The backend's own TRUSTED_PROXIES handling differs from sneak's ruling of 2026-09-22 for every app: unset trusts the RFC 1918 ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, an explicit list replaces that, and an explicitly empty value trusts nothing.
On next at b1eefe0, backend/internal/config/config.go: the default (line 29) also trusts 127.0.0.1/32 and ::1/128, and since viper reads an empty environment variable as unset, TRUSTED_PROXIES= gets that default instead of trusting nothing. In the image this does not show, because bin/entrypoint.sh starts the backend with TRUSTED_PROXIES=127.0.0.1/32; it shows when the backend runs on its own (make run). Found in the review of #121.
Severity: low.
Definition of done
Unset, the backend trusts exactly the three RFC 1918 ranges; set and empty, it trusts nothing; a list replaces the default. A value it cannot parse still stops the start with an error naming TRUSTED_PROXIES.
The image still starts the backend with TRUSTED_PROXIES=127.0.0.1/32.
Tests cover unset, empty and a list.
The docs that state the backend's default say the new one; TODO.md updated in the same commit; commit title ends (closes #N).
Model: opus-5-5
The backend's own `TRUSTED_PROXIES` handling differs from sneak's ruling of 2026-09-22 for every app: unset trusts the RFC 1918 ranges `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16`, an explicit list replaces that, and an explicitly empty value trusts nothing.
On `next` at `b1eefe0`, `backend/internal/config/config.go`: the default (line 29) also trusts `127.0.0.1/32` and `::1/128`, and since viper reads an empty environment variable as unset, `TRUSTED_PROXIES=` gets that default instead of trusting nothing. In the image this does not show, because `bin/entrypoint.sh` starts the backend with `TRUSTED_PROXIES=127.0.0.1/32`; it shows when the backend runs on its own (`make run`). Found in the review of https://git.eeqj.de/sneak/netwatch/pulls/121.
Severity: low.
## Definition of done
- Unset, the backend trusts exactly the three RFC 1918 ranges; set and empty, it trusts nothing; a list replaces the default. A value it cannot parse still stops the start with an error naming `TRUSTED_PROXIES`.
- The image still starts the backend with `TRUSTED_PROXIES=127.0.0.1/32`.
- Tests cover unset, empty and a list.
- The docs that state the backend's default say the new one; `TODO.md` updated in the same commit; commit title ends ` (closes #N)`.
Model: opus-5-5
clawbot
self-assigned this 2026-10-14 11:13:38 +02:00
#136: unset, the backend trusts the three RFC 1918 ranges and no longer loopback; a list replaces them; set and empty, it trusts no proxy. This one setting is read with os.LookupEnv first, because viper's AllowEmptyEnv would also make an empty PORT or DEBUG stop the start. The image still starts the backend with TRUSTED_PROXIES=127.0.0.1/32.
Model: opus-5-5
https://git.eeqj.de/sneak/netwatch/pulls/136: unset, the backend trusts the three RFC 1918 ranges and no longer loopback; a list replaces them; set and empty, it trusts no proxy. This one setting is read with `os.LookupEnv` first, because viper's `AllowEmptyEnv` would also make an empty `PORT` or `DEBUG` stop the start. The image still starts the backend with `TRUSTED_PROXIES=127.0.0.1/32`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The backend's own
TRUSTED_PROXIEShandling differs from sneak's ruling of 2026-09-22 for every app: unset trusts the RFC 1918 ranges10.0.0.0/8,172.16.0.0/12and192.168.0.0/16, an explicit list replaces that, and an explicitly empty value trusts nothing.On
nextatb1eefe0,backend/internal/config/config.go: the default (line 29) also trusts127.0.0.1/32and::1/128, and since viper reads an empty environment variable as unset,TRUSTED_PROXIES=gets that default instead of trusting nothing. In the image this does not show, becausebin/entrypoint.shstarts the backend withTRUSTED_PROXIES=127.0.0.1/32; it shows when the backend runs on its own (make run). Found in the review of #121.Severity: low.
Definition of done
TRUSTED_PROXIES.TRUSTED_PROXIES=127.0.0.1/32.TODO.mdupdated in the same commit; commit title ends(closes #N).Model: opus-5-5
#136: unset, the backend trusts the three RFC 1918 ranges and no longer loopback; a list replaces them; set and empty, it trusts no proxy. This one setting is read with
os.LookupEnvfirst, because viper'sAllowEmptyEnvwould also make an emptyPORTorDEBUGstop the start. The image still starts the backend withTRUSTED_PROXIES=127.0.0.1/32.Model: opus-5-5