Troubleshooting

Troubleshooting

Real issues encountered and how they were resolved.

Swagger "Try it out" uses http behind the proxy

Cloud Run terminates TLS and forwards plain HTTP, so the app generated http:// URLs (browser blocks the mixed content). Fix: server.forward-headers-strategy=framework in the deployed profiles, so X-Forwarded-Proto/Host are honored. It's scoped to deployed profiles — enabling it globally strips X-Forwarded-For before the rate limiter and breaks the per-IP tests.

Static assets / API return 403 from the page but 200 directly

Vite <script type="module"> is fetched in CORS mode, so the browser sends an Origin even for same-origin requests. Spring's CORS filter rejected it because the deployed origin wasn't allow-listed. Fix: add the service's own origin to CORS_ALLOWED_ORIGINS.

App fails to start (JWT secret)

JWT_SECRET must be ≥ 32 bytes for HS256; the app fails fast otherwise. Provide it via Secret Manager in prod; bootRun and the test task inject a dev value.

Artifact Registry: "Project number is not supported"

The Artifact Registry API needs the project ID, not the project number — use the project ID for the Terraform provider.

docker buildx: permission denied on ~/.docker/buildx/...

Point buildx state at a writable dir: BUILDX_CONFIG=/tmp/buildx docker buildx build ....

/actuator/health is DOWN

The Redis health indicator fails when there's no Redis (the minimal deploy uses the in-memory limiter). It's disabled with management.health.redis.enabled=false.

Rate limiting looks "global" behind Cloud Run

With trust-forwarded-for=false, the limiter keys on the proxy's address rather than the end user. See Rate Limiting for how to wire the real client IP.