HTTPS with nginx

Terminate TLS in nginx, bind Trestle to loopback and declare only nginx's immediate address as trusted.

location / {
  proxy_pass http://127.0.0.1:8090;
  proxy_http_version 1.1;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-For $remote_addr;
  proxy_buffering off;
  client_max_body_size 257m;
  proxy_read_timeout 1h;
}

TRESTLE_TRUSTED_PROXIES=127.0.0.1/32

Why these directives matter

• Replacing X-Forwarded-For prevents a direct client from supplying a fake chain.
• X-Forwarded-Proto allows Trestle to issue Secure administrator cookies only through the trusted proxy.
• Disabled buffering and the long read timeout support realtime SSE.
• The upload ceiling must cover multipart overhead; Trestle still applies its own quota and endpoint limits.
• Preserved Host keeps origin enforcement correct.

Run health, login, upload, SSE and webhook-delivery smoke tests after every nginx change.