From 3ab3a6a4f41fc232ee123aaacbc0de05b22cd653 Mon Sep 17 00:00:00 2001 From: mivanchenko Date: Sat, 12 Sep 2026 00:12:04 +0200 Subject: [PATCH] Trust Caddy as a proxy in Waitress so forwarded headers reach Flask Root cause of the ICS-link-uses-http bug (#22): Caddy was already sending X-Forwarded-Proto/-Host/-For correctly (confirmed via the Caddy admin API's compiled route config), but Waitress strips untrusted X-Forwarded-* headers by default before they ever reach the WSGI environ -- so the earlier ProxyFix middleware had nothing to read. This was the actual fix; ProxyFix was necessary but not sufficient. Co-Authored-By: Claude Sonnet 5 --- backoffice/app/app.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/backoffice/app/app.py b/backoffice/app/app.py index d71a03b..b34598f 100644 --- a/backoffice/app/app.py +++ b/backoffice/app/app.py @@ -415,4 +415,12 @@ def index(): if __name__ == "__main__": - serve(app, host="0.0.0.0", port=8080) + # Waitress strips X-Forwarded-* by default unless the proxy is declared + # trusted -- without this, ProxyFix upstream never sees them, and every + # url_for(_external=True) link (e.g. the owner's ICS feed, #22) silently + # falls back to "http". Port 8080 is never published to the host, so the + # only thing that can dial us at all is Caddy on the shared `proxy` + # Docker network -- trusting "*" here doesn't widen who can reach us. + serve(app, host="0.0.0.0", port=8080, trusted_proxy="*", + trusted_proxy_headers={"x-forwarded-for", "x-forwarded-proto", "x-forwarded-host"}, + clear_untrusted=True)