ik/rf4-spotter
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: narrow production proxy trust network

Browse Source
This commit is contained in:
ik
2026-09-22 20:36:33 +07:00
parent d7d1a2873a
commit 14ccfec5e6
3 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compose.production.yaml
+7 -4
View File
@@ -132,9 +132,9 @@ services:
IMPORT_INTERVAL_SECONDS: ${IMPORT_INTERVAL_SECONDS:-3600}
PUBLIC_CACHE_SECONDS: ${PUBLIC_CACHE_SECONDS:-20}
RATE_LIMIT_SECRET: ${RATE_LIMIT_SECRET:?Set RATE_LIMIT_SECRET}
# Caddy reaches API over the private Docker network, not loopback.
# Override with the exact edge-network CIDR when the deployment network is customized.
TRUSTED_PROXY_CIDRS: '${TRUSTED_PROXY_CIDRS:-"172.16.0.0/12,127.0.0.1/32,::1/128"}'
# Caddy reaches API over the dedicated private edge network, not loopback.
# Keep this CIDR aligned with EDGE_NETWORK_SUBNET when customizing the network.
TRUSTED_PROXY_CIDRS: '${TRUSTED_PROXY_CIDRS:-"172.30.0.0/24,127.0.0.1/32,::1/128"}'
RETENTION_SUBMISSION_DAYS: ${RETENTION_SUBMISSION_DAYS:-1}
RETENTION_UNREVIEWED_DAYS: ${RETENTION_UNREVIEWED_DAYS:-30}
RETENTION_APPROVED_PERSONAL_DAYS: ${RETENTION_APPROVED_PERSONAL_DAYS:-180}
@@ -232,7 +232,7 @@ services:
S3_SECRET_KEY: ${S3_SECRET_KEY:?Set S3_SECRET_KEY}
SEED_DEMO_DATA: "false"
RATE_LIMIT_SECRET: ${RATE_LIMIT_SECRET:?Set RATE_LIMIT_SECRET}
TRUSTED_PROXY_CIDRS: '${TRUSTED_PROXY_CIDRS:-"172.16.0.0/12,127.0.0.1/32,::1/128"}'
TRUSTED_PROXY_CIDRS: '${TRUSTED_PROXY_CIDRS:-"172.30.0.0/24,127.0.0.1/32,::1/128"}'
COMMUNITY_IMPORT_INTERVAL_SECONDS: ${COMMUNITY_IMPORT_INTERVAL_SECONDS:-1800}
RF4MAP_POINT_URL: ${RF4MAP_POINT_URL:-https://rf4map.ru/points/275}
RF4POSTS_SPOT_URL: ${RF4POSTS_SPOT_URL:-https://rf4-posts.com/ru/spots/d0c6d9c6-4ebf-49a7-98a8-9a562553a8ee}
@@ -262,6 +262,9 @@ services:
networks:
edge:
ipam:
config:
- subnet: ${EDGE_NETWORK_SUBNET:-172.30.0.0/24}
backend:
internal: true