Trust forwarded IPs from the host proxy

2026-08-25 01:53:11 +00:00
parent 7f85db6689
commit f5aab65ff4
3 changed files with 17 additions and 0 deletions
@@ -72,6 +72,10 @@ docker compose ps
 By default, the API is available at `http://localhost:17777/api`. Swagger UI is
 available at `http://localhost:17777/api/doc`.
 The default bind address is suitable for a reverse proxy on the Docker host.
+The backend resolves the Docker host gateway when it starts. Uvicorn trusts
+forwarded headers only from this gateway and the loopback interface. This lets
+audit and security records contain the client IP address. Keep `BACKEND_BIND`
+on `127.0.0.1` and let the reverse proxy provide the public endpoint.

 ## Store persistent data