R-776: zipline sees each visitor behind the tunnel (trusted docker networks; 9202 checklist 3.6 re-measure owed)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-05 21:17:31 +02:00
parent 462e66f0ca
commit ccc2be57f8
1 changed files with 6 additions and 0 deletions
@@ -19,6 +19,12 @@ services:
    environment:
      - TZ=Europe/Budapest
      - CORE_SECRET=${CORE_SECRET}
+      # R-776 (R-753, controller >= 0.286.0): Fastify's trustProxy with a CIDR list walks X-Forwarded-For from the RIGHT,
+      # skipping the docker networks — so the login limiter (7 / 10 s per address) keys on each VISITOR, not on traefik's
+      # one address for everybody. Never trustProxy=true without the list (that is the leftmost, client-written entry).
+      # 9202 re-measure owed (checklist 3.6).
+      - CORE_TRUST_PROXY=true
+      - CORE_TRUSTED_PROXIES=172.16.0.0/12
      # FIGYELEM: a v4 óta a DB változó neve DATABASE_URL (prefix NÉLKÜL), míg a
      # CORE_SECRET megtartotta a prefixet. A régi CORE_DATABASE_URL nevet a v4
      # már nem ismeri fel, és indulás nélkül kilép: