From d60851bb534501ba45846c4fe4013bffa0e4affd Mon Sep 17 00:00:00 2001 From: Ben Date: Wed, 12 Aug 2026 22:06:22 +0200 Subject: [PATCH] Trust reverse proxies so HTTPS asset URLs work behind CPM. Without TrustProxies, Laravel generated http:// links after TLS termination and browsers blocked CSS/JS as mixed content. --- bootstrap/app.php | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/bootstrap/app.php b/bootstrap/app.php index 159f8f2..8a91725 100644 --- a/bootstrap/app.php +++ b/bootstrap/app.php @@ -13,6 +13,16 @@ return Application::configure(basePath: dirname(__DIR__)) health: '/up', ) ->withMiddleware(function (Middleware $middleware): void { + // CPM/Caddy terminates TLS; trust forwarded proto/host so asset() URLs stay https. + $middleware->trustProxies( + at: '*', + headers: Request::HEADER_X_FORWARDED_FOR + | Request::HEADER_X_FORWARDED_HOST + | Request::HEADER_X_FORWARDED_PORT + | Request::HEADER_X_FORWARDED_PROTO + | Request::HEADER_X_FORWARDED_PREFIX, + ); + $middleware->redirectGuestsTo(fn () => route('login')); $middleware->redirectUsersTo(fn () => route('recordings.index')); })