Correct configuration behind a proxy

[alfmos]

Hi all,
how are we supposed to manage secure csrf tokens behind a proxy?
Our hydra listens on localhost and it is behind nginx. Inside hydra.yml we put

tls:
allow_termination_from:
- 127.0.0.1/32

and of course we set --dangerous-force-http, or hydra wouldn't start.
As a result csrf cookies are insecure (Samesite in config is lax), and every time hydra starts it tells us that using --dangerous-force-http is really dangerous, and we shouldn't.
What would be the correct configuration regarding cookies and http/https configuration? One that hydra finds well done?
thanks.
Command line is:

=/opt/hydra/bin/hydra -c /opt/hydra/config/hydra.yml serve all --dangerous-force-http

our hydra.yml:

serve:
  tls:
    allow_termination_from:
      - 127.0.0.1/32
  cookies:
    same_site_mode:  lax
    same_site_legacy_workaround: true
  admin:
    # host: localhost
    cors:
      max_age: 5000
      enabled: true
      allowed_origins:
        - http://localhost
        - http://localhost:4200
        - localhost:4200
        - localhost:8800
        - http://localhost:8800
        - https://new.dottnet.it
        - http://localhost:3000
      allowed_methods:
        - POST
        - GET
        - PUT
        - PATCH
        - DELETE
      allowed_headers:
        - Authorization
      exposed_headers:
        - Content-Type
  public:
          # host: https://new.dottnet.it
    cors:
      max_age: 5000
      enabled: true
      allowed_origins:
        - http://localhost
        - http://localhost:4200
        - localhost:4200
        - localhost:8800
        - http://localhost:8800
        - https://new.dottnet.it
        - http://localhost:3000
        - http://localhost:3000/
      allowed_methods:
        - POST
        - GET
        - PUT
        - PATCH
        - DELETE
      allowed_headers:
        - Authorization
      exposed_headers:
        - Content-Type

dsn: mysql://whatever
urls:
  self:
    issuer: http://127.0.0.1:4444
    public: https://new.dottnet.it/drclick/
  consent: https://new.dottnet.it/oauth/consent
  login: https://new.dottnet.it/oauth/login
  logout: https://new.dottnet.it/oauth/logout

secrets:
  system:
    - youReallyNeedToChangeThis

oidc:
  subject_identifiers:
    supported_types:

[vinckr]

Hello @alfmos
Can you omit --dangerous-force-http and not put Hydra behind the proxy?
You should expose the Public port (default 4444) but not the Administrative port (default 4445), as per the prepare for production documentation.
You can also serve the ports seperately https://www.ory.sh/docs/hydra/cli/hydra-serve-public , but using hydra serve all is recommended.