admin
b50289074d
gates / gates (push) Successful in 28s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
22 lines
3.2 KiB
Markdown
22 lines
3.2 KiB
Markdown
# Catalog sweep 4/4 — READ in source at each pinned tag (not measured live). Subagent report 2026-10-01, condensed.
|
|
Apps: recipe-importer romm seerr sonarr sparkyfitness tandoor termix uptime-kuma vaultwarden vikunja wanderer wger wishlist zipline grimmory metube.
|
|
|
|
| App (pin) | How | Used for | Verdict | Evidence |
|
|
|---|---|---|---|---|
|
|
| recipe-importer v0.9.11 | gunicorn peer | logs | SAFE | app/main.py:31-53 |
|
|
| romm 5.3.1 | `--forwarded-allow-ips=*` uvicorn LEFTMOST (hard-coded) | per-IP pair-code / device-auth limits | RISK (low: codes unguessable) → router reset | docker/init_scripts/init:141; backend/utils/rate_limit.py:9 |
|
|
| seerr 2.7.3 | trustProxy setting (UI, default off) → LEFTMOST | logs; forwards XFF to Jellyfin | SAFE while off → router reset (household-switchable) | server/index.ts:140-141 |
|
|
| sonarr 4.0.20 | ASP.NET from the right, TrustedNetworks | local bypass (refused while XFF left over) | SAFE; optional | ForwardedHeadersConfigurator.cs:15-44 |
|
|
| sparkyfitness v0.17.3 | better-auth LEFTMOST; Express trust proxy 1 | sign-in 3/10s per IP; nginx global 5 r/s | RISK → router reset | better-auth get-request-ip.ts:18-26; docker/nginx.conf |
|
|
| tandoor 2.6.15 | allauth `ALLAUTH_TRUSTED_PROXY_COUNT`=1 (count from the right) | login 5/m/ip etc. | SAFE as is (one bucket); no count fits both paths — leave | recipes/settings.py:712-719; allauth httpkit.py:197-220 |
|
|
| termix 2.8.0 | bundled nginx real_ip recursive from the right | login limiter per IP and per username | SAFE and better: real client after Part A | docker/nginx.conf:44-49 |
|
|
| uptime-kuma 2.5.5 | trustProxy setting (DB, default off) → LEFTMOST | logs only (limiters global) | SAFE → router reset (household-switchable) | server/uptime-kuma-server.js:160-195 |
|
|
| vaultwarden 1.36.0 | `IP_HEADER` X-Real-IP (default) | login/admin limits per IP | SAFE (X-Real-Ip traefik-set; tunnel = one bucket). **Never** `IP_HEADER=X-Forwarded-For` | src/config.rs:669-671; src/auth.rs:1053-1066 |
|
|
| vikunja 2.6.0 | `VIKUNJA_SERVICE_IPEXTRACTIONMETHOD` direct (peer); xff walks from the right | login floor 10/min per IP | needs a setting: `xff` → real client on both paths | pkg/routes/ip.go:39-52; echo ip.go:242-266 |
|
|
| wanderer v0.20.0 | PocketBase peer (TrustedProxy empty) | PocketBase limiter off | SAFE; never UseLeftmostIP | core/event_request.go:40-74 |
|
|
| wger 2.7 | axes/ipware REMOTE_ADDR, proxy count 0 | lockout per USERNAME (decision 58) | SAFE; leave (no count fits both paths) | settings/main.py:267-274 |
|
|
| wishlist v0.67.1 | — | — | SAFE (HEADER_USERNAME must stay unset) | src/hooks.server.ts:45 |
|
|
| zipline 4.8.0 | Fastify trustProxy with CIDR list (off) | login 7/10s by IP (limiter on) | needs a setting: `CORE_TRUST_PROXY=true`, `CORE_TRUSTED_PROXIES=172.16.0.0/12` | src/server/index.ts:55-67 |
|
|
| grimmory v3.4.1 (wip) | Tomcat RemoteIpValve, internalProxies incl. 172.16.0.0/12 — from the right | `login:ip:` 5/15 min (+ `login:user:`) | SAFE and FIXED by Part A (R-775's IP lock becomes per visitor); the per-NAME lock remains | application.yaml:63; Spring Boot TomcatServerProperties.java:756-757; AuthRateLimitService.java:18-57 |
|
|
| metube 2026.09.29 | — | — (no auth) | SAFE | app/main.py:400-420 |
|