Graham McIntire ef54125aa6 fix(security): only trust forwarded-ip headers from known proxies ... The remote_ip plug previously trusted Cf-Connecting-Ip and X-Forwarded-For on every request, so any client reaching a pod directly (cluster-internal, kubectl port-forward, misconfigured Service) could spoof conn.remote_ip, which flows into session storage and logs. Now only honour those headers when the immediate TCP peer sits inside a configured CIDR list. Default list covers loopback, RFC1918, CGNAT, link-local, and IPv6 ULA — matches the k8s pod/service network. Override via config :microwaveprop, :trusted_proxies, or per-environment via the TRUSTED_PROXY_CIDRS env var in runtime.exs. Also refresh the stale "nginx/dokku proxy" moduledoc — deployment has been k8s + Cloudflare for a while.		2026-04-21 13:19:52 -05:00
..
components	chore(branding): rename site to "Microwave Propagation"	2026-04-18 16:18:21 -05:00
controllers	fix(dialyzer): clear 125+ warnings under strict flags	2026-04-21 10:30:06 -05:00
live	fix(dialyzer): actually fix LiveTable warnings instead of hiding them	2026-04-21 12:58:10 -05:00
plugs	fix(security): only trust forwarded-ip headers from known proxies	2026-04-21 13:19:52 -05:00
endpoint.ex	fix(logging): suppress /metrics logs and harden scorer hot path	2026-04-21 10:44:25 -05:00
gettext.ex	initial	2026-03-28 11:28:47 -05:00
live_table_footer.ex	Show windowed page list in live_table footer	2026-04-13 10:02:19 -05:00
live_table_resource.ex	fix(dialyzer): actually fix LiveTable warnings instead of hiding them	2026-04-21 12:58:10 -05:00
metrics_plug.ex	fix(metrics): serve scrape body via PromEx.get_metrics	2026-04-18 16:50:37 -05:00
router.ex	feat(telemetry): PromEx Prometheus exporter at /metrics	2026-04-18 16:39:39 -05:00
skew_t.ex	Rename ERA5 → NARR across the codebase	2026-04-16 09:22:23 -05:00
telemetry.ex	perf(telemetry): cut hot-path overhead on scores_at cache hits	2026-04-20 16:12:01 -05:00
user_auth.ex	fix(dialyzer): clear 125+ warnings under strict flags	2026-04-21 10:30:06 -05:00