fix: Preserve HTTPS X-Forwarded-Proto in Nginx and configure SECURE_PROXY_SSL_HEADER in Django to fix 403 CSRF verification on Django Admin

backend/shiftplan_backend/settings.py

@@ -10,14 +10,37 @@ SECRET_KEY = os.environ.get('SECRET_KEY', 'django-insecure-key-shiftplan-change-
 
 DEBUG = os.environ.get('DEBUG', 'True') == 'True'
 
-ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '*').split(',')
+ALLOWED_HOSTS = [h.strip() for h in os.environ.get('ALLOWED_HOSTS', '*').split(',') if h.strip()]
+
+# Reverse Proxy & SSL Configuration for Coolify / Traefik
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+USE_X_FORWARDED_HOST = True
+USE_X_FORWARDED_PORT = True
+
+# CSRF & Trusted Origins Configuration
+CSRF_TRUSTED_ORIGINS = [
+    'http://localhost',
+    'http://127.0.0.1',
+    'https://*.op3n.link',
+    'http://*.op3n.link',
+]
 
-# CSRF & Origin configuration for reverse proxies (Coolify, Traefik, custom domains)
 raw_csrf = os.environ.get('CSRF_TRUSTED_ORIGINS', '')
 if raw_csrf:
-    CSRF_TRUSTED_ORIGINS = [o.strip() for o in raw_csrf.split(',') if o.strip()]
-else:
-    CSRF_TRUSTED_ORIGINS = ['http://*', 'https://*']
+    for origin in raw_csrf.split(','):
+        o = origin.strip()
+        if o and o not in CSRF_TRUSTED_ORIGINS:
+            CSRF_TRUSTED_ORIGINS.append(o)
+
+for h in ALLOWED_HOSTS:
+    if h and h != '*':
+        if not h.startswith('http://') and not h.startswith('https://'):
+            http_origin = f'http://{h}'
+            https_origin = f'https://{h}'
+            if http_origin not in CSRF_TRUSTED_ORIGINS:
+                CSRF_TRUSTED_ORIGINS.append(http_origin)
+            if https_origin not in CSRF_TRUSTED_ORIGINS:
+                CSRF_TRUSTED_ORIGINS.append(https_origin)
 
 INSTALLED_APPS = [
     'django.contrib.admin',