From ca144ea84111d0910e930241e1e06bb9a8f9da1d Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 1 Oct 2026 22:02:11 +0200 Subject: [PATCH] =?UTF-8?q?bookstack:=20APP=5FPROXIES=3D172.16.0.0/12=20?= =?UTF-8?q?=E2=80=94=20the=20login=20throttle=20per=20visitor=20(R-753;=20?= =?UTF-8?q?decision=2059=20revisited=20now=20that=20the=20box=20passes=20e?= =?UTF-8?q?ach=20visitor)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Checklist 3.6 re-measured on 9202 through the simulated tunnel (felhom.eu audits/visitors-2026-10-01/A/bookstack-3.6.txt): without it, a stranger's 5 wrong tries for admin@admin.com throttled the household from another address too; with it, the stranger is throttled and the household signs in at once. A rotating forged leftmost address does not escape. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- templates/bookstack/docker-compose.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/templates/bookstack/docker-compose.yml b/templates/bookstack/docker-compose.yml index c9f60b4..67089fd 100644 --- a/templates/bookstack/docker-compose.yml +++ b/templates/bookstack/docker-compose.yml @@ -26,6 +26,10 @@ services: - DB_PASSWORD=${DB_PASSWORD} - DB_DATABASE=bookstack - APP_KEY=${APP_KEY} + # R-753 (controller >= 0.286.0): trust the docker networks as proxies, so Laravel walks X-Forwarded-For from the + # RIGHT and keys its login throttle on each VISITOR (tunnel: the real address; LAN: the LAN client). Measured on + # 9202: without it a stranger's 5 wrong tries throttled the household too; with it only the stranger. + - APP_PROXIES=172.16.0.0/12 - APP_URL=https://${SUBDOMAIN}.${DOMAIN} volumes: - bookstack_config:/config