The backend's own TRUSTED_PROXIES now follows sneak's ruling of 2026-09-22 for every app (#129):
unset, it trusts 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, and no longer 127.0.0.1/32 or ::1/128
a list replaces that
set and empty, it trusts no proxy
viper reads an empty environment variable as unset, so TRUSTED_PROXIES= used to get the default. config.New now reads this one setting with os.LookupEnv first, and asks viper (config file, then default) only when the variable is unset. viper's AllowEmptyEnv is not used: it applies to every setting, so an empty PORT or DEBUG would stop the start instead of counting as unset, as README.md says it does.
What the diff does not show:
A value the backend cannot parse is still refused in middleware.New, with an error naming TRUSTED_PROXIES; that code is unchanged.
The image is unaffected: bin/entrypoint.sh still starts the backend with TRUSTED_PROXIES=127.0.0.1/32. Only runs outside the image, such as make run, see the new default, and a reverse proxy on the same host now has to be named.
#121 changes the container's nginx default in other sections of README.md; only the TODO.md entries will need a rebase for whichever lands second.
Disclosure: an earlier, unfinished run had pushed a commit to this branch without opening a PR. This replaces it, rebased onto the current next.
Model: opus-5-5
The backend's own `TRUSTED_PROXIES` now follows sneak's ruling of 2026-09-22 for every app (https://git.eeqj.de/sneak/netwatch/issues/129):
- unset, it trusts `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16`, and no longer `127.0.0.1/32` or `::1/128`
- a list replaces that
- set and empty, it trusts no proxy
viper reads an empty environment variable as unset, so `TRUSTED_PROXIES=` used to get the default. `config.New` now reads this one setting with `os.LookupEnv` first, and asks viper (config file, then default) only when the variable is unset. viper's `AllowEmptyEnv` is not used: it applies to every setting, so an empty `PORT` or `DEBUG` would stop the start instead of counting as unset, as `README.md` says it does.
What the diff does not show:
- A value the backend cannot parse is still refused in `middleware.New`, with an error naming `TRUSTED_PROXIES`; that code is unchanged.
- The image is unaffected: `bin/entrypoint.sh` still starts the backend with `TRUSTED_PROXIES=127.0.0.1/32`. Only runs outside the image, such as `make run`, see the new default, and a reverse proxy on the same host now has to be named.
- https://git.eeqj.de/sneak/netwatch/pulls/121 changes the container's nginx default in other sections of `README.md`; only the `TODO.md` entries will need a rebase for whichever lands second.
- Disclosure: an earlier, unfinished run had pushed a commit to this branch without opening a PR. This replaces it, rebased onto the current `next`.
Model: opus-5-5
PASS: unset, empty and a list of TRUSTED_PROXIES now behave as sneak's ruling of 2026-09-22 says, a value the backend cannot parse still stops the start naming TRUSTED_PROXIES, the image still gives the backend 127.0.0.1/32, and the docs agree with the code and with the container's nginx default from #121.
Disclosure: gated on this branch rebased onto the current next, with the TODO.md Completed Steps conflict resolved locally (both entries kept, this one on top); the branch itself still needs that rebase before it can merge.
Model: opus-5-5
PASS: unset, empty and a list of `TRUSTED_PROXIES` now behave as sneak's ruling of 2026-09-22 says, a value the backend cannot parse still stops the start naming `TRUSTED_PROXIES`, the image still gives the backend `127.0.0.1/32`, and the docs agree with the code and with the container's nginx default from https://git.eeqj.de/sneak/netwatch/pulls/121.
Disclosure: gated on this branch rebased onto the current `next`, with the `TODO.md` Completed Steps conflict resolved locally (both entries kept, this one on top); the branch itself still needs that rebase before it can merge.
Model: opus-5-5
The backend's own TRUSTED_PROXIES now follows the ruling for every app:
unset, it trusts 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, and no
longer loopback; a list replaces that; set and empty, it trusts no
proxy.
viper reads an empty environment variable as unset, so an empty value
got the default. config.New now reads this one setting with
os.LookupEnv first. viper's AllowEmptyEnv would apply to every setting,
so an empty PORT or DEBUG would stop the start instead of counting as
unset, as README.md says it does.
bin/entrypoint.sh still starts the backend with
TRUSTED_PROXIES=127.0.0.1/32.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The backend's own
TRUSTED_PROXIESnow follows sneak's ruling of 2026-09-22 for every app (#129):10.0.0.0/8,172.16.0.0/12and192.168.0.0/16, and no longer127.0.0.1/32or::1/128viper reads an empty environment variable as unset, so
TRUSTED_PROXIES=used to get the default.config.Newnow reads this one setting withos.LookupEnvfirst, and asks viper (config file, then default) only when the variable is unset. viper'sAllowEmptyEnvis not used: it applies to every setting, so an emptyPORTorDEBUGwould stop the start instead of counting as unset, asREADME.mdsays it does.What the diff does not show:
middleware.New, with an error namingTRUSTED_PROXIES; that code is unchanged.bin/entrypoint.shstill starts the backend withTRUSTED_PROXIES=127.0.0.1/32. Only runs outside the image, such asmake run, see the new default, and a reverse proxy on the same host now has to be named.README.md; only theTODO.mdentries will need a rebase for whichever lands second.next.Model: opus-5-5
PASS: unset, empty and a list of
TRUSTED_PROXIESnow behave as sneak's ruling of 2026-09-22 says, a value the backend cannot parse still stops the start namingTRUSTED_PROXIES, the image still gives the backend127.0.0.1/32, and the docs agree with the code and with the container's nginx default from #121.Disclosure: gated on this branch rebased onto the current
next, with theTODO.mdCompleted Steps conflict resolved locally (both entries kept, this one on top); the branch itself still needs that rebase before it can merge.Model: opus-5-5
2ecd1990edto0fb647e8be