Freegle / Iznik / 25741

72%

push

circleci

fix(edge): pin X-Forwarded-Proto https on the uploads vhost

The uploads vhost is only reached via HAProxy, which terminates TLS, so the
client-facing scheme is always https. It was forwarding $scheme (the http of
the internal HAProxy->nginx hop), which made tusd -behind-proxy build an
http:// Location header. Server-side tus clients (AI illustration storage, TN
photo scrape) PATCH to that Location; the http URL 302-redirected to https and
the redirect dropped the body, so those uploads silently failed — a generated
AI illustration never landed, and the UI fell back to showing the previous
image (the "retry shows the same picture" report). Pinning https makes tusd
emit an https Location that PATCHes straight through. Verified end-to-end:
POST 201 -> https Location -> PATCH 204 -> file on NFS -> delivery 200 image/png.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ka6SXbZyznGYXyCyC9C86h

12917 of 17018 branches covered (75.9%)

Branch coverage included in aggregate %.

134873 of 186683 relevant lines covered (72.25%)

38.28 hits per line