🔒 Fix HTTPS configuration for Dokploy deployment

HTTPS FIXES:
- Added TLS/SSL configuration to dokploy.json with Let's Encrypt
- Created production_https_settings.py with proper HTTPS Django settings
- Added SSL redirect, HSTS headers, and secure cookie settings
- Updated Dockerfile and startup script to use HTTPS settings
- Added CSRF trusted origins for both HTTP and HTTPS
- Configured Traefik proxy header handling

SECURITY IMPROVEMENTS:
- Force HTTPS redirect for production
- HTTP Strict Transport Security (HSTS) enabled
- Secure cookies (SESSION_COOKIE_SECURE, CSRF_COOKIE_SECURE)
- XSS protection and content type sniffing prevention
- Proper X-Forwarded-Proto header handling for Dokploy/Traefik

This should resolve HTTPS certificate and redirect issues in Dokploy.

Dockerfile.dokploy

@@ -20,7 +20,7 @@ ENV PYTHONUNBUFFERED=1 \
     SECRET_KEY="build-time-dummy-key-change-in-production"
 
 # Collect static files
-RUN python manage.py collectstatic --noinput --settings=netcop_hub.settings
+RUN python manage.py collectstatic --noinput --settings=production_https_settings
 
 # Make startup script executable
 RUN chmod +x start-dokploy.sh

dokploy.json

@@ -6,11 +6,22 @@
   "healthCheck": "/health/",
   "buildArgs": {},
   "buildOptions": ["--no-cache"],
+  "security": {
+    "redirectHttpsToHttp": false,
+    "forceHttps": true
+  },
+  "traefik": {
+    "tls": true,
+    "certResolver": "letsencrypt"
+  },
   "env": {
     "PYTHONUNBUFFERED": "1",
     "DEBUG": "false",
     "SECRET_KEY": "production-key-change-this-123456789",
     "ALLOWED_HOSTS": "website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me,*",
-    "DOKPLOY_PROJECT_NAME": "quantum-tasks-ai"
+    "DOKPLOY_PROJECT_NAME": "quantum-tasks-ai",
+    "SECURE_SSL_REDIRECT": "true",
+    "SECURE_PROXY_SSL_HEADER": "HTTP_X_FORWARDED_PROTO,https",
+    "CSRF_TRUSTED_ORIGINS": "https://website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me,http://website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me"
   }
 }

production_https_settings.py

@@ -0,0 +1,39 @@
+# Production HTTPS settings for Dokploy deployment
+from netcop_hub.settings import *
+
+# Force HTTPS in production
+SECURE_SSL_REDIRECT = True
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+
+# HSTS (HTTP Strict Transport Security)
+SECURE_HSTS_SECONDS = 31536000  # 1 year
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+SECURE_HSTS_PRELOAD = True
+
+# Cookie security
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+SESSION_COOKIE_HTTPONLY = True
+CSRF_COOKIE_HTTPONLY = True
+
+# Additional security headers
+SECURE_CONTENT_TYPE_NOSNIFF = True
+SECURE_BROWSER_XSS_FILTER = True
+X_FRAME_OPTIONS = 'DENY'
+
+# Trust Dokploy/Traefik proxy headers
+USE_X_FORWARDED_HOST = True
+USE_X_FORWARDED_PORT = True
+
+# CSRF trusted origins for HTTPS
+CSRF_TRUSTED_ORIGINS = [
+    'https://website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me',
+    'http://website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me',  # For testing
+    'https://localhost:3000',
+    'http://localhost:3000',
+]
+
+print("🔒 HTTPS Production Settings Loaded")
+print(f"   - SSL Redirect: {SECURE_SSL_REDIRECT}")
+print(f"   - HSTS: {SECURE_HSTS_SECONDS} seconds")
+print(f"   - Trusted Origins: {len(CSRF_TRUSTED_ORIGINS)} configured")

start-dokploy.sh

@@ -8,22 +8,23 @@ echo "======================================="
 
 # Run database migrations
 echo "📄 Running database migrations..."
-python manage.py migrate --noinput
+DJANGO_SETTINGS_MODULE=production_https_settings python manage.py migrate --noinput
 
 # Create cache table if needed
 echo "🗄️ Ensuring cache table exists..."
-python manage.py createcachetable || true
+DJANGO_SETTINGS_MODULE=production_https_settings python manage.py createcachetable || true
 
 # Check if we can access the database
 echo "🔍 Testing database connection..."
-python manage.py check --database default
+DJANGO_SETTINGS_MODULE=production_https_settings python manage.py check --database default
 
 # Start the application
 echo "🌐 Starting gunicorn server on port 3000..."
 echo "Health check endpoint: /health/"
+echo "🔒 HTTPS enabled with SSL redirect"
 echo "======================================="
 
-exec gunicorn netcop_hub.wsgi:application \
+DJANGO_SETTINGS_MODULE=production_https_settings exec gunicorn netcop_hub.wsgi:application
     --bind 0.0.0.0:3000 \
     --workers 2 \
     --timeout 120 \