fix: derive TLS path from wiki dir for service compatibility

cmd/mind-map/main.go

@@ -394,8 +394,10 @@ func runHTTPServer(addr, dir, webuiDir string, idleTimeout time.Duration, stopCh
 		IdleTimeout:       idleTimeout,
 	}
 
-	// Serve HTTPS if TLS certs are available, otherwise HTTP
-	tlsDir := mindtls.DefaultDir()
+	// Serve HTTPS if TLS certs are available, otherwise HTTP.
+	// Derive TLS dir from the wiki dir (sibling directory) so it works
+	// correctly when running as a system service with a different home.
+	tlsDir := mindtls.DirFromWikiDir(dir)
 	useTLS := mindtls.HasCerts(tlsDir)
 
 	if useTLS {

cmd/mind-map/service.go

@@ -172,7 +172,7 @@ var serviceStartCmd = &cobra.Command{
 		}
 		fmt.Println("Service started.")
 		scheme := "http"
-		if mindtls.HasCerts(mindtls.DefaultDir()) {
+		if mindtls.HasCerts(mindtls.DirFromWikiDir(dir)) {
 			scheme = "https"
 		}
 		fmt.Printf("  Web UI:       %s://%s\n", scheme, addr)

internal/tls/tls.go

@@ -34,6 +34,14 @@ func DefaultDir() string {
 	return filepath.Join(home, ".mind-map", "tls")
 }
 
+// DirFromWikiDir derives the TLS directory from the wiki directory.
+// The wiki dir is typically ~/.mind-map/wiki, so TLS is the sibling
+// ~/.mind-map/tls. This is more reliable than DefaultDir() when
+// running as a system service (where os.UserHomeDir() may differ).
+func DirFromWikiDir(wikiDir string) string {
+	return filepath.Join(filepath.Dir(wikiDir), "tls")
+}
+
 // CertPaths returns the paths to the server cert and key.
 func CertPaths(dir string) (certFile, keyFile string) {
 	return filepath.Join(dir, "server.crt"), filepath.Join(dir, "server.key")