mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
583d43f213
fastapi-guard peels a fixed trusted_proxy_depth=1 from X-Forwarded-For (the rightmost entry, which nginx itself recorded). That is correct for every chain except host-proxied tailnet traffic (Tailscale Serve → nginx), which arrives as [tailnet-client, loopback-or-bridge-gateway] — depth-1 resolves it to a whitelisted hop IP, leaving WAF/ban/rate-limit inert for the whole /tg surface (the documented ceiling). ClientIpResolutionMiddleware (pure ASGI, wraps SecurityMiddleware so it runs first) stamps guard_core's request.state.client_ip cache — its supported pre-resolution seam — for EXACTLY that shape: peel known local hops (loopback + docker bridge pool) from the right, stamp only when at least one hop was peeled AND the candidate is in the tailnet CGNAT range (100.64.0.0/10). Every other shape abstains, so direct LAN clients, agent containers relaying through nginx (even with forged public-IP prefixes), and all-hops operator traffic resolve byte-for-byte as before. Documented residual: a same-bridge container forging a CGNAT prefix only DE-privileges itself (loses its whitelist exemption). XFF is read first-occurrence to match Starlette's own header semantics, and a wiring test pins the middleware mount ORDER, not just presence. Co-authored-by: Renn F <rennf93@users.noreply.github.com>