From 1616d55ae4ea4ec4808b70cd5217061a9a765ddd Mon Sep 17 00:00:00 2001 From: matthewberry Date: Wed, 4 Nov 2026 10:41:40 -0600 Subject: [PATCH 1/2] fix: trust traefik's X-Forwarded-Proto so pagination links use https TLS ends at traefik, so the app sees plain http and builds next/previous links starting http://. uvicorn already reads X-Forwarded-Proto, but only from 127.0.0.1; traefik connects from a pod IP. Set FORWARDED_ALLOW_IPS to the cluster's pod network. --- chart/templates/deployment.yaml | 8 ++++++-- chart/values.yaml | 5 +++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml index 7f3014d..cf26fbd 100644 --- a/chart/templates/deployment.yaml +++ b/chart/templates/deployment.yaml @@ -31,9 +31,13 @@ spec: envFrom: - secretRef: name: {{ .Values.config.existingSecret }} -{{- else }} - # Use hardcoded plaintext values (less secure) +{{- end }} env: + # Proxies uvicorn takes X-Forwarded-Proto from, so links it builds use https + - name: FORWARDED_ALLOW_IPS + value: {{ .Values.controller.forwardedAllowIps | quote }} +{{- if not .Values.config.existingSecret }} + # Use hardcoded plaintext values (less secure) - name: OED_DB_USER value: {{ .Values.config.OED_DB_USER }} - name: OED_DB_PASSWORD diff --git a/chart/values.yaml b/chart/values.yaml index 37c0603..3b25193 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -38,6 +38,11 @@ controller: limits: memory: 1Gi + # Sources trusted for X-Forwarded-* headers. TLS ends at traefik, so without this the + # app sees plain http and its pagination links say http://. The cluster's pod network + # (every node's podCIDR is inside 10.42.0.0/16), where traefik's pods run. + forwardedAllowIps: "10.42.0.0/16" + # TODO: parameterize labels, tolerations, nodeSelector, etc? From d1a200b414498569d8f338e6a3fafc46c3b73bf3 Mon Sep 17 00:00:00 2001 From: matthewberry Date: Wed, 4 Nov 2026 10:46:20 -0600 Subject: [PATCH 2/2] refactor: set FORWARDED_ALLOW_IPS through a general extraEnv list Same chart shape as CLEANDB-api#28, so the two APIs configure this the same way. --- chart/templates/deployment.yaml | 13 ++++++++----- chart/values.yaml | 12 ++++++++---- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml index cf26fbd..9e41384 100644 --- a/chart/templates/deployment.yaml +++ b/chart/templates/deployment.yaml @@ -31,13 +31,13 @@ spec: envFrom: - secretRef: name: {{ .Values.config.existingSecret }} +{{- with .Values.controller.extraEnv }} + env: + {{- toYaml . | nindent 12 }} {{- end }} +{{- else }} + # Use hardcoded plaintext values (less secure) env: - # Proxies uvicorn takes X-Forwarded-Proto from, so links it builds use https - - name: FORWARDED_ALLOW_IPS - value: {{ .Values.controller.forwardedAllowIps | quote }} -{{- if not .Values.config.existingSecret }} - # Use hardcoded plaintext values (less secure) - name: OED_DB_USER value: {{ .Values.config.OED_DB_USER }} - name: OED_DB_PASSWORD @@ -48,4 +48,7 @@ spec: value: {{ .Values.config.OED_DB_PORT }} - name: OED_DB_NAME value: {{ .Values.config.OED_DB_NAME }} +{{- with .Values.controller.extraEnv }} + {{- toYaml . | nindent 12 }} +{{- end }} {{- end }} diff --git a/chart/values.yaml b/chart/values.yaml index 3b25193..4c50cb4 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -38,10 +38,14 @@ controller: limits: memory: 1Gi - # Sources trusted for X-Forwarded-* headers. TLS ends at traefik, so without this the - # app sees plain http and its pagination links say http://. The cluster's pod network - # (every node's podCIDR is inside 10.42.0.0/16), where traefik's pods run. - forwardedAllowIps: "10.42.0.0/16" + # Additional environment variables for the container, as a list of {name, value} + extraEnv: + # Trust X-Forwarded-* from the ingress so generated URLs use https and logs show client + # addresses. 10.42.0.0/16 is this cluster's pod network, so every pod in the cluster is + # trusted, not only Traefik; outside clients can't spoof their address. Not "*", which + # would log the first X-Forwarded-For entry, one an outside client can set. + - name: FORWARDED_ALLOW_IPS + value: "10.42.0.0/16" # TODO: parameterize labels, tolerations, nodeSelector, etc?