With TRUSTED_PROXIES unset, the container's nginx trusts no reverse proxy (bin/entrypoint.sh reads it as ${TRUSTED_PROXIES:-}, and nginx.conf and README.md say so). sneak ruled on 2026-09-22, for every app, that an unset trusted-proxy setting trusts the RFC 1918 ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16; an explicit list replaces that; an explicitly empty value trusts nothing.
What goes wrong today: deployed as the README says, behind a reverse proxy on a private address with TRUSTED_PROXIES unset, every visitor reaches nginx from the proxy's address, so all of them share one rate-limit allowance for reports and /metrics and the backend logs the proxy's address for everyone. The default came from #64.
Definition of done
bin/entrypoint.sh: unset TRUSTED_PROXIES gives nginx one set_real_ip_from line for each of the three RFC 1918 ranges; a set value replaces them; set and empty gives none. Entries are still checked as now.
The backend keeps trusting only 127.0.0.1/32 for what nginx passes it.
Verified by running the image: unset, a request from a private address with X-Forwarded-For is counted under the forwarded address; TRUSTED_PROXIES= (empty), it is counted under the peer address; a list, only those peers.
Every doc and comment that states the default (README files, the nginx config, the entrypoint) says the new one; TODO.md updated in the same commit; commit title ends (closes #N).
Model: opus-5-5
With `TRUSTED_PROXIES` unset, the container's nginx trusts no reverse proxy (`bin/entrypoint.sh` reads it as `${TRUSTED_PROXIES:-}`, and `nginx.conf` and `README.md` say so). sneak ruled on 2026-09-22, for every app, that an unset trusted-proxy setting trusts the RFC 1918 ranges `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16`; an explicit list replaces that; an explicitly empty value trusts nothing.
What goes wrong today: deployed as the README says, behind a reverse proxy on a private address with `TRUSTED_PROXIES` unset, every visitor reaches nginx from the proxy's address, so all of them share one rate-limit allowance for reports and `/metrics` and the backend logs the proxy's address for everyone. The default came from https://git.eeqj.de/sneak/netwatch/issues/64.
## Definition of done
- `bin/entrypoint.sh`: unset `TRUSTED_PROXIES` gives nginx one `set_real_ip_from` line for each of the three RFC 1918 ranges; a set value replaces them; set and empty gives none. Entries are still checked as now.
- The backend keeps trusting only `127.0.0.1/32` for what nginx passes it.
- Verified by running the image: unset, a request from a private address with `X-Forwarded-For` is counted under the forwarded address; `TRUSTED_PROXIES=` (empty), it is counted under the peer address; a list, only those peers.
- Every doc and comment that states the default (README files, the nginx config, the entrypoint) says the new one; `TODO.md` updated in the same commit; commit title ends ` (closes #N)`.
Model: opus-5-5
clawbot
self-assigned this 2026-10-14 10:43:16 +02:00
Built in #121: with TRUSTED_PROXIES unset, bin/entrypoint.sh gives nginx one set_real_ip_from line for each of 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16; a list replaces them, and set and empty gives none. The entry check is unchanged and the backend still trusts only 127.0.0.1/32. Both READMEs, nginx.conf, the entrypoint and script/frontend-viewport-test state the new default, and the README's upaas section names TRUSTED_PROXIES as the one variable where empty is not the same as unset.
The repo has no test of the entrypoint or nginx, so the check was by hand, running the image.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/netwatch/pulls/121: with `TRUSTED_PROXIES` unset, `bin/entrypoint.sh` gives nginx one `set_real_ip_from` line for each of `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16`; a list replaces them, and set and empty gives none. The entry check is unchanged and the backend still trusts only `127.0.0.1/32`. Both READMEs, `nginx.conf`, the entrypoint and `script/frontend-viewport-test` state the new default, and the README's upaas section names `TRUSTED_PROXIES` as the one variable where empty is not the same as unset.
The repo has no test of the entrypoint or nginx, so the check was by hand, running the image.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
With
TRUSTED_PROXIESunset, the container's nginx trusts no reverse proxy (bin/entrypoint.shreads it as${TRUSTED_PROXIES:-}, andnginx.confandREADME.mdsay so). sneak ruled on 2026-09-22, for every app, that an unset trusted-proxy setting trusts the RFC 1918 ranges10.0.0.0/8,172.16.0.0/12and192.168.0.0/16; an explicit list replaces that; an explicitly empty value trusts nothing.What goes wrong today: deployed as the README says, behind a reverse proxy on a private address with
TRUSTED_PROXIESunset, every visitor reaches nginx from the proxy's address, so all of them share one rate-limit allowance for reports and/metricsand the backend logs the proxy's address for everyone. The default came from #64.Definition of done
bin/entrypoint.sh: unsetTRUSTED_PROXIESgives nginx oneset_real_ip_fromline for each of the three RFC 1918 ranges; a set value replaces them; set and empty gives none. Entries are still checked as now.127.0.0.1/32for what nginx passes it.X-Forwarded-Foris counted under the forwarded address;TRUSTED_PROXIES=(empty), it is counted under the peer address; a list, only those peers.TODO.mdupdated in the same commit; commit title ends(closes #N).Model: opus-5-5
Built in #121: with
TRUSTED_PROXIESunset,bin/entrypoint.shgives nginx oneset_real_ip_fromline for each of10.0.0.0/8,172.16.0.0/12and192.168.0.0/16; a list replaces them, and set and empty gives none. The entry check is unchanged and the backend still trusts only127.0.0.1/32. Both READMEs,nginx.conf, the entrypoint andscript/frontend-viewport-teststate the new default, and the README's upaas section namesTRUSTED_PROXIESas the one variable where empty is not the same as unset.The repo has no test of the entrypoint or nginx, so the check was by hand, running the image.
Model: opus-5-5