From 3bb2e576869a0f2cdc51aafe4679d3c6b1588b78 Mon Sep 17 00:00:00 2001
From: Han <apricot13@users.noreply.github.com>
Date: Tue, 2 Jan 2024 16:39:04 +0000
Subject: [PATCH] add in FORCE_SSL env var

---
 docker-compose.production.yml | 1 +
 index.js                      | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/docker-compose.production.yml b/docker-compose.production.yml
index ab9dc13..77911b4 100644
--- a/docker-compose.production.yml
+++ b/docker-compose.production.yml
@@ -21,6 +21,7 @@ services:
     environment:
       NODE_ENV: production
       DB_URI: mongodb://mongo:27017/outpost_api
+      FORCE_SSL: true
     networks:
       - outpost_api_internal_network
       - outpost_api_external_network
diff --git a/index.js b/index.js
index bcb2035..6e2dc00 100644
--- a/index.js
+++ b/index.js
@@ -21,9 +21,13 @@ connect(() =>
 
 server.set("trust proxy", 1)
 
+// outside of dev environment if we send FORCE_SSL then SSL is forced
 if (!isDevelopment) {
-  server.use(forceSSL)
+  if (process.env.FORCE_SSL && process.env.FORCE_SSL.toLowerCase() === "true") {
+    server.use(forceSSL)
+  }
 }
+
 server.use(
   rateLimit({
     windowMs: 15 * 60 * 1000,