From d5975efeafe5f43ab41c6c28188d6a28c7673734 Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Sun, 22 Feb 2026 21:26:34 -0500 Subject: [PATCH] Enable TRUST_PROXY_HEADERS and SECURE_COOKIES for production deployment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - TRUST_PROXY_HEADERS=true: ensures rate limiting keys on the real client IP (X-Forwarded-For / X-Real-IP) rather than the Traefik container IP - SECURE_COOKIES=true: sets the Secure flag on session cookies since the app is served behind TLS via Traefik - Remove ports: "5000:5000" — Traefik routes traffic internally; publishing the port directly would bypass Traefik middleware Co-Authored-By: Claude Sonnet 4.6 --- docker-compose.prod.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index 25a7c71..890d0df 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -1,14 +1,14 @@ services: app: image: git.fabledsword.com/bvandeusen/fabledassistant:latest - ports: - - "5000:5000" environment: DATABASE_URL: "postgresql+asyncpg://fabled:${DB_PASSWORD}@db:5432/fabledassistant" SECRET_KEY: "${SECRET_KEY}" OLLAMA_URL: "http://ollama:11434" OLLAMA_MODEL: "${OLLAMA_MODEL:-llama3.1}" LOG_LEVEL: "${LOG_LEVEL:-INFO}" + TRUST_PROXY_HEADERS: "true" + SECURE_COOKIES: "true" networks: - fabledassistant_backend healthcheck: