July 6 - Optimize codes

app/__init__.py

@@ -6,6 +6,7 @@ from flask_mail import Mail
 from flask_wtf.csrf import CSRFProtect
 from flask_limiter import Limiter
 from flask_limiter.util import get_remote_address
+from werkzeug.middleware.proxy_fix import ProxyFix
 from config import config
 import os
 import logging
@@ -30,6 +31,15 @@ def create_app(config_name='default'):
     app = Flask(__name__)
     app.config.from_object(config[config_name])
 
+    # ── Reverse-proxy awareness (Nginx) ──────────────────────────────────────
+    # Nginx terminates TLS and forwards requests over the loopback interface,
+    # setting X-Forwarded-For / X-Forwarded-Proto / X-Forwarded-Host. Without
+    # ProxyFix, request.remote_addr is always 127.0.0.1, which collapses every
+    # Flask-Limiter key into a single shared bucket (rate limits become global
+    # instead of per-client) and makes url_for(_external) emit http:// links.
+    # x_for=1 trusts exactly one proxy hop — our own Nginx.
+    app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)
+
     db.init_app(app)
     login_manager.init_app(app)
     migrate.init_app(app, db)
@@ -199,7 +209,6 @@ def create_app(config_name='default'):
     from app.api.notifications import bp as _api_notifications_bp
     from app.api.stats         import bp as _api_stats_bp
     from app.api.comments      import bp as _api_comments_bp
-    from app.api.devices       import bp as _api_devices_bp
     csrf.exempt(_api_auth_bp)
     csrf.exempt(_api_facilities_bp)
     csrf.exempt(_api_templates_bp)
@@ -209,7 +218,6 @@ def create_app(config_name='default'):
     csrf.exempt(_api_notifications_bp)
     csrf.exempt(_api_stats_bp)
     csrf.exempt(_api_comments_bp)
-    csrf.exempt(_api_devices_bp)
     register_api(app)
 
     # ── Security response headers ─────────────────────────────────────────