admin
b50289074d
gates / gates (push) Successful in 28s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2.8 KiB
2.8 KiB
Catalog sweep 3/4 — READ in source at each pinned tag (not measured live). Subagent report 2026-10-01, condensed.
Apps: n8n navidrome nextcloud onlyoffice opengist outline paperless-ngx papra plant-it plex privatebin radarr radicale rallly.
| App (pin) | How | Used for | Verdict | Evidence |
|---|---|---|---|---|
| n8n 2.42.1 | Express trust proxy hop count (N8N_PROXY_HOPS=0) |
IP limit 1000/5min + per email | SAFE; optional N8N_PROXY_HOPS=2 |
packages/@n8n/config/src/index.ts:266-268 |
| navidrome 0.64.2 | peer unless ExtAuth.TrustedSources set (not set) | login 5/20s per IP | SAFE. Never set the whitelist (opens Remote-User login) | server/middlewares.go:171-201 |
| nextcloud 34.0.4 | Apache mod_remoteip X-Real-IP from private; core trusted_proxies from the right | brute-force throttle by IP | SAFE as is (tunnel = one bucket); TRUSTED_PROXIES=172.16.0.0/12 → real client |
Request.php:591-631; Throttler.php:50-59 |
| onlyoffice 9.4.0 | leftmost XFF only with ipfilter on (off) | — | SAFE; never enable ipfilter | Common/sources/utils.js:1052-1066 |
| opengist 1.15 | echo RealIP LEFTMOST | logs only | log text forgeable → router reset | echo context.go:309-331 |
| outline 1.10.1 | Koa proxy LEFTMOST (PROXY_IP_HEADER X-Forwarded-For) |
per-IP limits; sign-in link bound to IP | RISK → router reset (or PROXY_IP_HEADER=X-Real-IP) |
server/services/web.ts:31-39; rateLimiter.ts:31-52 |
| paperless-ngx 2.20.15 | allauth 65.12.1 LEFTMOST | login_failed 10/m/ip + 5/300s/username | RISK (per-IP part) → router reset | allauth account/adapter.py:774-780 |
| papra 26.6.2 | better-auth LEFTMOST; invalid → rate limit SKIPPED | sign-in/up limit per IP | RISK (junk value turns the limit off) → router reset (or AUTH_IP_ADDRESS_HEADERS=x-real-ip) |
auth.config.ts:70-82; better-auth rate-limiter/index.ts:167-171 |
| plant-it 0.10.0 | LEFTMOST | per-IP limiter in an unbounded map | RISK (evasion + memory growth) → router reset | RateLimitFilter.java:36-60 |
| plex 1.41.4 | closed source; XFF "in most places" (inferred) | allowedNetworks auth bypass (unset) | SAFE as templated; never set ALLOWED_NETWORKS | forum links (inferred) |
| privatebin 2.0.6 | only with [traffic] header (unset) |
paste flood limit | SAFE; never X_FORWARDED_FOR |
TrafficLimiter.php:52-154 |
| radarr 6.4.4 | ASP.NET from the right, TrustedNetworks (loopback) | local-address auth bypass (needs no leftover XFF) | SAFE; optional TrustedNetworks 172.16.0.0/12 | ForwardedHeadersConfigurator.cs:15-38 |
| radicale 3.8.1 | REMOTE_ADDR | logs | SAFE | radicale/app/__init__.py:449-458 |
| rallly 4.15.3 | better-auth (multi-hop unresolvable → shared); /api/event LEFTMOST | sign-in limits; /api/event limit | auth SAFE; /api/event forgeable → router reset | better-auth utils/ip.ts:283-372; api/event route.ts:72-79 |