mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 13:01:00 +00:00
Marc-André Bombeck
a43f704690
The Coolify-fronted HealthLog stack sits behind Cloudflare, which strips and re-sets `cf-connecting-ip` on every request that lands on its edge. Without consulting this header, `getClientIp` reads the Caddy loopback IP off the `X-Forwarded-For` chain and the admin sign-in geo lookup ends up with a null IP for every visitor — Marc's "Standort" column rendered a literal "—" on every row of the sign-in overview even after v1.4.36 closed the missing-ASN fallback. The new branch prefers `cf-connecting-ip` ahead of the XFF / x-real-ip chain, but only when the operator opts in via `TRUST_CF_CONNECTING_IP=1`. A self-hosted deployment without Cloudflare in front MUST leave the flag off — an attacker can set the header directly on the public internet, and the downstream geo resolver would happily report a forged location. The trust-violation accounting in `getClientIpOrTrustWarning` skips when the CF header satisfies the lookup because Cloudflare re-sets the value on every edge request — there is no chain to violate. The existing XFF + x-real-ip semantics are unchanged for every deployment that leaves the flag unset. `.env.example` documents the flag in a dedicated "Reverse-proxy trust" block right above the process-split section so the operator finds it next to the existing infra-trust controls.