mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-30 16:47:01 +09:00
Juan DenisandClaude Opus 5
0bb7e4ab54
install.sh wrote no TRUST_PROXY_HEADERS line at all, so the code default (False) applied while every host install serves the panel through its own nginx. Per-IP rate limits, the login brute-force throttle and every audit-log entry therefore keyed on 127.0.0.1, which quietly weakened all three -- one abusive client shared a bucket with everyone else. .env.example claimed true, so the two disagreed and it looked configured. Trusting X-Forwarded-For is only safe when nothing can reach gunicorn without traversing a proxy we control, so the switch follows that condition rather than assuming it. On a host install it holds: render_service_unit binds gunicorn to 127.0.0.1 and bootstrap_firewall opens SSH + 80/443 + PANEL_PORT and never the backend port. backend_bind_host() is now the single source of truth for both the systemd unit and the trust decision so the two cannot drift, and backend_is_loopback_only() gates the setting. - stock install: TRUST_PROXY_HEADERS=true, TRUSTED_PROXY_HOPS=1 - SERVERKIT_EXTERNAL_PROXY=1: true with 2 hops, unchanged - SERVERKIT_BIND_HOST not loopback: false plus a warning. The port is directly reachable there, so the header is attacker-chosen, and a forged IP is worse than a wrong one because it defeats the throttles that consume it. Re-runs backfill it into installs that predate this, via _env_default_key, which fills a gap but never overrides an uncommented value -- flipping someone's deliberate false back on would be the worst kind of surprise. .env.example moves to false on purpose: that file is the Docker/manual path and docker-compose.yml publishes 5000 on all interfaces, so true was the unsafe default there. Host installs never read it. SECURITY.md claimed "the shipped nginx deploy sets it", which was untrue until now. T44 covers all six behaviours, each mutation-checked by line number: disabling the branch, inverting it to trust an exposed port, and disabling the backfill each fail exactly one assertion and no others. Shell suite 121 passed. Backend suite 3542 passed, 48 skipped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>