From 4ad87ffaafc11741906864fcf7c0c7eed93d2e33 Mon Sep 17 00:00:00 2001 From: mivanchenko Date: Fri, 11 Sep 2026 23:58:57 +0200 Subject: [PATCH] Trust Caddy's X-Forwarded-Proto so external links use https url_for(_external=True) (e.g. the owner ICS feed link, #22) was always guessing "http" since Flask has no way to know the original request was HTTPS when Caddy proxies to us over plain internal HTTP. Co-Authored-By: Claude Sonnet 5 --- backoffice/app/app.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/backoffice/app/app.py b/backoffice/app/app.py index 017d591..05a3ed6 100644 --- a/backoffice/app/app.py +++ b/backoffice/app/app.py @@ -12,6 +12,7 @@ from decimal import Decimal from flask import Flask, jsonify, request, Response from waitress import serve +from werkzeug.middleware.proxy_fix import ProxyFix import booking_db as bdb import db @@ -24,6 +25,11 @@ from owner_booking import bp as owner_booking_bp from owner_settings import bp as owner_settings_bp app = Flask(__name__, static_folder="static", static_url_path="") +# Caddy terminates TLS and proxies to us over plain HTTP, forwarding +# X-Forwarded-Proto/-Host; without this, url_for(_external=True) (e.g. the +# owner's ICS feed link, #22) always guesses "http" since Flask has no other +# way to know the original request was HTTPS. One hop of proxy (Caddy). +app.wsgi_app = ProxyFix(app.wsgi_app, x_proto=1, x_host=1) app.register_blueprint(booking_bp) app.register_blueprint(public_booking_bp) app.register_blueprint(manage_booking_bp)