feat(delivery): phase 12 — the container, and the defect only a proxy could find

PLAN.md §13 phase 12, the last one. Four decisions of record, D54–D57, taking the
count to fifty-seven; recorded in §6, "How phase 12 delivered it".

A two-stage Dockerfile, a pull-only docker-compose.yml carrying both bind mounts,
.env.example, the workflow that publishes and deploys, CONTRIBUTING.md, the
community-health files this was the only repository of the ten to lack, and
DEPLOY.md.

D54 — a merge deploys, amending D6. build-image.yml pushes
runicgateway-site:latest and :sha-<7>, then rolls the container over on the
`rgcom` runner out of /opt/runicgateway.com, and waits for the container's own
healthcheck rather than for `up -d` to return.

D55 — the site runs on its own host behind a generic reverse proxy, so DEPLOY.md
states the four requirements rather than one worked example, and the container
binds 127.0.0.1 so the safe configuration is the default.

D56 — @astrojs/node derives the request protocol from req.socket.encrypted and
never reads x-forwarded-proto, so behind a TLS-terminating proxy the browser sends
Origin: https://… while the container computes http://… and Astro's CSRF check
compares them for equality. Every beta signup, from every visitor, was answered
403. serve.mjs now normalises both forwarded headers, unconditionally — the image
should deploy and work. Two assertions in test/headers.test.mjs hold both halves.

D57 — DEPLOY.md rather than a README section; SECURITY.md and CODE_OF_CONDUCT.md
are pointers to the org's copies rather than copies, because a copy would hard-code
the contact address D13 confines to brand.json.

Verified: npm run verify green (eleven checks, 36 unit tests, 7 served tests,
astro check 0 errors). The image was built and run with both mounts — a mounted
brand reached 51 files and all 50 search pages, /brand/* fell back per file, a
proxy-shaped signup reached the store, and the export CLI wrote both Play files to
the host mount. docker compose config caught a YAML trap in the healthcheck: a
block sequence reads the `: ` in `r.ok ? 0 : 1` as a mapping.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/serve.mjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /**
- * serve.mjs — the production entry point (PLAN.md §6, D48).
+ * serve.mjs — the production entry point (PLAN.md §6, D48, D56).
  *
  * `npm start` runs `applyBrand.mjs` and then this, instead of `dist/server/entry.mjs`
- * directly. It is a thin wrapper around the adapter's own handler and exists for two
- * reasons, one of them a bug in a dependency.
+ * directly. It is a thin wrapper around the adapter's own handler and exists for three
+ * reasons, two of them things `@astrojs/node` gets wrong.
  *
  * ---------------------------------------------------------------------------------------
  * 1. THE ADAPTER SERVES THE WRONG PAGE'S CONTENT-SECURITY-POLICY
@@ -119,7 +119,66 @@ process.env.ASTRO_NODE_AUTOSTART = 'disabled';
 // letter, and Node's ESM loader reads `c:` as an unsupported URL scheme.
 const { handler } = await import(pathToFileURL(path.join(root, 'dist', 'server', 'entry.mjs')).href);
 
+/* ---------------------------------------------------------------------------------------
+   3. THE FORWARDED HEADERS THE ADAPTER DOES NOT READ
+   --------------------------------------------------------------------------------------- */
+
+/**
+ * Make the request look, to the adapter, like what the browser actually sent.
+ *
+ * `@astrojs/node` builds the URL of every request from the connection and the `Host`
+ * header alone — `astro/app/node`'s `createRequestFromNodeRequest`:
+ *
+ *     const isEncrypted = "encrypted" in req.socket && req.socket.encrypted;
+ *     const protocol = isEncrypted ? "https" : "http";
+ *
+ * `x-forwarded-proto` is never consulted on this path. (`security.allowedDomains` does not
+ * help: on this code path it gates only whether `Astro.clientAddress` may come from
+ * `x-forwarded-for`.)
+ *
+ * Behind a proxy that terminates TLS — which is how this site is deployed, and the only
+ * way it is deployed — that is fatal to the one route that accepts a POST. The browser
+ * sends `Origin: https://runicgateway.com`; the container computes `http://runicgateway.com`
+ * because its own socket is plaintext; and Astro's CSRF middleware compares the two for
+ * EQUALITY:
+ *
+ *     const isSameOrigin = request.headers.get("origin") === url.origin;
+ *
+ * So every beta signup, from every visitor, is answered `403 Cross-site POST form
+ * submissions are forbidden`. No proxy configuration can fix it — a proxy cannot make this
+ * container's socket encrypted — and nothing else on the site changes, so the symptom is a
+ * form that silently refuses everyone while fifty pages look perfectly healthy.
+ *
+ * Both headers are trusted unconditionally, with no flag to set. The image is meant to be
+ * deployed and work: it publishes on loopback for a proxy to reach, and an operator who has
+ * to discover a `TRUST_PROXY` variable to make the signup work is an operator who ships a
+ * dead form. Trusting them costs nothing here — a cross-site form submission cannot make a
+ * victim's browser send `x-forwarded-proto`, so the CSRF check is exactly as strong as it
+ * was, and the site has no cookie, session or credential to protect in the first place.
+ *
+ * `x-forwarded-host` is handled for the same reason at one remove: most proxies pass `Host`
+ * through untouched, but some rewrite it to the upstream address and put the real name here
+ * instead, which produces the identical mismatch.
+ */
+const firstForwarded = (value) => value?.toString().split(',')[0].trim();
+
+const applyForwardedHeaders = (req) => {
+  const proto = firstForwarded(req.headers['x-forwarded-proto']);
+  if (proto === 'https' && !req.socket.encrypted) {
+    // What `"encrypted" in req.socket` reads. Defined on the socket rather than passed
+    // along, because the adapter is given the raw request and looks there itself.
+    Object.defineProperty(req.socket, 'encrypted', { value: true, configurable: true });
+  }
+
+  const forwardedHost = firstForwarded(req.headers['x-forwarded-host']);
+  if (forwardedHost && !/[/\\]/.test(forwardedHost)) {
+    req.headers.host = forwardedHost;
+  }
+};
+
 const server = http.createServer((req, res) => {
+  applyForwardedHeaders(req);
+
   const policy = policies.get(normalise(req.url ?? '/'));
 
   for (const [key, value] of Object.entries(STATIC_HEADERS)) res.setHeader(key, value);