",
       "icon": "/assets/img/app-icons/pine.svg",
       "author": "Archipelago",
diff --git a/apps/pine/manifest.yml b/apps/pine/manifest.yml
index ee0cf4f6..9387384c 100644
--- a/apps/pine/manifest.yml
+++ b/apps/pine/manifest.yml
@@ -1,14 +1,15 @@
 app:
   id: pine
   name: Pine
-  version: "1.0.0"
+  version: "1.1.0"
   description: A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.
   category: home
 
   # The user-facing launcher (app_id + container both "pine", matching the
   # runtime references + the live container so the orchestrator adopts it). A
-  # tiny nginx that serves the setup / status page for the voice stack. The two
-  # Wyoming engines (pine-whisper, pine-piper) are internal stack members.
+  # tiny nginx that serves the "Connect Pine to WiFi" provisioner page for the
+  # voice stack. The two Wyoming engines (pine-whisper, pine-piper) are internal
+  # stack members.
   container_name: pine
 
   container:
@@ -16,6 +17,15 @@ app:
     pull_policy: if-not-present
     network: archy-net
     network_aliases: [pine]
+    # The provisioner uses Web Bluetooth (Improv-over-BLE) to push WiFi creds to
+    # the PineVoice speaker. navigator.bluetooth only exists in a SECURE CONTEXT
+    # (https or localhost), so the launcher terminates TLS with a self-signed
+    # cert — otherwise the "Connect Pine to WiFi" button is inert on the LAN.
+    # Idempotent: kept as-is when crt+key already exist. Mirrors the netbird
+    # secure-context fix (#15).
+    generated_certs:
+      - crt: /var/lib/archipelago/pine/tls.crt
+        key: /var/lib/archipelago/pine/tls.key
 
   dependencies:
     - app_id: pine-whisper
@@ -27,7 +37,7 @@ app:
 
   security:
     # cap-drop=ALL is applied by the orchestrator. nginx (master as root, drops
-    # workers) binds :80 inside the container — needs the worker-drop caps +
+    # workers) binds :443 inside the container — needs the worker-drop caps +
     # NET_BIND_SERVICE for the privileged port.
     capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID, NET_BIND_SERVICE]
     readonly_root: false
@@ -36,10 +46,22 @@ app:
 
   ports:
     - host: 10380
-      container: 80
+      container: 443
       protocol: tcp
 
   volumes:
+    - type: bind
+      source: /var/lib/archipelago/pine/nginx.conf
+      target: /etc/nginx/conf.d/default.conf
+      options: [ro]
+    - type: bind
+      source: /var/lib/archipelago/pine/tls.crt
+      target: /etc/nginx/tls.crt
+      options: [ro]
+    - type: bind
+      source: /var/lib/archipelago/pine/tls.key
+      target: /etc/nginx/tls.key
+      options: [ro]
     - type: bind
       source: /var/lib/archipelago/pine/index.html
       target: /usr/share/nginx/html/index.html
@@ -47,12 +69,19 @@ app:
 
   environment: []
 
-  # The setup / status page, written to the host before create and served
-  # read-only. Web-Bluetooth WiFi provisioning of the speaker only works from a
-  # secure/localhost context (not this LAN page), so the page documents that
-  # flow rather than embedding it — the live provisioner lives in the `pine`
-  # Gitea repo (index.html), run from a laptop on localhost.
   files:
+    - path: /var/lib/archipelago/pine/nginx.conf
+      overwrite: true
+      content: |
+        server {
+            listen 443 ssl;
+            server_name _;
+            ssl_certificate /etc/nginx/tls.crt;
+            ssl_certificate_key /etc/nginx/tls.key;
+            root /usr/share/nginx/html;
+            index index.html;
+            location / { try_files $uri $uri/ /index.html; }
+        }
     - path: /var/lib/archipelago/pine/index.html
       overwrite: true
       content: |
@@ -61,26 +90,42 @@ app:
         <head>
           <meta charset="utf-8">
           <meta name="viewport" content="width=device-width, initial-scale=1">
-          <title>Pine — private voice assistant</title>
+          <title>Pine — connect your speaker</title>
           <style>
             :root { color-scheme: dark; }
-            body { margin: 0; font: 16px/1.6 system-ui, sans-serif;
+            * { box-sizing: border-box; }
+            body { margin: 0; font: 16px/1.6 system-ui, -apple-system, sans-serif;
                    background: #0f1512; color: #e7efe9; }
-            .wrap { max-width: 720px; margin: 0 auto; padding: 40px 24px 80px; }
-            header { display: flex; align-items: center; gap: 16px; margin-bottom: 8px; }
-            header svg { width: 56px; height: 56px; flex: 0 0 auto; }
-            h1 { font-size: 28px; margin: 0; }
+            .wrap { max-width: 520px; margin: 0 auto; padding: 40px 22px 64px; }
+            header { display: flex; align-items: center; gap: 14px; margin-bottom: 6px; }
+            header svg { width: 52px; height: 52px; flex: 0 0 auto; }
+            h1 { font-size: 26px; margin: 0; }
             .tag { color: #8fbfa5; font-size: 14px; margin: 2px 0 0; }
-            h2 { font-size: 18px; margin: 32px 0 8px; color: #b7e0c8; }
-            ol { padding-left: 22px; } li { margin: 6px 0; }
-            code { background: #1c2620; padding: 2px 6px; border-radius: 5px;
-                   font-size: 14px; color: #cfe9d9; }
             .card { background: #16201b; border: 1px solid #24332b;
-                    border-radius: 12px; padding: 16px 20px; margin: 16px 0; }
-            .row { display: flex; gap: 12px; align-items: baseline; }
-            .row b { min-width: 96px; color: #9fd3b6; }
-            a { color: #7fd6a6; }
-            footer { margin-top: 40px; color: #6d8578; font-size: 13px; }
+                    border-radius: 14px; padding: 20px; margin: 20px 0; }
+            .status .row { display: flex; gap: 10px; align-items: baseline; font-size: 14px; }
+            .status .row b { min-width: 84px; color: #9fd3b6; }
+            .status code { background: #0f1512; padding: 1px 6px; border-radius: 5px;
+                           font-size: 13px; color: #cfe9d9; }
+            label { display: block; font-size: 13px; color: #9fbfad; margin: 14px 0 5px; }
+            input { width: 100%; padding: 11px 12px; font-size: 15px; color: #e7efe9;
+                    background: #0f1512; border: 1px solid #2b3d33; border-radius: 9px;
+                    outline: none; }
+            input:focus { border-color: #4fae82; }
+            button { width: 100%; margin-top: 18px; padding: 13px; font-size: 15px;
+                     font-weight: 600; color: #06110b; background: #7fd6a6; border: 0;
+                     border-radius: 10px; cursor: pointer; transition: filter .15s; }
+            button:hover:not(:disabled) { filter: brightness(1.08); }
+            button:disabled { opacity: .45; cursor: default; }
+            #log { margin-top: 16px; padding: 12px; min-height: 68px; font-size: 13px;
+                   font-family: ui-monospace, monospace; white-space: pre-wrap;
+                   background: #0b100d; border: 1px solid #1e2a23; border-radius: 9px;
+                   color: #a9c6b6; max-height: 220px; overflow-y: auto; }
+            .ok { color: #7fd6a6; } .err { color: #ee8f8f; } .warn { color: #e8c878; }
+            .ha { color: #6d8578; font-size: 13px; margin-top: 22px; }
+            .ha b { color: #9fbfad; }
+            .insecure { display: none; background: #2a1f12; border-color: #4a3418;
+                        color: #e8c878; font-size: 13px; }
           </style>
         </head>
         <body>
@@ -92,61 +137,163 @@ app:
                 <path d="M256 150 L360 300 L300 300 L256 236 L212 300 L152 300 Z"/>
                 <path d="M256 262 L392 430 L120 430 L256 262 Z"/>
               </g></svg>
-              <div>
-                <h1>Pine</h1>
-                <p class="tag">A private voice assistant that runs on your node.</p>
-              </div>
+              <div><h1>Pine</h1>
+                <p class="tag">Connect your speaker — everything stays on your node.</p></div>
             </header>
 
-            <p>Pine gives Home Assistant a local voice: your PineVoice speaker
-            hears you, <b>Whisper</b> turns speech into text on this node, and
-            <b>Piper</b> speaks the reply back — nothing leaves your home.</p>
-
-            <div class="card">
-              <div class="row"><b>Whisper (STT)</b><span>listening on
-                <code>host.containers.internal:10300</code></span></div>
-              <div class="row"><b>Piper (TTS)</b><span>listening on
-                <code>host.containers.internal:10200</code></span></div>
-              <div class="row"><b>Speaker</b><span>Wyoming satellite on
-                <code>&lt;speaker-ip&gt;:10700</code></span></div>
+            <div class="card status">
+              <div class="row"><b>Whisper</b><span>speech-to-text ready on <code>:10300</code></span></div>
+              <div class="row"><b>Piper</b><span>text-to-speech ready on <code>:10200</code></span></div>
+              <div class="row"><b>Speaker</b><span>put it in pairing mode — ring LED blinking yellow</span></div>
             </div>
 
-            <h2>1 · Get the speaker on WiFi</h2>
-            <ol>
-              <li>Web-Bluetooth provisioning needs a secure/localhost page, so
-                run the setup tool from the <code>pine</code> repo on a laptop:
-                <code>python3 -m http.server 8377 --bind 127.0.0.1</code>, then
-                open <code>http://localhost:8377</code> in Chrome.</li>
-              <li>Put the speaker in provisioning mode (ring LED blinking
-                yellow), enter your WiFi, and press the centre button when the
-                page asks for authorization.</li>
-              <li>Success: the log shows <code>✓ PROVISIONED</code> and the
-                speaker chimes.</li>
-            </ol>
+            <div class="card insecure" id="insecure">
+              This page isn’t running over HTTPS, so the browser blocks Bluetooth.
+              Open it via its <b>https://…:10380</b> address (accept the self-signed
+              certificate) and the button below will work.
+            </div>
 
-            <h2>2 · Wire it into Home Assistant</h2>
-            <ol>
-              <li>In Home Assistant: <b>Settings → Devices &amp; services</b>.
-                Add the two <b>Wyoming Protocol</b> integrations —
-                <code>host.containers.internal:10300</code> (Whisper) and
-                <code>:10200</code> (Piper).</li>
-              <li>Add the speaker as a third Wyoming device at
-                <code>&lt;speaker-ip&gt;:10700</code>.</li>
-              <li>Build an <b>Assist</b> pipeline: STT = faster-whisper,
-                TTS = Piper, then set it as the speaker's pipeline.</li>
-              <li>Say the wake word (<b>“Hey Jarvis”</b>) or press the speaker's
-                centre button, and talk to your home.</li>
-            </ol>
+            <div class="card">
+              <label for="ssid">WiFi network (SSID)</label>
+              <input id="ssid" autocomplete="off" spellcheck="false" placeholder="Your 2.4 GHz network">
+              <label for="pass">WiFi password — typed here, sent only over Bluetooth to the speaker</label>
+              <input id="pass" type="password" autocomplete="off">
+              <button id="go">Connect Pine to WiFi</button>
+              <div id="log">Ready. Click the button, then pick “PineVoice” in the Bluetooth popup.</div>
+            </div>
 
-            <footer>Pine · Whisper + Piper run locally on this Archipelago node.
-              No cloud, no account.</footer>
+            <p class="ha">After WiFi joins, add the speaker to Home Assistant:
+              <b>Settings → Devices &amp; services → Add Wyoming Protocol</b>, host =
+              the speaker’s IP, port <b>10700</b>, then pick an Assist pipeline using
+              Whisper + Piper. Wake word: <b>“Hey Jarvis.”</b></p>
           </div>
+
+          <script>
+          "use strict";
+          // Improv-over-BLE (improv-wifi spec, verified vs improv-wifi-sdk 1.4.0).
+          const SVC   = "00467768-6228-2272-4663-277478268000";
+          const CHAR_STATE  = "00467768-6228-2272-4663-277478268001";
+          const CHAR_ERROR  = "00467768-6228-2272-4663-277478268002";
+          const CHAR_RPC    = "00467768-6228-2272-4663-277478268003";
+          const CHAR_RESULT = "00467768-6228-2272-4663-277478268004";
+          const STATES = {1:"authorization required",2:"authorized",3:"provisioning…",4:"PROVISIONED"};
+          const ERRORS = {1:"invalid RPC packet",2:"unknown RPC command",
+            3:"unable to connect — wrong password, or the SSID isn't reachable on 2.4 GHz",
+            4:"not authorized — press the button on the device",5:"bad hostname",
+            255:"unknown device error"};
+
+          const logEl = document.getElementById("log");
+          const log = (msg, cls) => { const l = document.createElement("div");
+            if (cls) l.className = cls; l.textContent = msg; logEl.appendChild(l);
+            logEl.scrollTop = logEl.scrollHeight; };
+          const hex = dv => [...new Uint8Array(dv.buffer, dv.byteOffset, dv.byteLength)]
+            .map(b => b.toString(16).padStart(2, "0")).join(" ");
+
+          const btn = document.getElementById("go");
+          if (!navigator.bluetooth) {
+            document.getElementById("insecure").style.display = "block";
+            logEl.textContent = "Web Bluetooth unavailable — open this page over https (see note above).";
+          }
+
+          btn.addEventListener("click", async () => {
+            const ssid = document.getElementById("ssid").value.trim();
+            const pass = document.getElementById("pass").value;
+            if (!ssid) { log("Enter your WiFi network name first.", "err"); return; }
+            if (!navigator.bluetooth) { log("No Web Bluetooth — open this page over https.", "err"); return; }
+            btn.disabled = true; logEl.textContent = "";
+            let device;
+            try {
+              log("Opening Bluetooth device chooser…");
+              device = await navigator.bluetooth.requestDevice({
+                filters: [{ services: [SVC] }, { namePrefix: "PineVoice" }],
+                optionalServices: [SVC],
+              });
+              log(`Selected: ${device.name || "(unnamed)"}`);
+              device.addEventListener("gattserverdisconnected", () => log("BLE disconnected."));
+              log("Connecting…");
+              const gatt = await device.gatt.connect();
+              const svc = await gatt.getPrimaryService(SVC);
+              const stateChar  = await svc.getCharacteristic(CHAR_STATE);
+              const errorChar  = await svc.getCharacteristic(CHAR_ERROR);
+              const rpcChar    = await svc.getCharacteristic(CHAR_RPC);
+              const resultChar = await svc.getCharacteristic(CHAR_RESULT);
+
+              let done, fail;
+              const outcome = new Promise((res, rej) => { done = res; fail = rej; });
+              let authorize; const authorized = new Promise(res => { authorize = res; });
+              let state = -1;
+              const onState = (s, via = "") => {
+                if (s === state) return; state = s;
+                log(`Device state${via}: ${STATES[s] || s}`, s === 4 ? "ok" : undefined);
+                if (s >= 2) authorize();
+                if (s === 4) done(null);
+              };
+              stateChar.addEventListener("characteristicvaluechanged",
+                e => onState(e.target.value.getUint8(0)));
+              errorChar.addEventListener("characteristicvaluechanged", e => {
+                const c = e.target.value.getUint8(0);
+                if (c !== 0) fail(new Error(ERRORS[c] || `error ${c}`)); });
+              resultChar.addEventListener("characteristicvaluechanged", e => {
+                const v = e.target.value; log(`RPC result: ${hex(v)}`);
+                if (v.byteLength > 2 && v.getUint8(1) > 0) {
+                  const n = v.getUint8(2); const b = new Uint8Array(n);
+                  for (let i = 0; i < n; i++) b[i] = v.getUint8(3 + i);
+                  done(new TextDecoder().decode(b)); } });
+              await stateChar.startNotifications();
+              await errorChar.startNotifications();
+              await resultChar.startNotifications();
+              onState((await stateChar.readValue()).getUint8(0));
+
+              const poller = setInterval(async () => {
+                try { onState((await stateChar.readValue()).getUint8(0), " (polled)");
+                  const ec = (await errorChar.readValue()).getUint8(0);
+                  if (ec !== 0) fail(new Error(ERRORS[ec] || `error ${ec}`)); } catch {} }, 2000);
+
+              let nextUrl;
+              try {
+                if (state === 1) {
+                  log("Authorization required — press the centre button on the speaker now.", "warn");
+                  await Promise.race([authorized, outcome,
+                    new Promise((_, rej) => setTimeout(
+                      () => rej(new Error("timed out waiting for the button press")), 60000))]);
+                  log("Authorized.", "ok");
+                }
+                const enc = new TextEncoder();
+                const sb = enc.encode(ssid), pb = enc.encode(pass);
+                const data = new Uint8Array([sb.length, ...sb, pb.length, ...pb]);
+                const pkt = new Uint8Array([1, data.length, ...data, 0]);
+                pkt[pkt.length - 1] = pkt.reduce((s, b) => s + b, 0);
+                log(`Sending WiFi credentials for “${ssid}”…`);
+                if (rpcChar.writeValueWithResponse) await rpcChar.writeValueWithResponse(pkt);
+                else await rpcChar.writeValue(pkt);
+                log("Credentials delivered — speaker acknowledged.", "ok");
+                log("Joining WiFi… (the speaker plays a sound within ~20s either way)");
+                const timeout = new Promise((_, rej) => setTimeout(
+                  () => rej(new Error("timed out after 60s waiting for the device")), 60000));
+                nextUrl = await Promise.race([outcome, timeout]);
+              } finally { clearInterval(poller); }
+
+              log("✓ PROVISIONED — the ring LED should breathe dim magenta.", "ok");
+              if (nextUrl) log(`Device reports next step: ${nextUrl}`, "ok");
+              try { gatt.disconnect(); } catch {}
+            } catch (err) {
+              log(`✗ ${err.name || "Error"}: ${err.message}`, "err");
+              if (err.name === "NotFoundError")
+                log("No speaker matched, or you closed the chooser. LED blinking yellow? "
+                  + "Hold the dot button 15s to reset.", "warn");
+              if (err.name === "NetworkError")
+                log("BLE link dropped — move closer, and make sure the Mac isn't already "
+                  + "paired to the speaker (it can hold the link exclusively).", "warn");
+              try { device?.gatt?.disconnect(); } catch {}
+            } finally { btn.disabled = false; }
+          });
+          </script>
         </body>
         </html>
 
   health_check:
     type: tcp
-    endpoint: localhost:80
+    endpoint: localhost:443
     interval: 30s
     timeout: 5s
     retries: 5
@@ -155,10 +302,10 @@ app:
   interfaces:
     main:
       name: Pine
-      description: Set up and check your private voice assistant
+      description: Connect your speaker to WiFi and check the voice assistant
       type: ui
       port: 10380
-      protocol: http
+      protocol: https
       path: /
 
   metadata:
diff --git a/neode-ui/public/catalog.json b/neode-ui/public/catalog.json
index d42cc11d..4688db41 100644
--- a/neode-ui/public/catalog.json
+++ b/neode-ui/public/catalog.json
@@ -373,7 +373,7 @@
     {
       "id": "pine",
       "title": "Pine",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.",
       "icon": "/assets/img/app-icons/pine.svg",
       "author": "Archipelago",
diff --git a/releases/app-catalog.json b/releases/app-catalog.json
index 4949f2b3..0606434e 100644
--- a/releases/app-catalog.json
+++ b/releases/app-catalog.json
@@ -3845,6 +3845,12 @@
         "app": {
           "category": "home",
           "container": {
+            "generated_certs": [
+              {
+                "crt": "/var/lib/archipelago/pine/tls.crt",
+                "key": "/var/lib/archipelago/pine/tls.key"
+              }
+            ],
             "image": "docker.io/library/nginx:1.27-alpine",
             "network": "archy-net",
             "network_aliases": [
@@ -3868,13 +3874,18 @@
           "environment": [],
           "files": [
             {
-              "content": "<!doctype html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>Pine — private voice assistant</title>\n  <style>\n    :root { color-scheme: dark; }\n    body { margin: 0; font: 16px/1.6 system-ui, sans-serif;\n           background: #0f1512; color: #e7efe9; }\n    .wrap { max-width: 720px; margin: 0 auto; padding: 40px 24px 80px; }\n    header { display: flex; align-items: center; gap: 16px; margin-bottom: 8px; }\n    header svg { width: 56px; height: 56px; flex: 0 0 auto; }\n    h1 { font-size: 28px; margin: 0; }\n    .tag { color: #8fbfa5; font-size: 14px; margin: 2px 0 0; }\n    h2 { font-size: 18px; margin: 32px 0 8px; color: #b7e0c8; }\n    ol { padding-left: 22px; } li { margin: 6px 0; }\n    code { background: #1c2620; padding: 2px 6px; border-radius: 5px;\n           font-size: 14px; color: #cfe9d9; }\n    .card { background: #16201b; border: 1px solid #24332b;\n            border-radius: 12px; padding: 16px 20px; margin: 16px 0; }\n    .row { display: flex; gap: 12px; align-items: baseline; }\n    .row b { min-width: 96px; color: #9fd3b6; }\n    a { color: #7fd6a6; }\n    footer { margin-top: 40px; color: #6d8578; font-size: 13px; }\n  </style>\n</head>\n<body>\n  <div class=\"wrap\">\n    <header>\n      <svg viewBox=\"0 0 512 512\" aria-hidden=\"true\"><g fill=\"#7fd6a6\">\n        <rect x=\"236\" y=\"396\" width=\"40\" height=\"72\" rx=\"6\"/>\n        <path d=\"M256 44 L336 168 L296 168 L256 108 L216 168 L176 168 Z\"/>\n        <path d=\"M256 150 L360 300 L300 300 L256 236 L212 300 L152 300 Z\"/>\n        <path d=\"M256 262 L392 430 L120 430 L256 262 Z\"/>\n      </g></svg>\n      <div>\n        <h1>Pine</h1>\n        <p class=\"tag\">A private voice assistant that runs on your node.</p>\n      </div>\n    </header>\n\n    <p>Pine gives Home Assistant a local voice: your PineVoice speaker\n    hears you, <b>Whisper</b> turns speech into text on this node, and\n    <b>Piper</b> speaks the reply back — nothing leaves your home.</p>\n\n    <div class=\"card\">\n      <div class=\"row\"><b>Whisper (STT)</b><span>listening on\n        <code>host.containers.internal:10300</code></span></div>\n      <div class=\"row\"><b>Piper (TTS)</b><span>listening on\n        <code>host.containers.internal:10200</code></span></div>\n      <div class=\"row\"><b>Speaker</b><span>Wyoming satellite on\n        <code>&lt;speaker-ip&gt;:10700</code></span></div>\n    </div>\n\n    <h2>1 · Get the speaker on WiFi</h2>\n    <ol>\n      <li>Web-Bluetooth provisioning needs a secure/localhost page, so\n        run the setup tool from the <code>pine</code> repo on a laptop:\n        <code>python3 -m http.server 8377 --bind 127.0.0.1</code>, then\n        open <code>http://localhost:8377</code> in Chrome.</li>\n      <li>Put the speaker in provisioning mode (ring LED blinking\n        yellow), enter your WiFi, and press the centre button when the\n        page asks for authorization.</li>\n      <li>Success: the log shows <code>✓ PROVISIONED</code> and the\n        speaker chimes.</li>\n    </ol>\n\n    <h2>2 · Wire it into Home Assistant</h2>\n    <ol>\n      <li>In Home Assistant: <b>Settings → Devices &amp; services</b>.\n        Add the two <b>Wyoming Protocol</b> integrations —\n        <code>host.containers.internal:10300</code> (Whisper) and\n        <code>:10200</code> (Piper).</li>\n      <li>Add the speaker as a third Wyoming device at\n        <code>&lt;speaker-ip&gt;:10700</code>.</li>\n      <li>Build an <b>Assist</b> pipeline: STT = faster-whisper,\n        TTS = Piper, then set it as the speaker's pipeline.</li>\n      <li>Say the wake word (<b>“Hey Jarvis”</b>) or press the speaker's\n        centre button, and talk to your home.</li>\n    </ol>\n\n    <footer>Pine · Whisper + Piper run locally on this Archipelago node.\n      No cloud, no account.</footer>\n  </div>\n</body>\n</html>\n",
+              "content": "server {\n    listen 443 ssl;\n    server_name _;\n    ssl_certificate /etc/nginx/tls.crt;\n    ssl_certificate_key /etc/nginx/tls.key;\n    root /usr/share/nginx/html;\n    index index.html;\n    location / { try_files $uri $uri/ /index.html; }\n}\n",
+              "overwrite": true,
+              "path": "/var/lib/archipelago/pine/nginx.conf"
+            },
+            {
+              "content": "<!doctype html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>Pine — connect your speaker</title>\n  <style>\n    :root { color-scheme: dark; }\n    * { box-sizing: border-box; }\n    body { margin: 0; font: 16px/1.6 system-ui, -apple-system, sans-serif;\n           background: #0f1512; color: #e7efe9; }\n    .wrap { max-width: 520px; margin: 0 auto; padding: 40px 22px 64px; }\n    header { display: flex; align-items: center; gap: 14px; margin-bottom: 6px; }\n    header svg { width: 52px; height: 52px; flex: 0 0 auto; }\n    h1 { font-size: 26px; margin: 0; }\n    .tag { color: #8fbfa5; font-size: 14px; margin: 2px 0 0; }\n    .card { background: #16201b; border: 1px solid #24332b;\n            border-radius: 14px; padding: 20px; margin: 20px 0; }\n    .status .row { display: flex; gap: 10px; align-items: baseline; font-size: 14px; }\n    .status .row b { min-width: 84px; color: #9fd3b6; }\n    .status code { background: #0f1512; padding: 1px 6px; border-radius: 5px;\n                   font-size: 13px; color: #cfe9d9; }\n    label { display: block; font-size: 13px; color: #9fbfad; margin: 14px 0 5px; }\n    input { width: 100%; padding: 11px 12px; font-size: 15px; color: #e7efe9;\n            background: #0f1512; border: 1px solid #2b3d33; border-radius: 9px;\n            outline: none; }\n    input:focus { border-color: #4fae82; }\n    button { width: 100%; margin-top: 18px; padding: 13px; font-size: 15px;\n             font-weight: 600; color: #06110b; background: #7fd6a6; border: 0;\n             border-radius: 10px; cursor: pointer; transition: filter .15s; }\n    button:hover:not(:disabled) { filter: brightness(1.08); }\n    button:disabled { opacity: .45; cursor: default; }\n    #log { margin-top: 16px; padding: 12px; min-height: 68px; font-size: 13px;\n           font-family: ui-monospace, monospace; white-space: pre-wrap;\n           background: #0b100d; border: 1px solid #1e2a23; border-radius: 9px;\n           color: #a9c6b6; max-height: 220px; overflow-y: auto; }\n    .ok { color: #7fd6a6; } .err { color: #ee8f8f; } .warn { color: #e8c878; }\n    .ha { color: #6d8578; font-size: 13px; margin-top: 22px; }\n    .ha b { color: #9fbfad; }\n    .insecure { display: none; background: #2a1f12; border-color: #4a3418;\n                color: #e8c878; font-size: 13px; }\n  </style>\n</head>\n<body>\n  <div class=\"wrap\">\n    <header>\n      <svg viewBox=\"0 0 512 512\" aria-hidden=\"true\"><g fill=\"#7fd6a6\">\n        <rect x=\"236\" y=\"396\" width=\"40\" height=\"72\" rx=\"6\"/>\n        <path d=\"M256 44 L336 168 L296 168 L256 108 L216 168 L176 168 Z\"/>\n        <path d=\"M256 150 L360 300 L300 300 L256 236 L212 300 L152 300 Z\"/>\n        <path d=\"M256 262 L392 430 L120 430 L256 262 Z\"/>\n      </g></svg>\n      <div><h1>Pine</h1>\n        <p class=\"tag\">Connect your speaker — everything stays on your node.</p></div>\n    </header>\n\n    <div class=\"card status\">\n      <div class=\"row\"><b>Whisper</b><span>speech-to-text ready on <code>:10300</code></span></div>\n      <div class=\"row\"><b>Piper</b><span>text-to-speech ready on <code>:10200</code></span></div>\n      <div class=\"row\"><b>Speaker</b><span>put it in pairing mode — ring LED blinking yellow</span></div>\n    </div>\n\n    <div class=\"card insecure\" id=\"insecure\">\n      This page isn’t running over HTTPS, so the browser blocks Bluetooth.\n      Open it via its <b>https://…:10380</b> address (accept the self-signed\n      certificate) and the button below will work.\n    </div>\n\n    <div class=\"card\">\n      <label for=\"ssid\">WiFi network (SSID)</label>\n      <input id=\"ssid\" autocomplete=\"off\" spellcheck=\"false\" placeholder=\"Your 2.4 GHz network\">\n      <label for=\"pass\">WiFi password — typed here, sent only over Bluetooth to the speaker</label>\n      <input id=\"pass\" type=\"password\" autocomplete=\"off\">\n      <button id=\"go\">Connect Pine to WiFi</button>\n      <div id=\"log\">Ready. Click the button, then pick “PineVoice” in the Bluetooth popup.</div>\n    </div>\n\n    <p class=\"ha\">After WiFi joins, add the speaker to Home Assistant:\n      <b>Settings → Devices &amp; services → Add Wyoming Protocol</b>, host =\n      the speaker’s IP, port <b>10700</b>, then pick an Assist pipeline using\n      Whisper + Piper. Wake word: <b>“Hey Jarvis.”</b></p>\n  </div>\n\n  <script>\n  \"use strict\";\n  // Improv-over-BLE (improv-wifi spec, verified vs improv-wifi-sdk 1.4.0).\n  const SVC   = \"00467768-6228-2272-4663-277478268000\";\n  const CHAR_STATE  = \"00467768-6228-2272-4663-277478268001\";\n  const CHAR_ERROR  = \"00467768-6228-2272-4663-277478268002\";\n  const CHAR_RPC    = \"00467768-6228-2272-4663-277478268003\";\n  const CHAR_RESULT = \"00467768-6228-2272-4663-277478268004\";\n  const STATES = {1:\"authorization required\",2:\"authorized\",3:\"provisioning…\",4:\"PROVISIONED\"};\n  const ERRORS = {1:\"invalid RPC packet\",2:\"unknown RPC command\",\n    3:\"unable to connect — wrong password, or the SSID isn't reachable on 2.4 GHz\",\n    4:\"not authorized — press the button on the device\",5:\"bad hostname\",\n    255:\"unknown device error\"};\n\n  const logEl = document.getElementById(\"log\");\n  const log = (msg, cls) => { const l = document.createElement(\"div\");\n    if (cls) l.className = cls; l.textContent = msg; logEl.appendChild(l);\n    logEl.scrollTop = logEl.scrollHeight; };\n  const hex = dv => [...new Uint8Array(dv.buffer, dv.byteOffset, dv.byteLength)]\n    .map(b => b.toString(16).padStart(2, \"0\")).join(\" \");\n\n  const btn = document.getElementById(\"go\");\n  if (!navigator.bluetooth) {\n    document.getElementById(\"insecure\").style.display = \"block\";\n    logEl.textContent = \"Web Bluetooth unavailable — open this page over https (see note above).\";\n  }\n\n  btn.addEventListener(\"click\", async () => {\n    const ssid = document.getElementById(\"ssid\").value.trim();\n    const pass = document.getElementById(\"pass\").value;\n    if (!ssid) { log(\"Enter your WiFi network name first.\", \"err\"); return; }\n    if (!navigator.bluetooth) { log(\"No Web Bluetooth — open this page over https.\", \"err\"); return; }\n    btn.disabled = true; logEl.textContent = \"\";\n    let device;\n    try {\n      log(\"Opening Bluetooth device chooser…\");\n      device = await navigator.bluetooth.requestDevice({\n        filters: [{ services: [SVC] }, { namePrefix: \"PineVoice\" }],\n        optionalServices: [SVC],\n      });\n      log(`Selected: ${device.name || \"(unnamed)\"}`);\n      device.addEventListener(\"gattserverdisconnected\", () => log(\"BLE disconnected.\"));\n      log(\"Connecting…\");\n      const gatt = await device.gatt.connect();\n      const svc = await gatt.getPrimaryService(SVC);\n      const stateChar  = await svc.getCharacteristic(CHAR_STATE);\n      const errorChar  = await svc.getCharacteristic(CHAR_ERROR);\n      const rpcChar    = await svc.getCharacteristic(CHAR_RPC);\n      const resultChar = await svc.getCharacteristic(CHAR_RESULT);\n\n      let done, fail;\n      const outcome = new Promise((res, rej) => { done = res; fail = rej; });\n      let authorize; const authorized = new Promise(res => { authorize = res; });\n      let state = -1;\n      const onState = (s, via = \"\") => {\n        if (s === state) return; state = s;\n        log(`Device state${via}: ${STATES[s] || s}`, s === 4 ? \"ok\" : undefined);\n        if (s >= 2) authorize();\n        if (s === 4) done(null);\n      };\n      stateChar.addEventListener(\"characteristicvaluechanged\",\n        e => onState(e.target.value.getUint8(0)));\n      errorChar.addEventListener(\"characteristicvaluechanged\", e => {\n        const c = e.target.value.getUint8(0);\n        if (c !== 0) fail(new Error(ERRORS[c] || `error ${c}`)); });\n      resultChar.addEventListener(\"characteristicvaluechanged\", e => {\n        const v = e.target.value; log(`RPC result: ${hex(v)}`);\n        if (v.byteLength > 2 && v.getUint8(1) > 0) {\n          const n = v.getUint8(2); const b = new Uint8Array(n);\n          for (let i = 0; i < n; i++) b[i] = v.getUint8(3 + i);\n          done(new TextDecoder().decode(b)); } });\n      await stateChar.startNotifications();\n      await errorChar.startNotifications();\n      await resultChar.startNotifications();\n      onState((await stateChar.readValue()).getUint8(0));\n\n      const poller = setInterval(async () => {\n        try { onState((await stateChar.readValue()).getUint8(0), \" (polled)\");\n          const ec = (await errorChar.readValue()).getUint8(0);\n          if (ec !== 0) fail(new Error(ERRORS[ec] || `error ${ec}`)); } catch {} }, 2000);\n\n      let nextUrl;\n      try {\n        if (state === 1) {\n          log(\"Authorization required — press the centre button on the speaker now.\", \"warn\");\n          await Promise.race([authorized, outcome,\n            new Promise((_, rej) => setTimeout(\n              () => rej(new Error(\"timed out waiting for the button press\")), 60000))]);\n          log(\"Authorized.\", \"ok\");\n        }\n        const enc = new TextEncoder();\n        const sb = enc.encode(ssid), pb = enc.encode(pass);\n        const data = new Uint8Array([sb.length, ...sb, pb.length, ...pb]);\n        const pkt = new Uint8Array([1, data.length, ...data, 0]);\n        pkt[pkt.length - 1] = pkt.reduce((s, b) => s + b, 0);\n        log(`Sending WiFi credentials for “${ssid}”…`);\n        if (rpcChar.writeValueWithResponse) await rpcChar.writeValueWithResponse(pkt);\n        else await rpcChar.writeValue(pkt);\n        log(\"Credentials delivered — speaker acknowledged.\", \"ok\");\n        log(\"Joining WiFi… (the speaker plays a sound within ~20s either way)\");\n        const timeout = new Promise((_, rej) => setTimeout(\n          () => rej(new Error(\"timed out after 60s waiting for the device\")), 60000));\n        nextUrl = await Promise.race([outcome, timeout]);\n      } finally { clearInterval(poller); }\n\n      log(\"✓ PROVISIONED — the ring LED should breathe dim magenta.\", \"ok\");\n      if (nextUrl) log(`Device reports next step: ${nextUrl}`, \"ok\");\n      try { gatt.disconnect(); } catch {}\n    } catch (err) {\n      log(`✗ ${err.name || \"Error\"}: ${err.message}`, \"err\");\n      if (err.name === \"NotFoundError\")\n        log(\"No speaker matched, or you closed the chooser. LED blinking yellow? \"\n          + \"Hold the dot button 15s to reset.\", \"warn\");\n      if (err.name === \"NetworkError\")\n        log(\"BLE link dropped — move closer, and make sure the Mac isn't already \"\n          + \"paired to the speaker (it can hold the link exclusively).\", \"warn\");\n      try { device?.gatt?.disconnect(); } catch {}\n    } finally { btn.disabled = false; }\n  });\n  </script>\n</body>\n</html>\n",
               "overwrite": true,
               "path": "/var/lib/archipelago/pine/index.html"
             }
           ],
           "health_check": {
-            "endpoint": "localhost:80",
+            "endpoint": "localhost:443",
             "interval": "30s",
             "retries": 5,
             "start_period": "10s",
@@ -3884,11 +3895,11 @@
           "id": "pine",
           "interfaces": {
             "main": {
-              "description": "Set up and check your private voice assistant",
+              "description": "Connect your speaker to WiFi and check the voice assistant",
               "name": "Pine",
               "path": "/",
               "port": 10380,
-              "protocol": "http",
+              "protocol": "https",
               "type": "ui"
             }
           },
@@ -3912,7 +3923,7 @@
           "name": "Pine",
           "ports": [
             {
-              "container": 80,
+              "container": 443,
               "host": 10380,
               "protocol": "tcp"
             }
@@ -3932,8 +3943,32 @@
             "no_new_privileges": true,
             "readonly_root": false
           },
-          "version": "1.0.0",
+          "version": "1.1.0",
           "volumes": [
+            {
+              "options": [
+                "ro"
+              ],
+              "source": "/var/lib/archipelago/pine/nginx.conf",
+              "target": "/etc/nginx/conf.d/default.conf",
+              "type": "bind"
+            },
+            {
+              "options": [
+                "ro"
+              ],
+              "source": "/var/lib/archipelago/pine/tls.crt",
+              "target": "/etc/nginx/tls.crt",
+              "type": "bind"
+            },
+            {
+              "options": [
+                "ro"
+              ],
+              "source": "/var/lib/archipelago/pine/tls.key",
+              "target": "/etc/nginx/tls.key",
+              "type": "bind"
+            },
             {
               "options": [
                 "ro"
@@ -3945,7 +3980,7 @@
           ]
         }
       },
-      "version": "1.0.0"
+      "version": "1.1.0"
     },
     "pine-piper": {
       "manifest": {
@@ -4606,7 +4641,7 @@
     }
   },
   "schema": 1,
-  "signature": "42f1f5092e82302f62b7aae5ff3799b3ea91fcf46b499d3f888fe5b86c9d4781277a5d3ff5f7b84516a5cfada529ad07738951d79908a16326fbea9ddbc62d0a",
+  "signature": "ee660b635640c9ac91d203330a7593132842bbd5650883183110f9829dfda417ab172211364860d7dd3f52ada19745850fad66f424a03faf27465cf3ff740301",
   "signed_by": "did:key:z6MkkidEnEpo6qHMCNSZoNKWtvQvxq3whnaME9wGgEFhq7ur",
   "updated": "2026-07-21"
 }