fix: trust K3s proxy headers and ignore local data

2026-10-22 12:21:07 +00:00
2 changed files with 5 additions and 1 deletions
@@ -19,3 +19,4 @@ tmp_*
 .hermes/
 .DS_Store
 .worktrees/
+/data/
@@ -136,8 +136,11 @@ spec:
                secretKeyRef:
                  name: jarca-ledger-dashboard-auth
                  key: signing-secret
+            # Traefik reaches this pod from the K3s pod CIDR. Uvicorn must
+            # trust that proxy range so HTTPS Origin checks see the public
+            # scheme instead of the internal HTTP hop.
            - name: FORWARDED_ALLOW_IPS
-              value: 127.0.0.1
+              value: 10.42.0.0/16
          ports:
            - name: dashboard
              containerPort: 8501