Fix Studio 404 behind reverse proxy via ForwardedHeaders + Studio:Host override

Author: mrdevrobot

Dockerfile

@@ -48,6 +48,11 @@ ENV KESTREL__ENDPOINTS__REST__PROTOCOLS=Http1AndHttp2
 ENV KESTREL__ENDPOINTS__STUDIO__URL=http://*:2628
 ENV KESTREL__ENDPOINTS__STUDIO__PROTOCOLS=Http1AndHttp2
 ENV STUDIO__ENABLED=false
+# When Studio is accessed via a reverse proxy (e.g. Plesk / nginx), set this to
+# the public hostname so RequireHost() matches the proxied Host header.
+# Example: -e STUDIO__HOST=studio.example.com
+# Leave unset for direct port access (http://server:2628).
+ENV STUDIO__HOST=
 
 # Data paths — mount a volume at /data to persist the database
 ENV BLITESERVER__DATABASEPATH=/data/blite.db

src/BLite.Server/Program.cs

@@ -16,6 +16,7 @@
 using BLite.Server.Telemetry;
 using BLite.Server.Transactions;
 using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.OpenApi;
 using OpenTelemetry.Metrics;
 using OpenTelemetry.Resources;
@@ -227,6 +228,12 @@ static string ResolveAppPath(string path) =>
 
 var restHostFilter   = HostFilter(app.Configuration["Kestrel:Endpoints:Rest:Url"]);
 var studioHostFilter = HostFilter(app.Configuration["Kestrel:Endpoints:Studio:Url"]);
+// If Studio is accessed via a reverse proxy, the Host header will be the proxy
+// domain (e.g. studio.example.com) rather than *:2628.  Studio:Host overrides
+// the port-based filter so RequireHost() matches the proxied hostname instead.
+var studioHostOverride = app.Configuration.GetValue<string>("Studio:Host");
+if (!string.IsNullOrWhiteSpace(studioHostOverride))
+    studioHostFilter = studioHostOverride;
 // Apply filters only when the two endpoints have actually different ports.
 bool portsAreSeparate = restHostFilter is not null
                      && studioHostFilter is not null
@@ -263,6 +270,15 @@ static string ResolveAppPath(string path) =>
 if (app.Environment.IsDevelopment())
     app.MapGrpcReflectionService();
 
+// Forward headers from reverse proxy (X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host).
+// Required for correct host matching (RequireHost) and HTTPS detection when behind nginx/Plesk.
+app.UseForwardedHeaders(new ForwardedHeadersOptions
+{
+    ForwardedHeaders = ForwardedHeaders.XForwardedFor
+                     | ForwardedHeaders.XForwardedProto
+                     | ForwardedHeaders.XForwardedHost
+});
+
 // Static files — must precede endpoint mapping (only needed for Studio CSS/JS)
 if (studioEnabled)
     app.UseStaticFiles();