Fix APP_FULL_BASE_URL to work behind reverse proxies.

Author: robol

backend/config/app.php

@@ -113,7 +113,7 @@
         'webroot' => 'webroot',
         'wwwRoot' => WWW_ROOT,
         //'baseUrl' => env('SCRIPT_NAME'),
-        'fullBaseUrl' => false,
+        'fullBaseUrl' => env('APP_FULL_BASE_URL', false),
         'imageBaseUrl' => 'img/',
         'cssBaseUrl' => 'css/',
         'jsBaseUrl' => 'js/',

backend/example.env

@@ -32,6 +32,15 @@ CAPS_CDS='Testing'
 # default:
 # READONLY=''
 
+# Optional administrator Bearer token. Both variables are required and the
+# configured user must already exist in CAPS.
+# CAPS_ADMIN_TOKEN='replace-with-a-long-random-token'
+# CAPS_ADMIN_TOKEN_USER='admin'
+
+# Public URL used to generate absolute links and redirects. Configure this in
+# production when TLS is terminated by a reverse proxy.
+# APP_FULL_BASE_URL='https://caps.example.org'
+
 # Connection information used by the ORM to connect
 # to your application's datastores.
 #

docker/README.md

@@ -8,6 +8,29 @@ To start the container, you can run
 ```bash
 sudo docker-compose up
 ```
+
+## HTTPS reverse proxies
+
+When CAPS is published through an HTTPS reverse proxy, set its public URL in
+`caps.env` so that CakePHP generates HTTPS redirects and absolute links:
+
+```env
+APP_FULL_BASE_URL=https://caps.example.org
+```
+
+Replace `caps.example.org` with the public hostname, without a trailing slash.
+The reverse proxy should also preserve the original host and scheme. For
+example, with nginx:
+
+```nginx
+proxy_set_header Host $host;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Port $server_port;
+```
+
+Restart the CAPS container after changing `caps.env`. Existing installations
+should also clear CakePHP's cache with `bin/cake cache clear_all`.
+
 For later updates, use
 ```bash
 sudo docker-compose up --build

docker/app.php

@@ -79,7 +79,7 @@
         'dir' => 'src',
         'webroot' => 'webroot',
         'wwwRoot' => WWW_ROOT,
-        'fullBaseUrl' => false,
+        'fullBaseUrl' => env('APP_FULL_BASE_URL', false),
         'imageBaseUrl' => 'img/',
         'cssBaseUrl' => 'css/',
         'jsBaseUrl' => 'js/',

docker/caps.env.template

@@ -31,6 +31,10 @@ CAPS_VERIFY_CERT=true
 # Name of the degree
 CAPS_CDS=Matematica
 
+# Public URL used to generate absolute links and redirects. Set this when CAPS
+# is served through an HTTPS reverse proxy.
+# APP_FULL_BASE_URL=https://caps.example.org
+
 # Use this to automatically set up an SSH port forwarding for
 # accessing the LDAP server through a different host. Public key
 # authentication needs to be set-up, using a key made available 

example.env

@@ -51,6 +51,15 @@ CAPS_USERS_PASSWD="admin:admin,user:user"
 # CAPS_ADMIN=''
 CAPS_ADMINS='admin'
 
+# Optional administrator Bearer token. The user must already exist in CAPS.
+# Generate a token with: openssl rand -hex 32
+# CAPS_ADMIN_TOKEN='replace-with-a-long-random-token'
+# CAPS_ADMIN_TOKEN_USER='admin'
+
+# Public URL used to generate absolute links and redirects. Configure this in
+# production when TLS is terminated by a reverse proxy.
+# APP_FULL_BASE_URL=https://caps.example.org
+
 # Connection information used by the ORM to connect
 # to your application's datastores.
 #