From a83e9f93de0bfb482921cb41c34af339b942b724 Mon Sep 17 00:00:00 2001
From: Assistant builder <meelstorm@gmail.com>
Date: Thu, 11 Jun 2026 20:17:46 +0000
Subject: [PATCH] Add UseForwardedHeaders so /install.sh + backend_ws use
 https/wss behind Traefik

---
 README.md          | 4 ++--
 backend/Program.cs | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 624df62..bf35ca5 100644
--- a/README.md
+++ b/README.md
@@ -23,10 +23,10 @@ for the Plan 1 implementation steps that produced this code.
 
 ```sh
 dotnet test                              # all backend tests
-dotnet run --project backend             # starts on http://localhost:5000
+dotnet run --project backend             # starts on http://localhost:5252
 ```
 
-Hit `http://localhost:5000/health` to verify it's up.
+Hit `http://localhost:5252/health` to verify it's up.
 
 ## Smoke test against a live deploy
 
diff --git a/backend/Program.cs b/backend/Program.cs
index f361f5f..49c8d64 100644
--- a/backend/Program.cs
+++ b/backend/Program.cs
@@ -4,6 +4,7 @@ using backend.Devices;
 using backend.Install;
 using backend.Pairing;
 using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.EntityFrameworkCore;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -16,6 +17,13 @@ if (Directory.Exists(keysDir))
         .SetApplicationName("smart-assistant");
 }
 
+builder.Services.Configure<ForwardedHeadersOptions>(opt =>
+{
+    opt.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
+    opt.KnownNetworks.Clear();
+    opt.KnownProxies.Clear();
+});
+
 builder.Services.AddDbContext<AppDbContext>(opt =>
     opt.UseSqlite(builder.Configuration.GetConnectionString("Default")));
 
@@ -42,6 +50,7 @@ using (var scope = app.Services.CreateScope())
     }
 }
 
+app.UseForwardedHeaders();
 app.UseAuthentication();
 app.UseAuthorization();