From b770e97493f4d7464182024967d861eaa5fb1127 Mon Sep 17 00:00:00 2001
From: Nils Pukropp <nils@narl.io>
Date: Sun, 15 Feb 2026 22:09:08 +0100
Subject: [PATCH] updated backend to user tursted hosts too

---
 .env.example                     |  5 +++++
 backend/entrypoint.sh            |  4 ++++
 backend/holy_backend/settings.py | 12 ++++++++++++
 backend/requirements.txt         |  1 +
 4 files changed, 22 insertions(+)

diff --git a/.env.example b/.env.example
index 7a8b482..8a18e92 100644
--- a/.env.example
+++ b/.env.example
@@ -16,6 +16,11 @@ ALLOWED_HOSTS=localhost,127.0.0.1,backend
 DEBUG=true
 
 
+# A comma-separated list of domains that Django will trust for CSRF purposes.
+# This should match your frontend domain.
+# Example: CSRF_TRUSTED_ORIGINS=https://holy.narl.io,http://localhost:5173
+CSRF_TRUSTED_ORIGINS=http://localhost:5173
+
 # --- SMTP Configuration ---
 # Rename this file to .env and fill in your details to enable email sending.
 
diff --git a/backend/entrypoint.sh b/backend/entrypoint.sh
index 08a1330..0f0649e 100755
--- a/backend/entrypoint.sh
+++ b/backend/entrypoint.sh
@@ -7,6 +7,10 @@ set -e
 echo "Applying database migrations..."
 python manage.py migrate
 
+# Collect static files
+echo "Collecting static files..."
+python manage.py collectstatic --no-input
+
 # Create superuser if it doesn't exist
 echo "Creating superuser..."
 python manage.py shell <<EOF
diff --git a/backend/holy_backend/settings.py b/backend/holy_backend/settings.py
index 3d711bd..df772de 100644
--- a/backend/holy_backend/settings.py
+++ b/backend/holy_backend/settings.py
@@ -51,6 +51,7 @@ INSTALLED_APPS = [
 
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
+    'whitenoise.middleware.WhiteNoiseMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'corsheaders.middleware.CorsMiddleware',
     'django.middleware.common.CommonMiddleware',
@@ -126,6 +127,17 @@ USE_TZ = True
 # https://docs.djangoproject.com/en/6.0/howto/static-files/
 
 STATIC_URL = 'static/'
+STATIC_ROOT = BASE_DIR / 'staticfiles'
+STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'
+
+# --- Reverse Proxy Configuration ---
+# These settings are crucial for running behind a proxy like Traefik
+USE_X_FORWARDED_HOST = True
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+
+# Read CSRF trusted origins from environment variable
+CSRF_TRUSTED_ORIGINS_STRING = os.environ.get('CSRF_TRUSTED_ORIGINS', 'http://localhost:5173')
+CSRF_TRUSTED_ORIGINS = [origin.strip() for origin in CSRF_TRUSTED_ORIGINS_STRING.split(',')]
 
 # Custom User Model
 AUTH_USER_MODEL = 'api.User'
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 2310b03..61c84df 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -5,3 +5,4 @@ django-filter>=23.5
 markdown>=3.5
 Pillow>=10.2.0
 drf-spectacular>=0.27.0
+whitenoise>=6.6.0