it's showing the ip of the reverse proxy. it needs to parse XFF
```
{"@meta":{"api_version":1,"execution_time":"0 ms","time_zone":"UTC"},"data":{"query":"172.19.0.14","results":[{"blocklists":[],"ip":"172.19.0.14","ptr":["traefik.fsn1app1-network"]}]},"status":"ok"}
```
TRUSTED_PROXIES unset: the trusted proxies are all RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Your traefik at 172.19.0.14 is then trusted with no setting.
TRUSTED_PROXIES set to a list: that list replaces the default.
TRUSTED_PROXIES set but empty: no proxy is trusted.
X-Forwarded-For is read only when the direct peer is a trusted proxy, so a client connecting directly cannot set its own address.
/ip/, the curl card on / and the request log all use this one resolution.
Model: opus-5-5
Plan, by the standing rule for every app:
- `TRUSTED_PROXIES` unset: the trusted proxies are all RFC 1918 addresses (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`). Your traefik at `172.19.0.14` is then trusted with no setting.
- `TRUSTED_PROXIES` set to a list: that list replaces the default.
- `TRUSTED_PROXIES` set but empty: no proxy is trusted.
- `X-Forwarded-For` is read only when the direct peer is a trusted proxy, so a client connecting directly cannot set its own address.
- `/ip/`, the `curl` card on `/` and the request log all use this one resolution.
Model: opus-5-5
clawbot
self-assigned this 2026-10-27 18:42:27 +01:00
Built in #205, as planned above. Only the default was missing: the code that reads X-Forwarded-For was already right. Once deployed, your instance needs no TRUSTED_PROXIES setting.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/routewatch/pulls/205, as planned above. Only the default was missing: the code that reads `X-Forwarded-For` was already right. Once deployed, your instance needs no `TRUSTED_PROXIES` setting.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
it's showing the ip of the reverse proxy. it needs to parse XFF
Plan, by the standing rule for every app:
TRUSTED_PROXIESunset: the trusted proxies are all RFC 1918 addresses (10.0.0.0/8,172.16.0.0/12,192.168.0.0/16). Your traefik at172.19.0.14is then trusted with no setting.TRUSTED_PROXIESset to a list: that list replaces the default.TRUSTED_PROXIESset but empty: no proxy is trusted.X-Forwarded-Foris read only when the direct peer is a trusted proxy, so a client connecting directly cannot set its own address./ip/, thecurlcard on/and the request log all use this one resolution.Model: opus-5-5
Built in #205, as planned above. Only the default was missing: the code that reads
X-Forwarded-Forwas already right. Once deployed, your instance needs noTRUSTED_PROXIESsetting.Model: opus-5-5