Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333)

Unset or empty, TRUSTED_PROXIES now defaults to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, so a reverse proxy reaching webhooker from one of those ranges gets per-client rate-limit buckets with nothing set. A set value replaces the default entirely; an unparseable one still fails startup. The startup warning for an empty list is gone.

The README gives the default, one rule (if any client can reach webhooker, or the proxy in front of it, from an RFC 1918 source address, set the list to the proxy's address alone), and where to find that address: the remoteIP field of the http request log line. Loopback is not in the default.

Model: opus-5-5

internal/config/config.go

@@ -75,6 +75,11 @@ const (
 	// internet-exposed endpoint.
 	defaultReceiverRateLimit = 120
 
+	// defaultTrustedProxies is TRUSTED_PROXIES when it is unset: the
+	// RFC 1918 private ranges, which a reverse proxy reaching the
+	// process over a Docker network or a private LAN connects from.
+	defaultTrustedProxies = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+
 	// maxPort is the highest valid TCP port number. The lower
 	// bound (at least 1) is enforced by envPositiveInt.
 	maxPort = 65535
@@ -172,13 +177,14 @@ type Config struct {
 
 	// TrustedProxies is the set of networks whose members are
 	// allowed to speak for the client with X-Forwarded-For, the
-	// only forwarded header read. It is empty unless
-	// TRUSTED_PROXIES is set, and empty means no peer is
-	// trusted: forwarded headers are then ignored entirely and
-	// clients are identified by the connection's own address.
-	// Members can choose their own rate-limit key, so this must
-	// name proxy hosts only, never a block that also covers
-	// clients.
+	// only forwarded header read. Unless TRUSTED_PROXIES is set it
+	// is the RFC 1918 private ranges (defaultTrustedProxies); a set
+	// value replaces them. If any client can reach the process, or
+	// the proxy in front of it, from an RFC 1918 source address
+	// (directly, or through anything that can rewrite source
+	// addresses, such as NAT or a published container port), it
+	// must be set to the proxy's address alone, or every rate limit
+	// can be bypassed by those clients.
 	TrustedProxies []netip.Prefix
 
 	// AllowedEgressCIDRs is the set of networks a delivery target
@@ -460,14 +466,15 @@ func parseCIDR(entry string) (netip.Prefix, error) {
 
 // envPrefixList returns the value of the named environment variable
 // parsed as a comma-separated list of CIDR blocks (bare addresses
-// allowed). An unset, empty, or blank value yields an empty list. A
-// set value containing an unparseable entry is a hard error naming
-// the key and the bad entry, so startup fails loudly rather than
-// silently running with a list the operator did not intend.
-func envPrefixList(key string) ([]netip.Prefix, error) {
+// allowed). An unset, empty, or blank value is read as defaultValue
+// instead. A set value containing an unparseable entry is a hard
+// error naming the key and the bad entry, so startup fails loudly
+// rather than silently running with a list the operator did not
+// intend.
+func envPrefixList(key, defaultValue string) ([]netip.Prefix, error) {
 	v := strings.TrimSpace(os.Getenv(key))
 	if v == "" {
-		return nil, nil
+		v = defaultValue
 	}
 
 	var prefixes []netip.Prefix
@@ -681,12 +688,12 @@ func loadFromEnv() (*Config, error) {
 		return nil, err
 	}
 
-	trustedProxies, err := envPrefixList("TRUSTED_PROXIES")
+	trustedProxies, err := envPrefixList("TRUSTED_PROXIES", defaultTrustedProxies)
 	if err != nil {
 		return nil, err
 	}
 
-	allowedEgressCIDRs, err := envPrefixList("ALLOWED_EGRESS_CIDRS")
+	allowedEgressCIDRs, err := envPrefixList("ALLOWED_EGRESS_CIDRS", "")
 	if err != nil {
 		return nil, err
 	}
@@ -760,50 +767,6 @@ func (c *Config) warnEgressAllowlist(log *slog.Logger) {
 	)
 }
 
-// warnSharedRateLimitBucket logs a startup warning whenever
-// TRUSTED_PROXIES is empty, in any environment.
-//
-// With no trusted proxies every rate limiter keys on the connecting
-// peer's address. Whether that is harmless or dangerous depends on
-// what is in front of the process, which this code cannot observe:
-// with nothing in front, the peer is the client and the limits are
-// per-client as intended; behind a reverse proxy the peer is the proxy
-// for every request, so all clients share one bucket per limiter.
-//
-// The login endpoint no longer spends budget on arrival — it verifies
-// credentials first and charges only failures — so a shared bucket
-// cannot deny the operator a correct password. What it does collapse
-// is the failure counting: one client's wrong passwords throttle
-// everyone else's wrong passwords, and the receiver's limits become
-// service-wide ceilings.
-//
-// The warning is deliberately not gated on WEBHOOKER_ENVIRONMENT:
-// behind a proxy every client shares one bucket in dev and prod alike.
-//
-// The default of trusting nobody is deliberate — trusting forwarded
-// headers from arbitrary peers lets any client choose its own bucket —
-// so this warns rather than failing startup or changing the key.
-func (c *Config) warnSharedRateLimitBucket(log *slog.Logger) {
-	if len(c.TrustedProxies) > 0 {
-		return
-	}
-
-	log.Warn(
-		"TRUSTED_PROXIES is empty: every rate limit keys on the "+
-			"connecting peer's address. With nothing proxying to "+
-			"this process that is the client itself and the limits "+
-			"are per-client as intended. Behind a reverse proxy the "+
-			"peer is the proxy on every request, so all clients "+
-			"share one bucket per limit: the receiver limits become "+
-			"service-wide ceilings, and one client's failed logins "+
-			"throttle every other client's failed logins — a "+
-			"correct password still gets in. If anything proxies to "+
-			"this process, set TRUSTED_PROXIES to its address.",
-		"environment", c.Environment,
-		"trustedProxies", len(c.TrustedProxies),
-	)
-}
-
 // New creates a Config by reading environment variables.
 //
 //nolint:revive // lc parameter is required by fx even if unused.
@@ -849,7 +812,6 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		"hasMetricsAuth", s.MetricsAuthEnabled(),
 	)
 
-	s.warnSharedRateLimitBucket(log)
 	s.warnEgressAllowlist(log)
 
 	return s, nil