updated favicons, fix domain rerouting, fix deploy provisioning

deploy/upcloud/provision.go

@@ -256,6 +256,11 @@ func cmdProvision(token, zone, plan, sshKeyPath, s3Secret string) error {
 		saveState(state)
 	}
 
+	// Always reconcile forwarded headers rule (handles existing LBs)
+	if err := ensureLBForwardedHeaders(ctx, svc, state.LB.UUID); err != nil {
+		return fmt.Errorf("LB forwarded headers: %w", err)
+	}
+
 	// Always reconcile TLS certs (handles partial failures and re-runs)
 	tlsDomains := []string{cfg.BaseDomain}
 	tlsDomains = append(tlsDomains, cfg.RegistryDomains...)
@@ -566,6 +571,14 @@ func createLoadBalancer(ctx context.Context, svc *service.Service, cfg *InfraCon
 					{Name: "public"},
 				},
 				Rules: []request.LoadBalancerFrontendRule{
+					{
+						Name:     "set-forwarded-headers",
+						Priority: 1,
+						Matchers: []upcloud.LoadBalancerMatcher{},
+						Actions: []upcloud.LoadBalancerAction{
+							request.NewLoadBalancerSetForwardedHeadersAction(),
+						},
+					},
 					{
 						Name:     "route-hold",
 						Priority: 10,
@@ -720,6 +733,45 @@ func ensureLBCertificates(ctx context.Context, svc *service.Service, lbUUID stri
 	return nil
 }
 
+// ensureLBForwardedHeaders ensures the "https" frontend has a set_forwarded_headers rule.
+// This makes the LB set X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port headers,
+// overwriting any pre-existing values (prevents spoofing).
+func ensureLBForwardedHeaders(ctx context.Context, svc *service.Service, lbUUID string) error {
+	rules, err := svc.GetLoadBalancerFrontendRules(ctx, &request.GetLoadBalancerFrontendRulesRequest{
+		ServiceUUID:  lbUUID,
+		FrontendName: "https",
+	})
+	if err != nil {
+		return fmt.Errorf("get frontend rules: %w", err)
+	}
+
+	for _, r := range rules {
+		if r.Name == "set-forwarded-headers" {
+			fmt.Println("  Forwarded headers rule: exists")
+			return nil
+		}
+	}
+
+	_, err = svc.CreateLoadBalancerFrontendRule(ctx, &request.CreateLoadBalancerFrontendRuleRequest{
+		ServiceUUID:  lbUUID,
+		FrontendName: "https",
+		Rule: request.LoadBalancerFrontendRule{
+			Name:     "set-forwarded-headers",
+			Priority: 1,
+			Matchers: []upcloud.LoadBalancerMatcher{},
+			Actions: []upcloud.LoadBalancerAction{
+				request.NewLoadBalancerSetForwardedHeadersAction(),
+			},
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("create forwarded headers rule: %w", err)
+	}
+	fmt.Println("  Forwarded headers rule: created")
+
+	return nil
+}
+
 // lookupObjectStorage discovers details of an existing Managed Object Storage.
 func lookupObjectStorage(ctx context.Context, svc *service.Service, uuid string) (ObjectStorageState, error) {
 	storage, err := svc.GetManagedObjectStorage(ctx, &request.GetManagedObjectStorageRequest{