From bffe3616b5449caba1793c673e43a292394a7086 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Thu, 2 Apr 2026 10:20:43 -0500
Subject: [PATCH] =?UTF-8?q?Disable=20force=5Fssl=20=E2=80=94=20SSL=20termi?=
 =?UTF-8?q?nated=20by=20Cloudflare=20tunnel?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 config/prod.exs    | 12 +++---------
 config/runtime.exs |  1 +
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/config/prod.exs b/config/prod.exs
index 8838cb49..25473f71 100644
--- a/config/prod.exs
+++ b/config/prod.exs
@@ -10,15 +10,9 @@ config :logger, level: :info
 # before starting your production server.
 config :microwaveprop, MicrowavepropWeb.Endpoint, cache_static_manifest: "priv/static/cache_manifest.json"
 
-# Force using SSL in production. This also sets the "strict-security-transport" header,
-# known as HSTS. If you have a health check endpoint, you may want to exclude it below.
-# Note `:force_ssl` is required to be set at compile-time.
-config :microwaveprop, MicrowavepropWeb.Endpoint,
-  force_ssl: [rewrite_on: [:x_forwarded_proto]],
-  exclude: [
-    # paths: ["/health"],
-    hosts: ["localhost", "127.0.0.1"]
-  ]
+# SSL terminated by Cloudflare tunnel — no force_ssl needed.
+# config :microwaveprop, MicrowavepropWeb.Endpoint,
+#   force_ssl: [rewrite_on: [:x_forwarded_proto]]
 
 # Configure Swoosh API Client
 config :swoosh, api_client: Swoosh.ApiClient.Req
diff --git a/config/runtime.exs b/config/runtime.exs
index 315284d8..45b20da5 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -55,6 +55,7 @@ if config_env() == :prod do
     socket_options: maybe_ipv6
 
   config :microwaveprop, MicrowavepropWeb.Endpoint,
+    # SSL terminated by Cloudflare tunnel; generated URLs still use https
     url: [host: host, port: 443, scheme: "https"],
     http: [
       # Enable IPv6 and bind on all interfaces.