Behind an external TLS proxy, Clusev's own Caddy only honors the upstream's
X-Forwarded-Proto when TRUSTED_PROXY_CIDR is set. Without it the app saw http,
asset() emitted http:// URLs, and the HTTPS page's CSP ('self') blocked them —
the panel loaded with no CSS/JS over the domain. PanelScheme now forces the URL
root + scheme to https://<domain> whenever the active domain is being served,
regardless of the (possibly untrusted) request scheme. The bare-IP recovery
path returns earlier and stays on HTTP.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| app.php | ||
| auth.php | ||
| broadcasting.php | ||
| cache.php | ||
| clusev.php | ||
| database.php | ||
| filesystems.php | ||
| logging.php | ||
| mail.php | ||
| queue.php | ||
| reverb.php | ||
| services.php | ||
| session.php | ||
| wire-elements-modal.php | ||