fix: isolate local ports and proxy trust defaults

2026-09-22 20:16:29 +07:00
parent cd862103b8
commit a501b5ea9d
5 changed files with 13 additions and 7 deletions
@@ -14,6 +14,8 @@ PUBLIC_CACHE_SECONDS=20

 ADMIN_TOKEN=replace-with-at-least-32-random-characters
 RATE_LIMIT_SECRET=replace-with-at-least-32-random-characters
+# Caddy is trusted only from the private Docker network; use the exact edge CIDR if customized.
+TRUSTED_PROXY_CIDRS=172.16.0.0/12,127.0.0.1/32,::1/128
 ADMIN_BASIC_USER=rf4admin
 # Generate with: docker run --rm caddy:2.10.2-alpine caddy hash-password --plaintext 'YOUR PASSWORD'
 ADMIN_BASIC_PASSWORD_HASH='replace-with-caddy-password-hash'