[P1.20] Terminate TLS in front of the services (they bind 0.0.0.0 over plaintext HTTP/ws)

[frankbria]

Severity: medium | Category: infra | Phase: P1.20

Problem

Frontend next start -H 0.0.0.0 and backend default host=0.0.0.0 with plaintext http:///ws:// URLs; remote-setup.sh installs no nginx/TLS/reverse proxy. On the shared VPS, JWT bearer tokens and API keys travel in cleartext on all interfaces.

Evidence

ecosystem.staging.config.js:34, codeframe/ui/server.py:783, .env.staging.example:23

Acceptance criteria

• A TLS-terminating reverse proxy (nginx/caddy) fronts the services; app processes bind 127.0.0.1.
• Provisioning sets up the proxy; documented origins are https:///wss://.

Dependencies

None

---

_{Filed from the SaaS launch-readiness audit. Atomic: one developer, one session. Work order: strictly P0.1 → P3.12 (no forward dependencies).}

[coderabbitai]

🔗 Related PRs

#709 - fix(security): shorten JWT lifetime to 24h + add web-UI CSP (#657) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!