Add ProxyFix for HTTPS and self-signed cert fallback

nextgenpdf-install.sh

@@ -230,7 +230,95 @@ sudo systemctl reload nginx
 # Install SSL certificate with Let's Encrypt
 echo "Installing SSL certificate with Let's Encrypt..."
 sudo apt install -y certbot python3-certbot-nginx
-sudo certbot --nginx -d $DOMAIN_NAME --non-interactive --agree-tos --email admin@$DOMAIN_NAME
+
+# Try Let's Encrypt first, fall back to self-signed if it fails
+if sudo certbot --nginx -d $DOMAIN_NAME --non-interactive --agree-tos --email admin@$DOMAIN_NAME 2>/dev/null; then
+    echo "✅ Let's Encrypt certificate installed successfully"
+else
+    echo "⚠️  Let's Encrypt failed (DNS not configured?), creating self-signed certificate..."
+    
+    # Create self-signed certificate
+    sudo mkdir -p /etc/ssl/private
+    sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+        -keyout /etc/ssl/private/$DOMAIN_NAME.key \
+        -out /etc/ssl/certs/$DOMAIN_NAME.crt \
+        -subj "/C=US/ST=State/L=City/O=Organization/CN=$DOMAIN_NAME"
+    
+    # Update Nginx configuration to use self-signed certificate
+    sudo tee /etc/nginx/sites-available/pdf-renamer > /dev/null <<EOF
+server {
+    listen 80;
+    server_name $DOMAIN_NAME;
+    
+    # Redirect HTTP to HTTPS
+    return 301 https://\$server_name\$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name $DOMAIN_NAME;
+
+    # Self-signed SSL certificate
+    ssl_certificate /etc/ssl/certs/$DOMAIN_NAME.crt;
+    ssl_certificate_key /etc/ssl/private/$DOMAIN_NAME.key;
+    
+    # SSL settings
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
+    
+    # Handle large file uploads (500MB)
+    client_max_body_size 500M;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+
+    # Handle static files
+    location /static {
+        alias /home/$CURRENT_USER/pdf-rename-sort/static;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Proxy to Flask app on port 3000
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+
+        # WebSocket support (if needed in future)
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Timeout settings for large files
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+    }
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_proxied expired no-cache no-store private auth;
+    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss;
+}
+EOF
+    
+    # Reload Nginx with new configuration
+    sudo systemctl reload nginx
+    
+    echo "⚠️  Self-signed certificate created. You'll see browser warnings."
+    echo "   To get a trusted certificate, configure DNS and run:"
+    echo "   sudo certbot --nginx -d $DOMAIN_NAME"
+fi
 
 # Configure firewall (UFW)
 echo "Configuring firewall..."
@@ -273,9 +361,11 @@ echo "2. Update the server_name in /etc/nginx/sites-available/pdf-renamer:"
 echo "   - Change 'pdf-renamer.your-domain.com' to '$DOMAIN_NAME'"
 echo "   - Point your DNS for $DOMAIN_NAME to this server's IP"
 echo ""
-echo "3. SSL certificate has been automatically installed with Let's Encrypt"
-echo "   - Certificate for: $DOMAIN_NAME"
-echo "   - Auto-renewal is configured"
+echo "3. SSL certificate has been installed"
+echo "   - If Let's Encrypt succeeded: Certificate is trusted"
+echo "   - If self-signed: You'll see browser warnings (this is normal)"
+echo "   - To upgrade to Let's Encrypt after DNS is configured:"
+echo "     sudo certbot --nginx -d $DOMAIN_NAME"
 echo "4. Reload systemd after updating environment variables:"
 echo "   sudo systemctl daemon-reload"
 echo "   sudo systemctl restart pdf-renamer"

pdf_renamer.py

@@ -7,10 +7,15 @@ from datetime import datetime
 from functools import wraps
 from flask import Flask, request, render_template_string, redirect, url_for, session, send_from_directory, flash, get_flashed_messages, jsonify
 from werkzeug.utils import secure_filename
+from werkzeug.middleware.proxy_fix import ProxyFix
 from PyPDF2 import PdfReader
 from authlib.integrations.flask_client import OAuth
 
 app = Flask(__name__)
+
+# Trust proxy headers (since we're behind Nginx)
+app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_prefix=1)
+
 app.config['UPLOAD_FOLDER'] = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'processed')
 os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
 app.config['MAX_CONTENT_LENGTH'] = 500 * 1024 * 1024  # 500MB limit