From 5f7bf7729ecb70b6ccbd8177c6d997cc91da927b Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 5 Oct 2026 21:17:31 +0200 Subject: [PATCH] R-776: vikunja sees each visitor behind the tunnel (trusted docker networks; 9202 checklist 3.6 re-measure owed) Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- templates/vikunja/docker-compose.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/templates/vikunja/docker-compose.yml b/templates/vikunja/docker-compose.yml index 5b1f8f7..9d2f329 100644 --- a/templates/vikunja/docker-compose.yml +++ b/templates/vikunja/docker-compose.yml @@ -19,6 +19,11 @@ services: - TZ=Europe/Budapest - VIKUNJA_SERVICE_PUBLICURL=https://${SUBDOMAIN}.${DOMAIN} - VIKUNJA_SERVICE_JWTSECRET=${VIKUNJA_SERVICE_JWTSECRET} + # R-776 (R-753, controller >= 0.286.0): the default `direct` reads the TCP peer (traefik) — one address for every + # visitor, so a stranger trips the login floor (10/min per address) for the household. `xff` walks X-Forwarded-For + # from the RIGHT skipping private addresses (echo's default trust): the tunnel's real visitor, or the LAN client. + # 9202 re-measure owed (checklist 3.6). + - VIKUNJA_SERVICE_IPEXTRACTIONMETHOD=xff volumes: - vikunja_data:/app/vikunja/files - vikunja_db:/db