[bug]: Helm chart generates incorrect HTTP URLs when `web_url` is set to HTTPS behind a reverse proxy

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

When deploying Plane using the Helm chart, web_url can be configured with an HTTPS URL because the application is accessed externally through a reverse proxy that provides TLS termination.

Example:

web_url: "https://plane.example.com"

In this setup, the Kubernetes ingress does not have a TLS certificate configured directly, because HTTPS is handled by the external reverse proxy.

However, some generated manifest values are rendered with http:// instead of preserving the https:// value configured in web_url.

Affected values include:

APP_BASE_URL: "http://plane.example.com"
SILO_API_BASE_URL: "http://plane.example.com"

This causes some application flows to use the wrong base URL.

For example, when configuring GitLab Enterprise authentication, the redirect or callback URL is generated using http:// instead of https://.

As a result, the authentication flow fails because GitLab expects the HTTPS callback URL, but Plane uses an HTTP URL.

The expected behavior is that, when web_url is explicitly configured with https://, all generated base URLs and authentication callback URLs should also use HTTPS, even when TLS is terminated outside the Kubernetes ingress.

Steps to reproduce

1. Deploy Plane using the Helm chart.

2. Configure web_url with an HTTPS URL:

web_url: "https://plane.example.com"

3. Do not configure TLS directly on the Kubernetes ingress, because HTTPS is handled by an external reverse proxy.

4. Apply the Helm chart.

5. Inspect the generated manifests or environment variables.

6. Check the values generated for:

APP_BASE_URL
SILO_API_BASE_URL

7. Notice that one or more generated URLs use http:// instead of preserving the configured https:// value.

8. Configure GitLab Enterprise authentication.

9. Try to authenticate through GitLab.

10. Notice that the redirect or callback flow uses HTTP instead of HTTPS, causing the authentication flow to fail.

Expected result:

If web_url is set to:

https://plane.example.com

Then generated values such as APP_BASE_URL, SILO_API_BASE_URL, and authentication callback URLs should also use:

https://plane.example.com

Environment

Production

Browser

None

Variant

Self-hosted

Version

2.4.5