nginx: trust X-Forwarded-For only from TRUSTED_PROXIES (closes #64)

nginx trusted X-Forwarded-For from every RFC1918 address, so a client
reaching it from one could write a new address on each request and
get a fresh rate-limit allowance. The container's TRUSTED_PROXIES now
names the reverse proxies nginx trusts, none by default.
bin/entrypoint.sh makes each entry a CIDR, checks it with the new
"netwatch-server check-cidr", which runs the server's own
TRUSTED_PROXIES parsing, and writes one set_real_ip_from line per
entry into /etc/nginx/trusted-proxies.conf, which nginx.conf includes.
The backend is started with TRUSTED_PROXIES=127.0.0.1/32, since nginx
is its only client. The viewport test mounts an empty file there.

Model: opus-5-5

TODO.md

@@ -32,13 +32,6 @@ latest run passes.
   an entry that is not an IP address or CIDR, as `netwatch-server check-cidr`
   finds; it starts the backend with `TRUSTED_PROXIES=127.0.0.1/32`, since nginx
   is its only client
-- 2026-09-29: report file names can no longer collide (issue #61): each is
-  `reports-<timestamp>-<number>.jsonl.zst`, where the number goes up by one for
-  each file the server starts to write, so two flushes in the same millisecond,
-  such as a flush for size and the final flush at shutdown, each get a file of
-  their own instead of the second one failing. A failed write uses up its
-  number, leaving a gap if the file could not be created and otherwise a file
-  under that number that may be incomplete.
 - 2026-09-29: ready to run under upaas (issue #59): the image has a
   `HEALTHCHECK` that requests `/.well-known/healthcheck` through nginx on the
   port from `PORT`. The backend no longer reads a bad `PORT` as 0 or a bad

backend/README.md

@@ -118,14 +118,9 @@ it as this server parses its own `TRUSTED_PROXIES`.
 
 ### Report storage
 
-Reports are written as `reports-<timestamp>-<number>.jsonl.zst` files in
+Reports are written as `reports-<timestamp>.jsonl.zst` files in `DATA_DIR`.
-`DATA_DIR`. The timestamp is in UTC to the millisecond, so the names sort by
+Each file contains one JSON object per line, compressed with zstd. Files are
-time. The number starts at 1 when the server starts and goes up by one for each
+created with `O_EXCL` to prevent overwrites.
-file the server starts to write, so two files written in the same millisecond
-still get different names. A failed write uses up its number, leaving a gap in
-the numbers if the file could not be created and otherwise a file under that
-number that may be incomplete. Each file contains one JSON object per line,
-compressed with zstd. Files are created with `O_EXCL` to prevent overwrites.
 
 ### Report limits
 

backend/internal/reportbuf/export_test.go

@@ -1,15 +1,7 @@
 package reportbuf
 
-import "time"
-
 // Flush writes the buffered reports to a file now, as the periodic
 // flush does, so tests need not wait a minute for it.
 func (b *Buffer) Flush() error {
 	return b.flushLocked()
 }
-
-// StopClock makes every report file the buffer writes from now on
-// carry the timestamp at, as if all were written in one millisecond.
-func (b *Buffer) StopClock(at time.Time) {
-	b.now = func() time.Time { return at }
-}

backend/internal/reportbuf/reportbuf.go

@@ -14,7 +14,6 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
-	"sync/atomic"
 	"time"
 
 	"sneak.berlin/go/netwatch/internal/config"
@@ -31,8 +30,7 @@ const (
 	dirPerms           fs.FileMode = 0o750
 	filePerms          fs.FileMode = 0o640
 
-	// Report files are named filePrefix + timestamp + "-" + number +
+	// Report files are named filePrefix + timestamp + fileSuffix.
-	// fileSuffix; see writeFile.
 	filePrefix = "reports-"
 	fileSuffix = ".jsonl.zst"
 )
@@ -58,12 +56,6 @@ type Buffer struct {
 	log      *slog.Logger
 	maxBytes int64
 	mu       sync.Mutex
-	// now is the clock report files are named by: time.Now, except
-	// in tests that need two flushes to share a timestamp.
-	now func() time.Time
-	// seq numbers the report files, so that two named in the same
-	// millisecond still get different names.
-	seq      atomic.Uint64
 	stopOnce sync.Once
 	// usedBytes is what Append checks against maxBytes: the size
 	// of the report files in dataDir, plus the reports not yet
@@ -87,7 +79,6 @@ func New(
 		done:     make(chan struct{}),
 		log:      params.Logger.Get(),
 		maxBytes: params.Config.DataDirMaxBytes,
-		now:      time.Now,
 	}
 
 	lc.Append(fx.Hook{
@@ -220,14 +211,11 @@ func (b *Buffer) drainBuf() []byte {
 // writeFile creates a timestamped zstd-compressed JSONL file
 // in the data directory.
 func (b *Buffer) writeFile(data []byte) error {
-	// The timestamp comes first, so the names sort by time; the number
+	ts := time.Now().UTC().Format("2006-01-02T15-04-05.000Z")
-	// after it tells apart files named in the same millisecond.
+	path := filepath.Join(b.dataDir, filePrefix+ts+fileSuffix)
-	ts := b.now().UTC().Format("2006-01-02T15-04-05.000Z")
-	name := fmt.Sprintf("%s%s-%d%s", filePrefix, ts, b.seq.Add(1), fileSuffix)
-	path := filepath.Join(b.dataDir, name)
 
 	// path is built from the operator-supplied dataDir plus a
-	// generated timestamp and number, so it carries no external input.
+	// generated timestamp, so it carries no external input.
 	f, err := os.OpenFile( //nolint:gosec // see comment above
 		path,
 		os.O_WRONLY|os.O_CREATE|os.O_EXCL,

backend/internal/reportbuf/reportbuf_test.go

@@ -3,11 +3,9 @@ package reportbuf_test
 import (
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io/fs"
 	"os"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -20,7 +18,6 @@ import (
 	"sneak.berlin/go/netwatch/internal/logger"
 	"sneak.berlin/go/netwatch/internal/reportbuf"
 
-	"github.com/klauspost/compress/zstd"
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
 )
@@ -213,6 +210,10 @@ func TestWrittenReportsCountAtFileSize(t *testing.T) {
 		t.Fatalf("flush: %v", err)
 	}
 
+	// The second report is written at shutdown, and must not land in
+	// the first file's millisecond (see TestWrittenReportsKeepCounting).
+	time.Sleep(time.Millisecond)
+
 	err = buf.Append(report)
 	if err != nil {
 		t.Fatalf("second report, after the first was written: %v", err)
@@ -253,6 +254,10 @@ func TestWrittenReportsKeepCounting(t *testing.T) {
 			t.Fatalf("with %d bytes of report files: %v", used, err)
 		}
 
+		// Report files are named to the millisecond; two in the same
+		// one collide (https://git.eeqj.de/sneak/netwatch/issues/61).
+		time.Sleep(time.Millisecond)
+
 		err = buf.Flush()
 		if err != nil {
 			t.Fatalf("flush: %v", err)
@@ -310,43 +315,6 @@ func TestConcurrentAppendsStopAtCap(t *testing.T) {
 	}
 }
 
-// TestTwoFlushesInOneMillisecond flushes twice within one millisecond,
-// as a flush for size and the final flush at shutdown can: each flush
-// must write a file of its own, and the files must hold every report.
-func TestTwoFlushesInOneMillisecond(t *testing.T) {
-	const flushes = 2
-
-	dir := t.TempDir()
-	t.Setenv("DATA_DIR", dir)
-
-	buf := startBuffer(t)
-	buf.StopClock(time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC))
-
-	for id := 1; id <= flushes; id++ {
-		err := buf.Append(map[string]int{"id": id})
-		if err != nil {
-			t.Fatalf("append report %d: %v", id, err)
-		}
-
-		err = buf.Flush()
-		if err != nil {
-			t.Fatalf("flush %d: %v", id, err)
-		}
-	}
-
-	files := readReportFiles(t, dir)
-	if len(files) != flushes {
-		t.Fatalf("%d report files after %d flushes", len(files), flushes)
-	}
-
-	for id := 1; id <= flushes; id++ {
-		want := fmt.Sprintf(`{"id":%d}`+"\n", id)
-		if !slices.Contains(files, want) {
-			t.Fatalf("no report file holds report %d alone", id)
-		}
-	}
-}
-
 // reportFilesBytes returns the total size of the report files in dir.
 func reportFilesBytes(t *testing.T, dir string) int64 {
 	t.Helper()
@@ -370,43 +338,6 @@ func reportFilesBytes(t *testing.T, dir string) int64 {
 	return total
 }
 
-// readReportFiles returns the decompressed contents of each report
-// file in dir.
-func readReportFiles(t *testing.T, dir string) []string {
-	t.Helper()
-
-	files := os.DirFS(dir)
-
-	names, err := fs.Glob(files, "reports-*.jsonl.zst")
-	if err != nil {
-		t.Fatalf("list report files: %v", err)
-	}
-
-	dec, err := zstd.NewReader(nil)
-	if err != nil {
-		t.Fatalf("create zstd decoder: %v", err)
-	}
-	defer dec.Close()
-
-	contents := make([]string, 0, len(names))
-
-	for _, name := range names {
-		compressed, readErr := fs.ReadFile(files, name)
-		if readErr != nil {
-			t.Fatalf("read %s: %v", name, readErr)
-		}
-
-		data, decErr := dec.DecodeAll(compressed, nil)
-		if decErr != nil {
-			t.Fatalf("decompress %s: %v", name, decErr)
-		}
-
-		contents = append(contents, string(data))
-	}
-
-	return contents
-}
-
 func writeBytes(t *testing.T, path string, n int) {
 	t.Helper()