From ab1afaebf0d8949620bc19d317e93f24e8c448a5 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sat, 3 Jan 2026 09:07:59 -0600
Subject: [PATCH] Add X-Forwarded-Proto header to APRS IngressRoute

- Ensures Phoenix knows the original request was HTTPS
- Complements externalTrafficPolicy:Local on Traefik service
- Service was patched with: kubectl patch service traefik -n traefik -p '{"spec":{"externalTrafficPolicy":"Local"}}'
- This preserves real client IPs for geolocation
---
 home/cluster/aprs/aprs-ingressroute.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/home/cluster/aprs/aprs-ingressroute.yaml b/home/cluster/aprs/aprs-ingressroute.yaml
index 59d9e56..01f1225 100644
--- a/home/cluster/aprs/aprs-ingressroute.yaml
+++ b/home/cluster/aprs/aprs-ingressroute.yaml
@@ -14,6 +14,16 @@ spec:
     - www.aprs.me
 ---
 apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: real-ip
+  namespace: aprs
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: aprs-https
@@ -24,6 +34,8 @@ spec:
   routes:
     - match: Host(`aprs.me`) || Host(`www.aprs.me`)
       kind: Rule
+      middlewares:
+        - name: real-ip
       services:
         - name: aprs
           port: 80