Marc-André Bombeck 7d05f68f23 fix(http): say when proxy headers go unread, and trust X-Real-IP only at one hop ...

With TRUST_PROXY_HOPS=0 behind a proxy that sends only X-Real-IP, every
client address resolves to nothing and all anonymous sign-ins share one
rate-limit bucket, with nothing in the log to say why. The first request
that carries a forwarding header the setting does not let HealthLog read
now logs one warning naming the header and the setting to change.

X-Real-IP stood in for a missing X-Forwarded-For at any hop count. It is a
single address, so it is now read only with TRUST_PROXY_HOPS=1; with two
or more hops the chain the count describes is X-Forwarded-For.

The upload, import and native batch routes that bypass the proxy now carry
Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy like every
other response, and so do the proxy's early exits.

The env examples described an unset TRUST_PROXY_HOPS as right for a
directly exposed host; unset means one hop, and that host wants 0.

2026-09-26 22:45:51 +02:00

..

portainer

docs(self-hosting): add Unraid CA and Portainer templates, harden compose quick-start

2026-06-21 10:32:40 +02:00

unraid

docs(self-hosting): add Unraid CA and Portainer templates, harden compose quick-start

2026-06-21 10:32:40 +02:00

account-sharing.md

docs(sharing): the booster needs two sections, and the guide promised it at one level

2026-09-10 12:23:59 +02:00

document-sources.md

docs(documents): Papra organization ids and tags permission, deletion by content, the Paperless SQLite case limit

2026-09-26 14:47:40 +02:00

geolite2.md

fix(config): treat an empty environment variable as unset

2026-09-26 15:20:42 +02:00

getting-started.md

feat(config): let the operator turn off the breach and update checks

2026-09-26 15:33:34 +02:00

mcp.md

docs(mcp): describe what search and fetch cover for clinical records

2026-09-26 13:02:05 +02:00

notifications.md

Merge the review fixes for channel tests

2026-09-13 15:17:36 +02:00

reproductive-health-data.md

test(settings): prove the wipe against real Postgres, and state what deletion means

2026-07-26 14:04:44 +02:00

reverse-proxy.md

fix(http): say when proxy headers go unread, and trust X-Real-IP only at one hop

2026-09-26 22:45:51 +02:00

scaling.md

Bring the self-hosting guides in line with the shipped code

2026-08-27 12:21:27 +02:00

sso.md

docs(sso): explain how an existing account is linked to a provider identity

2026-09-26 16:55:03 +02:00

tailscale.md

docs: add Tailscale serve and funnel as a reverse-proxy option

2026-08-29 18:21:14 +02:00

unraid.md

Bring the self-hosting guides in line with the shipped code

2026-08-27 12:21:27 +02:00