Trust reverse proxies at private addresses by default (closes #198)

With TRUSTED_PROXIES unset, the server now trusts reverse proxies in the
private ranges of RFC 1918. A proxy such as traefik on a Docker network is
then believed. /ip/, the home page's curl card and the request log give the
client's address from X-Forwarded-For instead of the proxy's address.

A list in TRUSTED_PROXIES replaces the default. TRUSTED_PROXIES set but
empty trusts no proxy, so the config package reads it with os.LookupEnv.
A direct client at a public address still cannot choose its address with
a forged header.

Model: opus-5-5

README.md

@@ -469,19 +469,29 @@ Configuration is handled via environment variables and OS-specific paths:
 | `XDG_DATA_HOME`    | `/var/lib` (in the Docker image) | Base of the state directory; must be an absolute path       |
 | `GOMEMLIMIT`       | `2560MiB` (in the Docker image)  | Go soft memory limit; see Memory                            |
 | `MALLOC_ARENA_MAX` | `2` (in the Docker image)        | glibc malloc arena cap, a positive whole number; see Memory |
-| `TRUSTED_PROXIES`  | (empty)                          | Addresses and CIDR ranges of trusted proxies; see below     |
+| `TRUSTED_PROXIES`  | the RFC 1918 ranges              | Addresses and CIDR ranges of trusted proxies; see below     |
 
 A variable that is set to an invalid value stops the start with an error and a
-non-zero exit. An empty variable counts as unset.
+non-zero exit. An empty variable counts as unset. `TRUSTED_PROXIES` is the one
+exception: set but empty, it makes the server trust no proxy.
 
-`TRUSTED_PROXIES` lists the reverse proxies whose `X-Forwarded-For` the server
-believes, comma-separated, such as `10.0.0.0/8,192.0.2.1`. For a request from
-one of them, the request log and `/ip/` use the last address in
-`X-Forwarded-For` that is not a trusted proxy: each proxy adds the address it
-received the request from to the end, so the entries before it are whatever the
-client sent. For a request from any other address they use the address the
-request came from, whatever forwarding headers it carries. `X-Real-IP` and
-`True-Client-IP` are not read.
+`TRUSTED_PROXIES` names the reverse proxies whose `X-Forwarded-For` the server
+believes:
+
+- When it is not set, the server trusts the private ranges of RFC 1918:
+    - `10.0.0.0/8`
+    - `172.16.0.0/12`
+    - `192.168.0.0/16`
+- When it lists addresses and CIDR ranges, comma-separated, such as
+  `10.0.0.0/8,192.0.2.1`, the server trusts those instead.
+- When it is set but empty (`TRUSTED_PROXIES=`), the server trusts no proxy.
+
+For a request from a trusted proxy, the request log and `/ip/` use the last
+address in `X-Forwarded-For` that is not a trusted proxy. Each proxy adds the
+address it received the request from to the end, so the entries before it are
+whatever the client sent. For a request from any other address they use the
+address the request came from, whatever forwarding headers it carries.
+`X-Real-IP` and `True-Client-IP` are not read.
 
 State directory (the database and the blocklist copies):
 
@@ -575,12 +585,11 @@ What the [upaas](https://git.eeqj.de/sneak/upaas) app needs:
 
 - Container port: `8080`.
 - Volume: one, at container path `/var/lib/berlin.sneak.app.routewatch`.
-- Environment: `TRUSTED_PROXIES`, set to the address the reverse proxy in front
-  of the app connects from, as the container sees it; without it the request log
-  and `/ip/` give the proxy's address for every request. Nothing else is needed:
-  leave `XDG_DATA_HOME`, `GOMEMLIMIT` and `MALLOC_ARENA_MAX` at the image's
-  values. `DEBUG=routewatch` is optional and adds the `System stats` memory line
-  to the log.
+- Environment: nothing. The server trusts a reverse proxy at an RFC 1918 address
+  without `TRUSTED_PROXIES` (see Configuration). Set it only when the proxy
+  connects from any other address. Leave `XDG_DATA_HOME`, `GOMEMLIMIT` and
+  `MALLOC_ARENA_MAX` at the image's values. `DEBUG=routewatch` is optional and
+  adds the `System stats` memory line to the log.
 - Memory Limit: `5g`, the 5 GiB limit from Memory above. upaas sets no swap
   limit, so on a host with swap Docker allows the same amount of swap again.
 - Health check: the image's `HEALTHCHECK` requests