strip client-supplied X-Forwarded-For at the edge (#129) #168

Sammanfogat

supernaut sammanfogade 1 incheckning från feat/129-caddy-trusted-proxies in i main

2026-07-20 12:28:25 +00:00

supernaut kommenterad

2026-07-20 11:34:22 +00:00

Ägare

Closes #129. Caddy is the edge and (via socket activation #81) sees the real external client IP as the connection peer — a public address not in the internal podman subnet. Adding trusted_proxies {{ caddy_trusted_proxies }} (10.89.0.0/24) makes Caddy treat every real client as untrusted and overwrite rather than append their X-Forwarded-For, stripping spoofed hops at the edge (defence-in-depth alongside bitborg-web PR #60 and Forgejo's own REVERSE_PROXY_TRUSTED_PROXIES).

Applied to all three reverse_proxy blocks (www, kanidm, forgejo) for consistency, not just www — they all parse XFF and share the access log. Rendered Caddyfile validated with caddy validate (2.11.4). syntax-check + ansible-lint clean.

Closes #129. Caddy is the edge and (via socket activation #81) sees the real external client IP as the connection peer — a public address not in the internal podman subnet. Adding `trusted_proxies {{ caddy_trusted_proxies }}` (10.89.0.0/24) makes Caddy treat every real client as untrusted and **overwrite** rather than append their `X-Forwarded-For`, stripping spoofed hops at the edge (defence-in-depth alongside bitborg-web PR #60 and Forgejo's own `REVERSE_PROXY_TRUSTED_PROXIES`). Applied to **all three** reverse_proxy blocks (www, kanidm, forgejo) for consistency, not just www — they all parse XFF and share the access log. Rendered Caddyfile validated with `caddy validate` (2.11.4). syntax-check + ansible-lint clean.

supernaut tvångsskickade feat/129-caddy-trusted-proxies från de49b89724

ci / ci (pull_request) Successful in 2m42s

Detaljer

till 398b43b5de

ci / ci (pull_request) Successful in 2m35s

Detaljer

2026-07-20 12:09:47 +00:00

Jämför

supernaut sammanfogade incheckning 1d1e54d62d till main

2026-07-20 12:28:25 +00:00

supernaut tog bort grenen feat/129-caddy-trusted-proxies

2026-07-20 12:28:25 +00:00