With TRUSTED_PROXIES unset, the container's nginx now takes the client address from X-Forwarded-For on requests from 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, as sneak ruled on 2026-09-22 for every app. A list replaces the three ranges; set and empty, nginx trusts no proxy. Each entry is still checked as before, and the backend inside the container still trusts only 127.0.0.1/32.
Unset and empty differ only by ${TRUSTED_PROXIES-...} against ${TRUSTED_PROXIES:-...} in bin/entrypoint.sh. PORT just above uses :-; the comment says why this one does not.
The README's upaas section said an empty variable counts as unset. TRUSTED_PROXIES is now the exception: a deployment that passes it as an empty value gets no trusted proxy.
The Docker bridge gateway (172.17.0.1) is inside 172.16.0.0/12, so by default a client that reaches a published port through Docker's port proxy can write its own X-Forwarded-For. The README keeps that warning and now says the default includes the gateway.
Not covered by a test: the repo has no test of the entrypoint or of nginx, so the check was by hand, running the image built from this branch with requests from the host.
Model: opus-5-5
With `TRUSTED_PROXIES` unset, the container's nginx now takes the client address from `X-Forwarded-For` on requests from `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16`, as sneak ruled on 2026-09-22 for every app. A list replaces the three ranges; set and empty, nginx trusts no proxy. Each entry is still checked as before, and the backend inside the container still trusts only `127.0.0.1/32`.
Closes https://git.eeqj.de/sneak/netwatch/issues/119
What the diff does not show:
- Unset and empty differ only by `${TRUSTED_PROXIES-...}` against `${TRUSTED_PROXIES:-...}` in `bin/entrypoint.sh`. `PORT` just above uses `:-`; the comment says why this one does not.
- The README's upaas section said an empty variable counts as unset. `TRUSTED_PROXIES` is now the exception: a deployment that passes it as an empty value gets no trusted proxy.
- The Docker bridge gateway (`172.17.0.1`) is inside `172.16.0.0/12`, so by default a client that reaches a published port through Docker's port proxy can write its own `X-Forwarded-For`. The README keeps that warning and now says the default includes the gateway.
Not covered by a test: the repo has no test of the entrypoint or of nginx, so the check was by hand, running the image built from this branch with requests from the host.
Model: opus-5-5
PASS: this meets #119, and its only conflict with current next is in the Completed Steps of TODO.md, where this entry goes above the one for #124.
Model: opus-5-5
PASS: this meets https://git.eeqj.de/sneak/netwatch/issues/119, and its only conflict with current `next` is in the Completed Steps of `TODO.md`, where this entry goes above the one for https://git.eeqj.de/sneak/netwatch/issues/124.
Model: opus-5-5
With TRUSTED_PROXIES unset, bin/entrypoint.sh gives nginx one
set_real_ip_from line for each of 10.0.0.0/8, 172.16.0.0/12 and
192.168.0.0/16, as sneak ruled on 2026-09-22 for every app. A list
replaces them, and set and empty trusts no proxy; each entry is checked
as before. The backend inside the container still trusts only
127.0.0.1/32. README.md, configs/nginx.conf and the comment in
script/frontend-viewport-test say the new default.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
With
TRUSTED_PROXIESunset, the container's nginx now takes the client address fromX-Forwarded-Foron requests from10.0.0.0/8,172.16.0.0/12and192.168.0.0/16, as sneak ruled on 2026-09-22 for every app. A list replaces the three ranges; set and empty, nginx trusts no proxy. Each entry is still checked as before, and the backend inside the container still trusts only127.0.0.1/32.Closes #119
What the diff does not show:
${TRUSTED_PROXIES-...}against${TRUSTED_PROXIES:-...}inbin/entrypoint.sh.PORTjust above uses:-; the comment says why this one does not.TRUSTED_PROXIESis now the exception: a deployment that passes it as an empty value gets no trusted proxy.172.17.0.1) is inside172.16.0.0/12, so by default a client that reaches a published port through Docker's port proxy can write its ownX-Forwarded-For. The README keeps that warning and now says the default includes the gateway.Not covered by a test: the repo has no test of the entrypoint or of nginx, so the check was by hand, running the image built from this branch with requests from the host.
Model: opus-5-5
PASS: this meets #119 and is ready to merge into
next.Model: opus-5-5
47b5ccd682tod568153af0PASS: this meets #119, and its only conflict with current
nextis in the Completed Steps ofTODO.md, where this entry goes above the one for #124.Model: opus-5-5
d568153af0tof43cd9f5a0