fix(docker): correct proxy configuration

- On non-localhost communication, this whitelists forwarded headers
  on all remote ips
- Add more headers
- Force https X-Forwarded-Proto
- Unset Forwarded header and rely on X-Forwarded-*

Signed-off-by: Kevin Morris <kevr@0cost.org>

docker/config/nginx.conf

@@ -137,8 +137,9 @@ http {
         location / {
             proxy_pass http://asgi_backend;
             proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-Protocol ssl;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto https;
             proxy_set_header X-Forwarded-Ssl on;
         }
     }

docker/scripts/run-fastapi.sh

@@ -23,6 +23,8 @@ elif [ "$1" == "gunicorn" ]; then
     exec gunicorn \
         --log-config /docker/logging.conf \
         --bind "0.0.0.0:8000" \
+        --proxy-protocol \
+        --forwarded-allow-ips "*" \
         -w $FASTAPI_WORKERS \
         -k uvicorn.workers.UvicornWorker \
         aurweb.asgi:app