From 639d1eaa4998896b1becb75e0ce4eb35d43846a9 Mon Sep 17 00:00:00 2001
From: King Omar <omar@bored.investments>
Date: Fri, 10 Jul 2026 15:08:24 +1000
Subject: [PATCH] Fix WP media proxy: use resolveOverride instead of raw IP
 fetch

Fetching https://[IP] fails SSL (cert is for the domain, not the IP).
Fetching http://[IP] may get upgraded to HTTPS by the zone policy.

resolveOverride lets Workers fetch the domain URL (TLS verifies correctly
against careersgateway.com.au) while routing the TCP connection directly
to the LiteSpeed origin at 62.169.17.14, bypassing the Worker route loop.
Allowed on any plan for hostnames belonging to the same zone.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/index.js | 29 ++++++-----------------------
 1 file changed, 6 insertions(+), 23 deletions(-)

diff --git a/src/index.js b/src/index.js
index e2a4bb8..45e7911 100644
--- a/src/index.js
+++ b/src/index.js
@@ -26,32 +26,15 @@ app.use('*', async (c, next) => {
 });
 
 // ── WordPress media proxy — serves /wp-content/* from origin host ────────────
+// Uses resolveOverride so TLS verifies against careersgateway.com.au (cert matches)
+// while the TCP connection goes directly to the LiteSpeed IP, bypassing the Worker loop.
 const WP_ORIGIN = '62.169.17.14';
 app.get('/wp-content/*', async c => {
-  const path = new URL(c.req.url).pathname + new URL(c.req.url).search;
-  const originUrl = `https://${WP_ORIGIN}${path}`;
-  const res = await fetch(originUrl, {
-    headers: {
-      'Host': 'careersgateway.com.au',
-      'User-Agent': 'Mozilla/5.0',
-    },
-    cf: { cacheTtl: 86400, cacheEverything: true },
+  const { pathname, search } = new URL(c.req.url);
+  const res = await fetch(`https://careersgateway.com.au${pathname}${search}`, {
+    cf: { resolveOverride: WP_ORIGIN, cacheTtl: 86400, cacheEverything: true },
   }).catch(() => null);
-  if (!res || !res.ok) {
-    // Fallback: try HTTP
-    const httpRes = await fetch(`http://${WP_ORIGIN}${path}`, {
-      headers: { 'Host': 'careersgateway.com.au' },
-    }).catch(() => null);
-    if (!httpRes || !httpRes.ok) return c.notFound();
-    return new Response(httpRes.body, {
-      status: httpRes.status,
-      headers: {
-        'Content-Type': httpRes.headers.get('Content-Type') || 'application/octet-stream',
-        'Cache-Control': 'public, max-age=86400',
-        'Access-Control-Allow-Origin': '*',
-      },
-    });
-  }
+  if (!res || !res.ok) return c.notFound();
   return new Response(res.body, {
     status: res.status,
     headers: {