Fix: database pool max clients limits and CSRF

videocaller/videocaller/settings.py

@@ -46,10 +46,14 @@ hf_space_host = os.environ.get('SPACE_HOST')
 if hf_space_host and hf_space_host not in ALLOWED_HOSTS:
     ALLOWED_HOSTS.append(hf_space_host)
 
+# Always trust the known external hosts for CSRF, even if DEBUG is True
+CSRF_TRUSTED_ORIGINS = [f'https://{host}' for host in ALLOWED_HOSTS if host not in ['localhost', '127.0.0.1']]
+
+# Important for reverse proxies (like HuggingFace Spaces and Render)
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+
 # Trust Render.com proxy headers
 if not DEBUG:
-    CSRF_TRUSTED_ORIGINS = [f'https://{host}' for host in ALLOWED_HOSTS if host not in ['localhost', '127.0.0.1']]
-    SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
     SECURE_SSL_REDIRECT = True
     SESSION_COOKIE_SECURE = True
     CSRF_COOKIE_SECURE = True
@@ -116,7 +120,7 @@ if database_url:
     DATABASES = {
         'default': dj_database_url.config(
             default=database_url,
-            conn_max_age=600,
+            conn_max_age=0,  # Disabled for serverless pooler compatibility (Supabase)
             conn_health_checks=True,
         )
     }