neiam /oh-my-ex-oh-ircd

fix force_ssl for pings

414662c · gmorell · 2026-06-10 21:26

2 files +13 -11

modified config/prod.exs

+13 −11

@@ -8,17 +8,19 @@ import Config

8	8	config :oh_my_ex_oh_ircd, OhMyExOhIrcdWeb.Endpoint,
9	9	cache_static_manifest: "priv/static/cache_manifest.json"
10	10
11		−# Force using SSL in production. This also sets the "strict-security-transport" header,
12		−# known as HSTS. If you have a health check endpoint, you may want to exclude it below.
13		−# Note `:force_ssl` is required to be set at compile-time.
14		−config :oh_my_ex_oh_ircd, OhMyExOhIrcdWeb.Endpoint,
15		− force_ssl: [
16		− rewrite_on: [:x_forwarded_proto],
17		− exclude: [
18		− # paths: ["/health"],
19		− hosts: ["localhost", "127.0.0.1"]
20		− ]
21		− ]
	11	+# TLS termination + the http → https redirect happen at the Traefik
	12	+# ingress, so Phoenix doesn't run `force_ssl` itself. Leaving it on
	13	+# behind a proxy that doesn't reliably forward `X-Forwarded-Proto`
	14	+# breaks the LiveView WebSocket: Plug.SSL sees the upgrade as plain
	15	+# HTTP, returns a 301, and the browser drops the connection.
	16	+#
	17	+# In the :standalone build site_encrypt terminates TLS in-pod, but that
	18	+# path serves https directly (no x_forwarded_proto to rewrite on), so
	19	+# force_ssl isn't needed there either. If you ever front this with a
	20	+# proxy that does reliably forward the header, re-enable:
	21	+#
	22	+# config :oh_my_ex_oh_ircd, OhMyExOhIrcdWeb.Endpoint,
	23	+# force_ssl: [rewrite_on: [:x_forwarded_proto]]
22	24
23	25	# Configure Swoosh API Client
24	26	config :swoosh, api_client: Swoosh.ApiClient.Req

Parents: 62c2d06