lattice-install serves the console on 443. The installer writes a self-signed server.crt / server.key under /etc/lattice/tls/. The browser will warn until you replace those with your org CA, Let’s Encrypt, or a cert you buy — LatticeDDI does not sell certificates.
HTTP :8080 is the API process on the box itself. Reach the UI over HTTPS, not that port from another host.
Paid HA terminates TLS on the VIP (haproxy.pem).
Postgres DSN: sslmode=require (or verify-full).