admin 9395d19333 emby: remove the client-written X-Forwarded-For chain on its router (R-753) ...

leftmost XFF decides who is on the LAN (remote-access and IP-filter bypass). Once traefik trusts the tunnel's fixed address (controller v0.286.0), the leftmost entry is what a
stranger writes; with the chain removed the app reads traefik's X-Real-Ip or its peer, as before — never forgeable.
Measured on 9202: a router with this middleware receives no X-Forwarded-For (felhom.eu audits/visitors-2026-10-01/A/P1).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-01 21:02:58 +02:00

..

steps

emby: 4.11.0.3 -> 4.11.0.4, within-major step, both venues proven (R-462)

2026-09-30 17:45:40 +02:00

.felhom.yml

emby: 4.11.0.3 -> 4.11.0.4, within-major step, both venues proven (R-462)

2026-09-30 17:45:40 +02:00

docker-compose.yml

emby: remove the client-written X-Forwarded-For chain on its router (R-753)

2026-10-01 21:02:58 +02:00