eed947b207
The X-Forwarded-For rewrite rule alone is not enough: waitress 2+ strips forwarded headers from untrusted proxies by default, so the app still saw 127.0.0.1 with the rule active. Trust the loopback proxy and consume x-forwarded-for on the waitress command line; waitress then rewrites remote_addr to the real client. Runbook gains the allowedServerVariables unlock (500.52) and both troubleshooting rows.
80 lines
3.4 KiB
XML
80 lines
3.4 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!--
|
|
IIS site config for shopdb-flask via HttpPlatformHandler.
|
|
|
|
IIS launches waitress (a Windows-friendly WSGI server; gunicorn does NOT run
|
|
on Windows) and forwards requests to it on a private loopback port that IIS
|
|
assigns via %HTTP_PLATFORM_PORT%. One process serves both /api and the built
|
|
Vue SPA (frontend/dist), so no separate static site is needed.
|
|
|
|
Prerequisites on the box:
|
|
- HttpPlatformHandler IIS module installed
|
|
(https://www.iis.net/downloads/microsoft/httpplatformhandler)
|
|
- URL Rewrite module installed (only for the optional X-Forwarded-For rule)
|
|
- Python 3.12 + a venv at APP_ROOT\venv with requirements.txt + waitress
|
|
- Secrets live in APP_ROOT\.env (wsgi.py load_dotenv() reads it). Keep them
|
|
OUT of this file. Lock .env ACLs to the app pool identity + admins.
|
|
|
|
Replace APP_ROOT (C:\shopdb-flask below) with the real deploy path. The IIS
|
|
site's physical path MUST be APP_ROOT (where wsgi.py lives).
|
|
-->
|
|
<configuration>
|
|
<system.webServer>
|
|
|
|
<handlers>
|
|
<add name="httpplatformhandler" path="*" verb="*"
|
|
modules="httpPlatformHandler" resourceType="Unspecified" />
|
|
</handlers>
|
|
|
|
<httpPlatform
|
|
processPath="C:\shopdb-flask\venv\Scripts\waitress-serve.exe"
|
|
arguments="--port=%HTTP_PLATFORM_PORT% --host=127.0.0.1 --threads=8 --trusted-proxy=127.0.0.1 --trusted-proxy-headers=x-forwarded-for wsgi:app"
|
|
stdoutLogEnabled="true"
|
|
stdoutLogFile="C:\shopdb-flask\logs\httpplatform"
|
|
startupTimeLimit="120"
|
|
startupRetryCount="3">
|
|
<environmentVariables>
|
|
<!-- FLASK_ENV MUST be production here or wsgi.py defaults to the dev
|
|
config (SQL echo, debug, wrong DB URL). Real secrets go in .env. -->
|
|
<environmentVariable name="FLASK_ENV" value="production" />
|
|
<environmentVariable name="PYTHONPATH" value="C:\shopdb-flask" />
|
|
<!-- Subpath method only: when this web.config sits in an IIS
|
|
Application (e.g. /ops) under an existing site instead of its own
|
|
site, tell the app its mount path. Must match the alias the
|
|
Application was created with AND the VITE_BASE_PATH the frontend
|
|
was built with ('/ops/'). Omit for the own-site method.
|
|
<environmentVariable name="MOUNT_PATH" value="/ops" />
|
|
-->
|
|
</environmentVariables>
|
|
</httpPlatform>
|
|
|
|
<!--
|
|
OPTIONAL: forward the real client IP so audit logs and the kiosk
|
|
visitor-location feature (IP -> business unit) see the caller, not the
|
|
loopback that HttpPlatformHandler connects from.
|
|
|
|
This block is COMMENTED OUT by default because it needs the URL Rewrite
|
|
module; with it uncommented but URL Rewrite not installed, IIS returns
|
|
HTTP 500.19 ("configuration section not well-formed / cannot be read").
|
|
Install URL Rewrite (https://www.iis.net/downloads/microsoft/url-rewrite)
|
|
and then uncomment the <rewrite> block below to enable it.
|
|
|
|
<rewrite>
|
|
<allowedServerVariables>
|
|
<add name="HTTP_X_FORWARDED_FOR" />
|
|
</allowedServerVariables>
|
|
<rules>
|
|
<rule name="Set X-Forwarded-For" stopProcessing="false">
|
|
<match url=".*" />
|
|
<serverVariables>
|
|
<set name="HTTP_X_FORWARDED_FOR" value="{REMOTE_ADDR}" />
|
|
</serverVariables>
|
|
<action type="None" />
|
|
</rule>
|
|
</rules>
|
|
</rewrite>
|
|
-->
|
|
|
|
</system.webServer>
|
|
</configuration>
|