updated backend to user tursted hosts too

.env.example

@@ -16,6 +16,11 @@ ALLOWED_HOSTS=localhost,127.0.0.1,backend
 DEBUG=true
 
 
+# A comma-separated list of domains that Django will trust for CSRF purposes.
+# This should match your frontend domain.
+# Example: CSRF_TRUSTED_ORIGINS=https://holy.narl.io,http://localhost:5173
+CSRF_TRUSTED_ORIGINS=http://localhost:5173
+
 # --- SMTP Configuration ---
 # Rename this file to .env and fill in your details to enable email sending.
 

backend/entrypoint.sh

@@ -7,6 +7,10 @@ set -e
 echo "Applying database migrations..."
 python manage.py migrate
 
+# Collect static files
+echo "Collecting static files..."
+python manage.py collectstatic --no-input
+
 # Create superuser if it doesn't exist
 echo "Creating superuser..."
 python manage.py shell <<EOF

backend/holy_backend/settings.py

@@ -51,6 +51,7 @@ INSTALLED_APPS = [
 
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
+    'whitenoise.middleware.WhiteNoiseMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'corsheaders.middleware.CorsMiddleware',
     'django.middleware.common.CommonMiddleware',
@@ -126,6 +127,17 @@ USE_TZ = True
 # https://docs.djangoproject.com/en/6.0/howto/static-files/
 
 STATIC_URL = 'static/'
+STATIC_ROOT = BASE_DIR / 'staticfiles'
+STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'
+
+# --- Reverse Proxy Configuration ---
+# These settings are crucial for running behind a proxy like Traefik
+USE_X_FORWARDED_HOST = True
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+
+# Read CSRF trusted origins from environment variable
+CSRF_TRUSTED_ORIGINS_STRING = os.environ.get('CSRF_TRUSTED_ORIGINS', 'http://localhost:5173')
+CSRF_TRUSTED_ORIGINS = [origin.strip() for origin in CSRF_TRUSTED_ORIGINS_STRING.split(',')]
 
 # Custom User Model
 AUTH_USER_MODEL = 'api.User'

backend/requirements.txt

@@ -5,3 +5,4 @@ django-filter>=23.5
 markdown>=3.5
 Pillow>=10.2.0
 drf-spectacular>=0.27.0
+whitenoise>=6.6.0