Trust Caddy as a proxy in Waitress so forwarded headers reach Flask

Root cause of the ICS-link-uses-http bug (#22): Caddy was already sending X-Forwarded-Proto/-Host/-For correctly (confirmed via the Caddy admin API's compiled route config), but Waitress strips untrusted X-Forwarded-* headers by default before they ever reach the WSGI environ -- so the earlier ProxyFix middleware had nothing to read. This was the actual fix; ProxyFix was necessary but not sufficient. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-12 00:12:04 +02:00
parent 55bb2ce65f
commit 3ab3a6a4f4
1 changed files with 9 additions and 1 deletions
@@ -415,4 +415,12 @@ def index():


 if __name__ == "__main__":
-    serve(app, host="0.0.0.0", port=8080)
+    # Waitress strips X-Forwarded-* by default unless the proxy is declared
+    # trusted -- without this, ProxyFix upstream never sees them, and every
+    # url_for(_external=True) link (e.g. the owner's ICS feed, #22) silently
+    # falls back to "http". Port 8080 is never published to the host, so the
+    # only thing that can dial us at all is Caddy on the shared `proxy`
+    # Docker network -- trusting "*" here doesn't widen who can reach us.
+    serve(app, host="0.0.0.0", port=8080, trusted_proxy="*",
+          trusted_proxy_headers={"x-forwarded-for", "x-forwarded-proto", "x-forwarded-host"},
+          clear_untrusted=True)