Resolves which proxies may speak for their callers via X-Forwarded-*, from
PORTAL_TRUST_PROXY.
This decides which address the rate limiter and the logs attribute a request
to. Trusting the header when nothing rewrites it lets any caller forge its
own client address and slip the per-IP limits, so the default is to trust
nothing and anything unparseable falls back to that default.
Entries name the proxy's own address — loopback behind tailscale serve,
or an IP/CIDR such as 10.0.0.0/8 — so a forwarded header is honoured only
on connections that genuinely arrive from that proxy.
A bare hop count is refused. Fastify removed it in 5.12.1 because it matched
every connection regardless of origin, which left anyone able to reach the
portal directly free to forge their own address (GHSA-3m5p-2c4r-xxw2). true
is refused for the same reason: it hands the rate-limit key to whoever sent
the request.
Resolves which proxies may speak for their callers via
X-Forwarded-*, fromPORTAL_TRUST_PROXY.This decides which address the rate limiter and the logs attribute a request to. Trusting the header when nothing rewrites it lets any caller forge its own client address and slip the per-IP limits, so the default is to trust nothing and anything unparseable falls back to that default.
Entries name the proxy's own address —
loopbackbehindtailscale serve, or an IP/CIDR such as10.0.0.0/8— so a forwarded header is honoured only on connections that genuinely arrive from that proxy.A bare hop count is refused. Fastify removed it in 5.12.1 because it matched every connection regardless of origin, which left anyone able to reach the portal directly free to forge their own address (GHSA-3m5p-2c4r-xxw2).
trueis refused for the same reason: it hands the rate-limit key to whoever sent the request.