From 923fb4a9ed50c548d1cc27cb159b48dd39fd0eca Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sun, 1 Feb 2026 11:27:08 -0600
Subject: [PATCH] exclude healthcheck from ssl redirect

---
 config/prod.exs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/config/prod.exs b/config/prod.exs
index f3b7d33f..e039cd38 100644
--- a/config/prod.exs
+++ b/config/prod.exs
@@ -29,4 +29,9 @@ config :towerops, ToweropsWeb.Endpoint,
   cache_static_manifest: "priv/static/cache_manifest.json",
   # Force SSL redirects and enable HSTS (HTTP Strict Transport Security)
   # HSTS tells browsers to only use HTTPS for this domain for the next year
-  force_ssl: [hsts: true, rewrite_on: [:x_forwarded_host, :x_forwarded_port, :x_forwarded_proto]]
+  # Exclude /health endpoint from SSL redirect (used by K8s probes on internal network)
+  force_ssl: [
+    hsts: true,
+    rewrite_on: [:x_forwarded_host, :x_forwarded_port, :x_forwarded_proto],
+    exclude: ["health"]
+  ]