Graham McIntire ef54125aa6 fix(security): only trust forwarded-ip headers from known proxies ... The remote_ip plug previously trusted Cf-Connecting-Ip and X-Forwarded-For on every request, so any client reaching a pod directly (cluster-internal, kubectl port-forward, misconfigured Service) could spoof conn.remote_ip, which flows into session storage and logs. Now only honour those headers when the immediate TCP peer sits inside a configured CIDR list. Default list covers loopback, RFC1918, CGNAT, link-local, and IPv6 ULA — matches the k8s pod/service network. Override via config :microwaveprop, :trusted_proxies, or per-environment via the TRUSTED_PROXY_CIDRS env var in runtime.exs. Also refresh the stale "nginx/dokku proxy" moduledoc — deployment has been k8s + Cloudflare for a while.		2026-04-21 13:19:52 -05:00
..
microwaveprop	feat(workers): add GridCachePruneWorker	2026-04-21 13:19:52 -05:00
microwaveprop_web	fix(security): only trust forwarded-ip headers from known proxies	2026-04-21 13:19:52 -05:00
mix/tasks	fix(dialyzer): actually fix LiveTable warnings instead of hiding them	2026-04-21 12:58:10 -05:00
microwaveprop.ex	initial	2026-03-28 11:28:47 -05:00
microwaveprop_web.ex	Merge auth links into main nav and lower password min to 8	2026-04-08 10:39:51 -05:00