Pull request for issue: #2393

This is a pull request for the following functionalities:

1. Configured cloudfllare SSL/TLS encryption mode from Flexible to Full (strict)
2. Updated the Nginx HTTP block for port 80 to redirect all HTTP traffic to HTTPS
3. Updated the Nginx HTTP block for port 80 to allow access to /.well-known/acme-challenge/ to handle challenge requests for the Let's Encrypt when creating a new cert using certbot.
4. Refactored the portainer container to include the TRUSTED_ORIGINS environment variable
5. Upgraded the already EOL php fpm base image from buster to bullseye in the production app dockerfile which will be fixed in Make partial pipeline pass #2426

How to test?

In dev

No changes to dev

In Staging

0. Migrate DNS to Cloudflare (optional)

Create new A record for your production ips, as below:

By doing this, all domains will be centralized to Cloudflare DNS, and save cost from managing your own DNS for development.

1. Update REMOTE_FILES_PUBLIC_URL, REMOTE_HOME_URL, REMOTE_HOSTNAME, remote_fileserver_hostname` in your gitlab variable page as in the new A record table.
2. Delete all the existing tls certs in your gitlab variable page, which will trigger the setup_cert.sh to create new cert for the new domain names during sd_gigadb.
3. Follow the steps in docs/SETUP_PROVISIONING.md and docs/SETUP_CI_CD_PIPELINE.md to spin up servers and execute the CI/CD pipeline
4. When sd_gigadb is passed, go to $name-staging.gigadb.org and portainer-$name-staging.gigadb.org to check

In Live

Repeat the steps in In Staing, except the for DNA A record which should be:

And also follow docs/RELEASE_PROCESS.md to make a live deployment.

How have functionalities been implemented?

HTTP vs HTTPS request

Originally, the cloudflare SSL/TLS encryption mode was set to Flexible and with proxy is turned on, from user to cloudflare is a HTTPS request, but from cloudflare to portainer server is a HTTP request. When Nginx server receives this request on port 80, it matches the server block intended for HTTP traffic in the nginx.target_deployment.http.conf, the location block contains try_files $uri $uri/ /index.php$is_args$args;, this directive tells Nginx to serve a file from the local disk, which fails and results in the browser being told to download a file.

It could be simply fixed by changing the SSL/TLS encryption mode to FULL (strict), it will make sure the requests from user to cloudflare then to portainer server is all HTTPS as Browser --(HTTPS)--> Cloudflare --(HTTPS)--> Server, this encrypts traffic and verifies the Let's Encrypt certificate is valid. And more importantly, by redirecting all HTTP requests to the corresponding HTTPS URL with a 301 Moved Permanently status code, this preserves the code's integrity removes the dependency on Cloudflare.

CSRF issue

When tried visit portainer behind the cloudflare proxy, the request has been configured to https only, user cannot log in portainer from the Chrome browser because of this error:

2025/08/07 05:17AM ERR github.com/portainer/portainer/api/http/csrf/csrf.go:100 > Failed to validate Origin or Referer | error="origin invalid" forwarded= host=portainer:9000 origin=https://portainer-ken-staging.gigadb.org referer=https://portainer-ken-staging.gigadb.org/ request_url=/api/auth trusted_origins=[] x_forwarded_proto=https

As reported in https://www.portainer.io/blog/origin-invalid-errors-with-portainer-2-27-7-behind-reverse-proxies, portainer has updated a third-party library (gorilla/csrf) introduced since version 2.27.7, the new version of gorilla/csrf was stricter on requirements around Origin and Referer headers than the previous release had been, so they have enabled the --trusted-origins CLI option (and the equivalent TRUSTED_ORIGINS environment variable) for the Portainer container.

The fix for this is to update the production portainer container with this environment variable:

    environment:
      - TRUSTED_ORIGINS=portainer-$REMOTE_HOSTNAME

Any issues with implementation?

Describe any problems with your implementation

None.

Any changes to automated tests?

None.

Any changes to documentation?

None.

Any technical debt repayment?

Updated ops/configuration/nginx-conf/sites/nginx.target_deployment.http.conf.dist to redirect all http request to https for the portainer.

Upgraded the already EOL php fpm base image from buster to bullseye in the production app dockerfile

Any improvements to CI/CD pipeline?

Describe any improvements to the Gitlab pipeline

Summary by CodeRabbit

• Bug Fixes

  • Improved accessibility of Portainer when deployed behind a Cloudflare proxy.

• Chores

  • Updated configuration files and environment variables to use hyphenated subdomain naming for Portainer.
  • Enhanced SSL security by removing outdated protocols and updating cipher suites.
  • Adjusted Docker Compose and certificate setup scripts to align with new subdomain format.
  • Updated documentation to reflect these changes.