From ccc2be57f8b40085fa502c7cda5e31feccc2e609 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 5 Oct 2026 21:17:31 +0200 Subject: [PATCH] R-776: zipline sees each visitor behind the tunnel (trusted docker networks; 9202 checklist 3.6 re-measure owed) Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- templates/zipline/docker-compose.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/templates/zipline/docker-compose.yml b/templates/zipline/docker-compose.yml index 2a48bcc..7a81c84 100644 --- a/templates/zipline/docker-compose.yml +++ b/templates/zipline/docker-compose.yml @@ -19,6 +19,12 @@ services: environment: - TZ=Europe/Budapest - CORE_SECRET=${CORE_SECRET} + # R-776 (R-753, controller >= 0.286.0): Fastify's trustProxy with a CIDR list walks X-Forwarded-For from the RIGHT, + # skipping the docker networks — so the login limiter (7 / 10 s per address) keys on each VISITOR, not on traefik's + # one address for everybody. Never trustProxy=true without the list (that is the leftmost, client-written entry). + # 9202 re-measure owed (checklist 3.6). + - CORE_TRUST_PROXY=true + - CORE_TRUSTED_PROXIES=172.16.0.0/12 # FIGYELEM: a v4 óta a DB változó neve DATABASE_URL (prefix NÉLKÜL), míg a # CORE_SECRET megtartotta a prefixet. A régi CORE_DATABASE_URL nevet a v4 # már nem ismeri fel, és indulás nélkül kilép: