Fix https scheme for Coder-fronted apps (X-Forwarded-Proto middleware)

[rfay]

Problem

Coder terminates TLS at https://*.coder.ddev.com and reverse-proxies to DDEV's Traefik over plain-HTTP entrypoints (the generated Coder routers use tls: false). As a result Traefik hands the backend X-Forwarded-Proto: http, and DDEV's nginx — which derives HTTPS solely from that header (map $http_x_forwarded_proto $fcgi_https) — reports HTTPS=off to PHP.

Apps then generate http:// absolute URLs while the browser is on an https:// page. The most visible casualty is the TYPO3 backend: /typo3/ throws

#1588095935 TYPO3\CMS\Core\Http\Security\MissingReferrerException

because its referrer-refresh redirect is stamped http://, and the browser drops the Referer header on the https://→http:// downgrade. Frontend rendering, canonical tags, sitemaps, and generated emails are affected by the same scheme misdetection.

Fix

coder-routes now defines a Traefik headers middleware ({project}-coder-https) and attaches it to every generated router. Since HTTPS always terminates at the Coder proxy, it forces the real external scheme:

middlewares:
  {project}-coder-https:
    headers:
      customRequestHeaders:
        X-Forwarded-Proto: https
        X-Forwarded-Ssl: on
        X-Forwarded-Port: "443"

This is generic across all Coder-fronted services (web backend, mailpit, xhgui, and dynamic port-forward dev servers such as Vite/Astro).

Verification

Probed through the exact http-8080 entrypoint the Coder proxy uses, with no client-supplied forwarded header:

	before	after
HTTPS seen by PHP	off	on
X-Forwarded-Proto	absent	https

TYPO3 now detects HTTPS, renders https:// backend URLs, and /typo3/ loads without MissingReferrerException.

Changes

• image/scripts/.ddev/commands/host/coder-routes — define + attach the middleware
• docs/reference/coder-url-patterns.md — document the scheme-correction behavior

🤖 Generated with Claude Code

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-02 18:25 UTC