Fix deploy asset check to use forwarded HTTPS headers.

Curling localhost without X-Forwarded-Proto always yields http:// URLs even when trustProxies is correct behind Caddy.
2026-08-12 23:32:14 +02:00
parent ab14f5e452
commit 2b126ee4e6
1 changed files with 17 additions and 1 deletions
@@ -94,7 +94,23 @@ for dir in "${DIRS[@]}"; do
            exit 1
        fi

-        asset_scheme="$(curl -fsS "${health_url%/up}/login" | grep -oE 'https?://[^"'\'' ]+\.css' | head -1 || true)"
+        # Hit /login as the public HTTPS edge would (trustProxies needs forwarded proto).
+        app_url="$(awk -F= '/^APP_URL=/ {print $2; exit}' .env 2>/dev/null || true)"
+        app_url="${app_url:-https://transcribe.z00.nu}"
+        public_host="$(python3 - <<PY
+from urllib.parse import urlparse
+print(urlparse("${app_url}").hostname or "transcribe.z00.nu")
+PY
+)"
+        asset_scheme="$(
+            curl -fsS \
+                -H "X-Forwarded-Proto: https" \
+                -H "X-Forwarded-Host: ${public_host}" \
+                -H "X-Forwarded-Port: 443" \
+                "http://127.0.0.1:${app_port}/login" \
+            | grep -oE 'https?://[^"'\'' ]+\.css' \
+            | head -1 || true
+        )"
        if [[ "${asset_scheme}" == http://* ]]; then
            echo "ERROR: login page still emits http:// asset URLs (${asset_scheme})" >&2
            exit 1