From 29eacb4aedd3061dcf7dc4bb36eb8ad8123c02fe Mon Sep 17 00:00:00 2001
From: Justin Ko <genichin@gmail.com>
Date: Thu, 22 Oct 2026 12:21:07 +0000
Subject: [PATCH] fix: trust K3s proxy headers and ignore local data

---
 .gitignore                      | 1 +
 deploy/k8s/base/deployment.yaml | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 2a3518b..b0e47b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,4 @@ tmp_*
 .hermes/
 .DS_Store
 .worktrees/
+/data/
diff --git a/deploy/k8s/base/deployment.yaml b/deploy/k8s/base/deployment.yaml
index 08c541b..8e8ed98 100644
--- a/deploy/k8s/base/deployment.yaml
+++ b/deploy/k8s/base/deployment.yaml
@@ -136,8 +136,11 @@ spec:
                 secretKeyRef:
                   name: jarca-ledger-dashboard-auth
                   key: signing-secret
+            # Traefik reaches this pod from the K3s pod CIDR. Uvicorn must
+            # trust that proxy range so HTTPS Origin checks see the public
+            # scheme instead of the internal HTTP hop.
             - name: FORWARDED_ALLOW_IPS
-              value: 127.0.0.1
+              value: 10.42.0.0/16
           ports:
             - name: dashboard
               containerPort: 8501