wger: a stranger locks only the name they try, for 5 min — not every household member for 30 (R-752, 09 decision 58 — decided by CC unattended, operator may reverse)

django-axes keyed on ip_address, and behind the tunnel every visitor has the tunnel container's address (R-753).
Measured on 9202 (felhom.eu/documentation/audits/lockouts-2026-10-01/B/): live template — 10 wrong tries on admin
locked the second member too; with AXES_LOCKOUT_PARAMETERS=username, AXES_COOLOFF_TIME=5 and the database handler —
the second member unaffected, admin in again at 7.5 min after one retry during the lock, a wrong password still
refused. Settings only: no image moves, no ladder entry (gates OK).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/wger/docker-compose.yml

@@ -44,6 +44,14 @@ services:
       # R-738: the image runs `manage.py migrate` at start ONLY with this switch (entrypoint.sh). Without it an update
       # that brings migrations leaves wger serving its front page over an unmigrated database (login 500).
       - DJANGO_PERFORM_MIGRATIONS=True
+      # R-752 (decided by CC unattended 2026-10-01, `09` §3 decision 58 — operator may reverse): django-axes locked by
+      # ip_address, and behind the tunnel every visitor has the tunnel's address (R-753) — a stranger's 10 wrong tries
+      # locked out EVERY household member for 30 min. Now only the targeted name, for 5 min (each try during a lock
+      # restarts it — wger 2.7 hard-codes that — so short is kinder), counted in the database (the default cache
+      # handler warns axes.W001). Measured on 9202: the other member unaffected; the targeted one in again at 7.5 min.
+      - AXES_LOCKOUT_PARAMETERS=username
+      - AXES_COOLOFF_TIME=5
+      - AXES_HANDLER=axes.handlers.database.AxesDatabaseHandler
       - DJANGO_DB_ENGINE=django.db.backends.sqlite3
       - DJANGO_DB_DATABASE=/home/wger/db/database.sqlite
       - DJANGO_DB_USER=wger