clawbot 16d01d5326 nginx: trust X-Forwarded-For only from TRUSTED_PROXIES (closes #64) ...

nginx trusted X-Forwarded-For from every RFC1918 address, so a client
reaching it from one could write a new address on each request and
get a fresh rate-limit allowance. The container's TRUSTED_PROXIES now
names the reverse proxies nginx trusts, none by default.
bin/entrypoint.sh refuses a value with a character no IP address or
CIDR has, and writes one set_real_ip_from line per entry into
/etc/nginx/trusted-proxies.conf, which nginx.conf includes. The
backend is started with TRUSTED_PROXIES=127.0.0.1/32, since nginx is
its only client. The viewport test mounts an empty file there.

Model: opus-5-5

2026-09-29 05:16:37 +00:00

..

config_test.go

upaas: health check, settings checked at start, README section (closes #59)

2026-09-29 06:39:10 +02:00

config.go

nginx: trust X-Forwarded-For only from TRUSTED_PROXIES (closes #64)

2026-09-29 05:16:37 +00:00