neiam /diogramos

diogramos

gogo

39209b7 · gmorell · 2026-04-28 00:00

6 files +38 -12

modified config/prod.exs

+11 −11

@@ -7,17 +7,17 @@ import Config

7	7	# before starting your production server.
8	8	config :diogramos, DiogramosWeb.Endpoint, cache_static_manifest: "priv/static/cache_manifest.json"
9	9
10		−# Force using SSL in production. This also sets the "strict-security-transport" header,
11		−# known as HSTS. If you have a health check endpoint, you may want to exclude it below.
12		−# Note `:force_ssl` is required to be set at compile-time.
13		−config :diogramos, DiogramosWeb.Endpoint,
14		− force_ssl: [
15		− rewrite_on: [:x_forwarded_proto],
16		− exclude: [
17		− # paths: ["/health"],
18		− hosts: ["localhost", "127.0.0.1"]
19		− ]
20		− ]
	10	+# TLS termination + the http → https redirect happen at the Traefik
	11	+# ingress, so Phoenix doesn't run `force_ssl` itself. Leaving it on
	12	+# behind a proxy that doesn't reliably forward `X-Forwarded-Proto`
	13	+# breaks the LiveView WebSocket: Plug.SSL sees the upgrade as plain
	14	+# HTTP, returns a 301, and the browser drops the connection.
	15	+#
	16	+# If you ever serve directly without a TLS-terminating proxy, re-enable
	17	+# this block:
	18	+#
	19	+# config :diogramos, DiogramosWeb.Endpoint,
	20	+# force_ssl: [rewrite_on: [:x_forwarded_proto]]
21	21
22	22	# Configure Swoosh API Client
23	23	config :swoosh, api_client: Swoosh.ApiClient.Req

modified config/runtime.exs

+23 −0

@@ -83,6 +83,29 @@ if config_env() == :prod do

83	83	environment_name: :prod,
84	84	release: System.get_env("APP_VERSION") \|\| System.get_env("CI_COMMIT_SHA")
85	85
	86	+ # Mailer adapter selection:
	87	+ #
	88	+ # * MAILGUN_API_KEY + MAILGUN_DOMAIN → Swoosh.Adapters.Mailgun
	89	+ # * otherwise → Swoosh.Adapters.Logger
	90	+ #
	91	+ # The Logger adapter doesn't actually send mail — it logs the
	92	+ # rendered email at :info — but it gets us off Swoosh.Adapters.Local,
	93	+ # which is what the login page checks for to show the dev-mailbox
	94	+ # banner. Wire up a real provider when you're ready to receive
	95	+ # confirmation links again.
	96	+ mailer_opts =
	97	+ if System.get_env("MAILGUN_API_KEY") && System.get_env("MAILGUN_DOMAIN") do
	98	+ [
	99	+ adapter: Swoosh.Adapters.Mailgun,
	100	+ api_key: System.get_env("MAILGUN_API_KEY"),
	101	+ domain: System.get_env("MAILGUN_DOMAIN")
	102	+ ]
	103	+ else
	104	+ [adapter: Swoosh.Adapters.Logger, level: :info]
	105	+ end
	106	+
	107	+ config :diogramos, Diogramos.Mailer, mailer_opts
	108	+
86	109	config :diogramos, DiogramosWeb.Endpoint,
87	110	url: [host: host, port: 443, scheme: "https"],
88	111	# Accept both http and https origins for the configured host. The

modified lib/diogramos_web/endpoint.ex

+4 −1

@@ -5,9 +5,12 @@ defmodule DiogramosWeb.Endpoint do

5	5	# The session will be stored in the cookie and signed,
6	6	# this means its contents can be read but not tampered with.
7	7	# Set :encryption_salt if you would also like to encrypt it.
	8	+ # Bump the `key` (or `signing_salt`) to silently invalidate every
	9	+ # cookie minted by an earlier deploy — useful after rotating
	10	+ # secret_key_base or moving from dev → prod.
8	11	@session_options [
9	12	store: :cookie,
10		− key: "_diogramos_key",
	13	+ key: "_diogramos_key_v2",
11	14	signing_salt: "dapkIR0G",
12	15	same_site: "Lax"
13	16	]

Parents: 03a17f0