From 0887fa233c0fb3b98dbd46ae54decb7de00c5769 Mon Sep 17 00:00:00 2001
From: Arvind Prabhakar <arvind.prabhakar@symcrest.com>
Date: Sat, 5 Sep 2026 20:57:12 +0000
Subject: [PATCH] Enforce HTTPS canonical Studio routes

---
 infrastructure/gateway/envoy/routes/forgejo.yaml  |  1 +
 .../gateway/envoy/routes/openproject.yaml         | 15 ++++++++++++++-
 infrastructure/gateway/envoy/routes/pgadmin.yaml  |  1 +
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/infrastructure/gateway/envoy/routes/forgejo.yaml b/infrastructure/gateway/envoy/routes/forgejo.yaml
index 96929b4..82de0ba 100644
--- a/infrastructure/gateway/envoy/routes/forgejo.yaml
+++ b/infrastructure/gateway/envoy/routes/forgejo.yaml
@@ -17,6 +17,7 @@ spec:
       filters:
         - type: RequestRedirect
           requestRedirect:
+            scheme: https
             path:
               type: ReplaceFullPath
               replaceFullPath: /services/studio/forgejo/
diff --git a/infrastructure/gateway/envoy/routes/openproject.yaml b/infrastructure/gateway/envoy/routes/openproject.yaml
index 544e614..81fd104 100644
--- a/infrastructure/gateway/envoy/routes/openproject.yaml
+++ b/infrastructure/gateway/envoy/routes/openproject.yaml
@@ -12,8 +12,21 @@ spec:
   rules:
     - matches:
         - path:
-            type: PathPrefix
+            type: Exact
             value: /services/studio/openproject
+      filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /services/studio/openproject/
+            statusCode: 301
+
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /services/studio/openproject/
       backendRefs:
         - name: openproject
           port: 8080
diff --git a/infrastructure/gateway/envoy/routes/pgadmin.yaml b/infrastructure/gateway/envoy/routes/pgadmin.yaml
index 80e62b0..7ed3f53 100644
--- a/infrastructure/gateway/envoy/routes/pgadmin.yaml
+++ b/infrastructure/gateway/envoy/routes/pgadmin.yaml
@@ -17,6 +17,7 @@ spec:
       filters:
         - type: RequestRedirect
           requestRedirect:
+            scheme: https
             path:
               type: ReplaceFullPath
               replaceFullPath: /services/studio/pgadmin/