fix #547: secure VM deployment behind HTTPS proxy

scripts/deploy-backoffice-vm.sh

@@ -27,6 +27,10 @@ Defaults:
   --remote-dir \$HOME/apps/vpd-backoffice
   --port       8082
 
+Production transport defaults are always applied on the VM:
+  bind address 127.0.0.1, forwarded headers enabled,
+  HTTPS required, Secure/HttpOnly/SameSite session cookie.
+
 The script uploads:
   - target/*.jar as app.jar
   - .env rewritten for the VM wallet path
@@ -111,6 +115,9 @@ if [[ "$DRY_RUN" == "Y" ]]; then
   log "dry-run: remote_dir=$REMOTE_DIR"
   log "dry-run: remote_wallet_dir=$REMOTE_WALLET_DIR"
   log "dry-run: port=$REMOTE_PORT"
+  log "dry-run: bind_address=127.0.0.1"
+  log "dry-run: require_https=true"
+  log "dry-run: session_cookie_secure=true"
   log "dry-run: local_wallet=$TNS_ADMIN"
   exit 0
 fi
@@ -144,6 +151,10 @@ export TNS_ADMIN="${REMOTE_WALLET_DIR}"
 export BACKOFFICE_DB_URL="jdbc:oracle:thin:@\${ADB_TNS}?TNS_ADMIN=\${TNS_ADMIN}"
 export BACKOFFICE_ORDS_DB_URL="\${BACKOFFICE_DB_URL}"
 export BACKOFFICE_PORT="${REMOTE_PORT}"
+export BACKOFFICE_BIND_ADDRESS="127.0.0.1"
+export BACKOFFICE_FORWARD_HEADERS_STRATEGY="framework"
+export BACKOFFICE_REQUIRE_HTTPS="true"
+export BACKOFFICE_SESSION_COOKIE_SECURE="true"
 ENVEOF
 chmod 600 "$TMP_DIR/.env"
 
@@ -222,7 +233,7 @@ if [[ "$START_APP" == "Y" ]]; then
   ssh "${SSH_ARGS[@]}" "$HOST" "\"$REMOTE_DIR\"/stop.sh || true; \"$REMOTE_DIR\"/start.sh; sleep 8; \"$REMOTE_DIR\"/status.sh"
 
   log "원격 헬스체크"
-  ssh "${SSH_ARGS[@]}" "$HOST" "curl -sS -o /tmp/vpd-backoffice-login.html -w '%{http_code}\n' http://127.0.0.1:${REMOTE_PORT}/login"
+  ssh "${SSH_ARGS[@]}" "$HOST" "curl -sS -H 'X-Forwarded-Proto: https' -H 'X-Forwarded-Host: localhost' -o /tmp/vpd-backoffice-login.html -w '%{http_code}\n' http://127.0.0.1:${REMOTE_PORT}/login"
 fi
 
 ok "배포 완료: $HOST:$REMOTE_DIR"