From a08cc042505d7963fe1114dbf7448cbabdef1e87 Mon Sep 17 00:00:00 2001
From: thecyberlearn <thecyberlearn@gmail.com>
Date: Fri, 5 Sep 2025 09:44:21 +0530
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20HTTPS=20configuration=20fo?=
 =?UTF-8?q?r=20Dokploy=20deployment?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HTTPS FIXES:
- Added TLS/SSL configuration to dokploy.json with Let's Encrypt
- Created production_https_settings.py with proper HTTPS Django settings
- Added SSL redirect, HSTS headers, and secure cookie settings
- Updated Dockerfile and startup script to use HTTPS settings
- Added CSRF trusted origins for both HTTP and HTTPS
- Configured Traefik proxy header handling

SECURITY IMPROVEMENTS:
- Force HTTPS redirect for production
- HTTP Strict Transport Security (HSTS) enabled
- Secure cookies (SESSION_COOKIE_SECURE, CSRF_COOKIE_SECURE)
- XSS protection and content type sniffing prevention
- Proper X-Forwarded-Proto header handling for Dokploy/Traefik

This should resolve HTTPS certificate and redirect issues in Dokploy.
---
 Dockerfile.dokploy           |  2 +-
 dokploy.json                 | 13 +++++++++++-
 production_https_settings.py | 39 ++++++++++++++++++++++++++++++++++++
 start-dokploy.sh             |  9 +++++----
 4 files changed, 57 insertions(+), 6 deletions(-)
 create mode 100644 production_https_settings.py

diff --git a/Dockerfile.dokploy b/Dockerfile.dokploy
index e42741f..3d4c0c9 100644
--- a/Dockerfile.dokploy
+++ b/Dockerfile.dokploy
@@ -20,7 +20,7 @@ ENV PYTHONUNBUFFERED=1 \
     SECRET_KEY="build-time-dummy-key-change-in-production"
 
 # Collect static files
-RUN python manage.py collectstatic --noinput --settings=netcop_hub.settings
+RUN python manage.py collectstatic --noinput --settings=production_https_settings
 
 # Make startup script executable
 RUN chmod +x start-dokploy.sh
diff --git a/dokploy.json b/dokploy.json
index 645cd40..0cb6e5f 100644
--- a/dokploy.json
+++ b/dokploy.json
@@ -6,11 +6,22 @@
   "healthCheck": "/health/",
   "buildArgs": {},
   "buildOptions": ["--no-cache"],
+  "security": {
+    "redirectHttpsToHttp": false,
+    "forceHttps": true
+  },
+  "traefik": {
+    "tls": true,
+    "certResolver": "letsencrypt"
+  },
   "env": {
     "PYTHONUNBUFFERED": "1",
     "DEBUG": "false",
     "SECRET_KEY": "production-key-change-this-123456789",
     "ALLOWED_HOSTS": "website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me,*",
-    "DOKPLOY_PROJECT_NAME": "quantum-tasks-ai"
+    "DOKPLOY_PROJECT_NAME": "quantum-tasks-ai",
+    "SECURE_SSL_REDIRECT": "true",
+    "SECURE_PROXY_SSL_HEADER": "HTTP_X_FORWARDED_PROTO,https",
+    "CSRF_TRUSTED_ORIGINS": "https://website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me,http://website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me"
   }
 }
diff --git a/production_https_settings.py b/production_https_settings.py
new file mode 100644
index 0000000..5d7fe42
--- /dev/null
+++ b/production_https_settings.py
@@ -0,0 +1,39 @@
+# Production HTTPS settings for Dokploy deployment
+from netcop_hub.settings import *
+
+# Force HTTPS in production
+SECURE_SSL_REDIRECT = True
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+
+# HSTS (HTTP Strict Transport Security)
+SECURE_HSTS_SECONDS = 31536000  # 1 year
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+SECURE_HSTS_PRELOAD = True
+
+# Cookie security
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+SESSION_COOKIE_HTTPONLY = True
+CSRF_COOKIE_HTTPONLY = True
+
+# Additional security headers
+SECURE_CONTENT_TYPE_NOSNIFF = True
+SECURE_BROWSER_XSS_FILTER = True
+X_FRAME_OPTIONS = 'DENY'
+
+# Trust Dokploy/Traefik proxy headers
+USE_X_FORWARDED_HOST = True
+USE_X_FORWARDED_PORT = True
+
+# CSRF trusted origins for HTTPS
+CSRF_TRUSTED_ORIGINS = [
+    'https://website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me',
+    'http://website-quantumtaskai-wrczik-cc50ac-31-97-62-205.traefik.me',  # For testing
+    'https://localhost:3000',
+    'http://localhost:3000',
+]
+
+print("🔒 HTTPS Production Settings Loaded")
+print(f"   - SSL Redirect: {SECURE_SSL_REDIRECT}")
+print(f"   - HSTS: {SECURE_HSTS_SECONDS} seconds")
+print(f"   - Trusted Origins: {len(CSRF_TRUSTED_ORIGINS)} configured")
diff --git a/start-dokploy.sh b/start-dokploy.sh
index 7fbf753..2a8e61a 100755
--- a/start-dokploy.sh
+++ b/start-dokploy.sh
@@ -8,22 +8,23 @@ echo "======================================="
 
 # Run database migrations
 echo "📄 Running database migrations..."
-python manage.py migrate --noinput
+DJANGO_SETTINGS_MODULE=production_https_settings python manage.py migrate --noinput
 
 # Create cache table if needed
 echo "🗄️ Ensuring cache table exists..."
-python manage.py createcachetable || true
+DJANGO_SETTINGS_MODULE=production_https_settings python manage.py createcachetable || true
 
 # Check if we can access the database
 echo "🔍 Testing database connection..."
-python manage.py check --database default
+DJANGO_SETTINGS_MODULE=production_https_settings python manage.py check --database default
 
 # Start the application
 echo "🌐 Starting gunicorn server on port 3000..."
 echo "Health check endpoint: /health/"
+echo "🔒 HTTPS enabled with SSL redirect"
 echo "======================================="
 
-exec gunicorn netcop_hub.wsgi:application \
+DJANGO_SETTINGS_MODULE=production_https_settings exec gunicorn netcop_hub.wsgi:application
     --bind 0.0.0.0:3000 \
     --workers 2 \
     --timeout 120 \