admin
b50289074d
gates / gates (push) Successful in 28s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
3.2 KiB
3.2 KiB
Catalog sweep 4/4 — READ in source at each pinned tag (not measured live). Subagent report 2026-10-01, condensed.
Apps: recipe-importer romm seerr sonarr sparkyfitness tandoor termix uptime-kuma vaultwarden vikunja wanderer wger wishlist zipline grimmory metube.
| App (pin) | How | Used for | Verdict | Evidence |
|---|---|---|---|---|
| recipe-importer v0.9.11 | gunicorn peer | logs | SAFE | app/main.py:31-53 |
| romm 5.3.1 | --forwarded-allow-ips=* uvicorn LEFTMOST (hard-coded) |
per-IP pair-code / device-auth limits | RISK (low: codes unguessable) → router reset | docker/init_scripts/init:141; backend/utils/rate_limit.py:9 |
| seerr 2.7.3 | trustProxy setting (UI, default off) → LEFTMOST | logs; forwards XFF to Jellyfin | SAFE while off → router reset (household-switchable) | server/index.ts:140-141 |
| sonarr 4.0.20 | ASP.NET from the right, TrustedNetworks | local bypass (refused while XFF left over) | SAFE; optional | ForwardedHeadersConfigurator.cs:15-44 |
| sparkyfitness v0.17.3 | better-auth LEFTMOST; Express trust proxy 1 | sign-in 3/10s per IP; nginx global 5 r/s | RISK → router reset | better-auth get-request-ip.ts:18-26; docker/nginx.conf |
| tandoor 2.6.15 | allauth ALLAUTH_TRUSTED_PROXY_COUNT=1 (count from the right) |
login 5/m/ip etc. | SAFE as is (one bucket); no count fits both paths — leave | recipes/settings.py:712-719; allauth httpkit.py:197-220 |
| termix 2.8.0 | bundled nginx real_ip recursive from the right | login limiter per IP and per username | SAFE and better: real client after Part A | docker/nginx.conf:44-49 |
| uptime-kuma 2.5.5 | trustProxy setting (DB, default off) → LEFTMOST | logs only (limiters global) | SAFE → router reset (household-switchable) | server/uptime-kuma-server.js:160-195 |
| vaultwarden 1.36.0 | IP_HEADER X-Real-IP (default) |
login/admin limits per IP | SAFE (X-Real-Ip traefik-set; tunnel = one bucket). Never IP_HEADER=X-Forwarded-For |
src/config.rs:669-671; src/auth.rs:1053-1066 |
| vikunja 2.6.0 | VIKUNJA_SERVICE_IPEXTRACTIONMETHOD direct (peer); xff walks from the right |
login floor 10/min per IP | needs a setting: xff → real client on both paths |
pkg/routes/ip.go:39-52; echo ip.go:242-266 |
| wanderer v0.20.0 | PocketBase peer (TrustedProxy empty) | PocketBase limiter off | SAFE; never UseLeftmostIP | core/event_request.go:40-74 |
| wger 2.7 | axes/ipware REMOTE_ADDR, proxy count 0 | lockout per USERNAME (decision 58) | SAFE; leave (no count fits both paths) | settings/main.py:267-274 |
| wishlist v0.67.1 | — | — | SAFE (HEADER_USERNAME must stay unset) | src/hooks.server.ts:45 |
| zipline 4.8.0 | Fastify trustProxy with CIDR list (off) | login 7/10s by IP (limiter on) | needs a setting: CORE_TRUST_PROXY=true, CORE_TRUSTED_PROXIES=172.16.0.0/12 |
src/server/index.ts:55-67 |
| grimmory v3.4.1 (wip) | Tomcat RemoteIpValve, internalProxies incl. 172.16.0.0/12 — from the right | login:ip: 5/15 min (+ login:user:) |
SAFE and FIXED by Part A (R-775's IP lock becomes per visitor); the per-NAME lock remains | application.yaml:63; Spring Boot TomcatServerProperties.java:756-757; AuthRateLimitService.java:18-57 |
| metube 2026.09.29 | — | — (no auth) | SAFE | app/main.py:400-420 |