From da7a11eb3bf2d0203eb9cc88cc8ad367d29b0a03 Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Tue, 5 May 2026 22:51:19 +0100 Subject: [PATCH] fix: strip conditional headers in bot-block-proxy to fix CalDAV sync nginx's not_modified_filter evaluated If-Match headers forwarded by Traefik's forwardAuth, returning 412 and breaking CalDAV VTODO updates from macOS/iOS Reminders. Switch to OpenResty and clear conditional headers with Lua before proxy processing. --- stacks/traefik/modules/traefik/main.tf | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/stacks/traefik/modules/traefik/main.tf b/stacks/traefik/modules/traefik/main.tf index 14d0e907..8be8b10a 100644 --- a/stacks/traefik/modules/traefik/main.tf +++ b/stacks/traefik/modules/traefik/main.tf @@ -307,6 +307,12 @@ resource "kubernetes_config_map" "bot_block_proxy_config" { server { listen 8080; location /auth { + access_by_lua_block { + ngx.req.clear_header("If-Match") + ngx.req.clear_header("If-None-Match") + ngx.req.clear_header("If-Modified-Since") + ngx.req.clear_header("If-Unmodified-Since") + } proxy_pass http://poison_fountain; proxy_connect_timeout 3s; proxy_read_timeout 5s; @@ -373,7 +379,7 @@ resource "kubernetes_deployment" "bot_block_proxy" { } container { name = "nginx" - image = "nginx:1-alpine" + image = "openresty/openresty:alpine" port { container_port = 8080