clawbot cbcde098dc Unset TRUSTED_PROXIES trusts the RFC 1918 ranges (closes #119) ...

With TRUSTED_PROXIES unset, bin/entrypoint.sh gives nginx one
set_real_ip_from line for each of 10.0.0.0/8, 172.16.0.0/12 and
192.168.0.0/16, as sneak ruled on 2026-09-22 for every app. A list
replaces them, and set and empty trusts no proxy; each entry is checked
as before. The backend inside the container still trusts only
127.0.0.1/32. README.md, configs/nginx.conf and the comment in
script/frontend-viewport-test say the new default.

Model: opus-5-5

2026-10-14 13:01:34 +02:00

..

nginx.conf

Unset TRUSTED_PROXIES trusts the RFC 1918 ranges (closes #119)

2026-10-14 13:01:34 +02:00

security-headers.conf

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00