neiam /waxx

waxx

goog

696ec70 · gmorell · 2026-05-25 03:50

2 files +11 -11

modified config/prod.exs

+11 −11

@@ -7,17 +7,17 @@ import Config

7	7	# before starting your production server.
8	8	config :waxx, WaxxWeb.Endpoint, cache_static_manifest: "priv/static/cache_manifest.json"
9	9
10		−# Force using SSL in production. This also sets the "strict-security-transport" header,
11		−# known as HSTS. If you have a health check endpoint, you may want to exclude it below.
12		−# Note `:force_ssl` is required to be set at compile-time.
13		−config :waxx, WaxxWeb.Endpoint,
14		− force_ssl: [
15		− rewrite_on: [:x_forwarded_proto],
16		− exclude: [
17		− # paths: ["/health"],
18		− hosts: ["localhost", "127.0.0.1"]
19		− ]
20		− ]
	10	+# SSL is terminated at the Traefik edge (see app.yml — the
	11	+# `redirect-https` middleware bounces http→https there). Phoenix never
	12	+# sees TLS directly: requests arrive on the pod as plaintext with
	13	+# `X-Forwarded-Proto: https`. We deliberately do NOT install
	14	+# `force_ssl` here — when it ran, any request whose X-Forwarded-Proto
	15	+# header didn't make it through ended up 301'd to https by Phoenix,
	16	+# which then broke WebSocket upgrades (the channels client can't
	17	+# follow redirects on /socket/websocket).
	18	+#
	19	+# To re-enable HSTS without the redirect, add `:put_secure_browser_headers`
	20	+# adjustments to the router pipeline instead.
21	21
22	22	# Configure Swoosh API Client
23	23	config :swoosh, api_client: Swoosh.ApiClient.Req

Parents: 5e612cd