From afd4cd741dd95decf384c06e82d100ddfe9e1094 Mon Sep 17 00:00:00 2001 From: matthewberry Date: Thu, 22 Oct 2026 16:56:39 -0500 Subject: [PATCH 1/2] fix: trust forwarded headers from the ingress uvicorn trusts X-Forwarded-* only from 127.0.0.1 by default, so behind Traefik it saw plain http and generated http:// pagination links. Set FORWARDED_ALLOW_IPS to the mmli2 pod network. A network, not "*", so the client address comes from the entry the ingress appended rather than one the client supplied. --- Dockerfile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Dockerfile b/Dockerfile index 90c7efd..47404b3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -32,5 +32,9 @@ RUN uv sync # Expose port EXPOSE 8000 +# Trust X-Forwarded-* from the ingress so generated URLs use https (mmli2 pod network; +# override for other clusters). Not "*", which would take a client-supplied X-Forwarded-For +ENV FORWARDED_ALLOW_IPS="10.42.0.0/16" + # Run uvicorn through uv CMD ["uv", "run", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"] \ No newline at end of file From 53d96b2a2616a1f3125937af8ba0e1d9492341a8 Mon Sep 17 00:00:00 2001 From: matthewberry Date: Thu, 22 Oct 2026 19:18:46 -0500 Subject: [PATCH 2/2] refactor: set FORWARDED_ALLOW_IPS in the chart instead of the image Add a controller.extraEnv passthrough to the deployment template, rendered whether or not existingSecret is set, and set FORWARDED_ALLOW_IPS in values.mmli2.yaml. This keeps the cluster's pod network out of the shared image and gives deployments a way to change it. The comment now says that every pod in the cluster is trusted, not only Traefik. --- Dockerfile | 4 ---- chart/templates/deployment.yaml | 7 +++++++ chart/values.mmli2.yaml | 9 +++++++++ chart/values.yaml | 3 +++ 4 files changed, 19 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 47404b3..90c7efd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -32,9 +32,5 @@ RUN uv sync # Expose port EXPOSE 8000 -# Trust X-Forwarded-* from the ingress so generated URLs use https (mmli2 pod network; -# override for other clusters). Not "*", which would take a client-supplied X-Forwarded-For -ENV FORWARDED_ALLOW_IPS="10.42.0.0/16" - # Run uvicorn through uv CMD ["uv", "run", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"] \ No newline at end of file diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml index b7880e3..9e9f2ed 100644 --- a/chart/templates/deployment.yaml +++ b/chart/templates/deployment.yaml @@ -27,6 +27,10 @@ spec: envFrom: - secretRef: name: {{ .Values.config.existingSecret }} +{{- with .Values.controller.extraEnv }} + env: + {{- toYaml . | nindent 12 }} +{{- end }} {{- else }} # Use hardcoded plaintext values (less secure) env: @@ -40,4 +44,7 @@ spec: value: {{ .Values.config.CLEAN_DB_PORT }} - name: CLEAN_DB_NAME value: {{ .Values.config.CLEAN_DB_NAME }} +{{- with .Values.controller.extraEnv }} + {{- toYaml . | nindent 12 }} +{{- end }} {{- end }} diff --git a/chart/values.mmli2.yaml b/chart/values.mmli2.yaml index 80d20a1..c5f1236 100644 --- a/chart/values.mmli2.yaml +++ b/chart/values.mmli2.yaml @@ -29,6 +29,15 @@ controller: pullPolicy: Always #pullSecrets: [] + # Additional environment variables for the container, as a list of {name, value} + extraEnv: + # Trust X-Forwarded-* from the ingress so generated URLs use https and logs show client + # addresses. 10.42.0.0/16 is this cluster's pod network, so every pod in the cluster is + # trusted, not only Traefik; outside clients can't spoof their address. Not "*", which + # would log the first X-Forwarded-For entry, one an outside client can set. + - name: FORWARDED_ALLOW_IPS + value: "10.42.0.0/16" + # TODO: parameterize labels, tolerations, nodeSelector, resources, etc? diff --git a/chart/values.yaml b/chart/values.yaml index fb1d28c..5d0d17b 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -29,6 +29,9 @@ controller: pullPolicy: Always #pullSecrets: [] + # Additional environment variables for the container, as a list of {name, value} + extraEnv: [] + # TODO: parameterize labels, tolerations, nodeSelector, resources, etc?