Graham McIntire ef54125aa6 fix(security): only trust forwarded-ip headers from known proxies ... The remote_ip plug previously trusted Cf-Connecting-Ip and X-Forwarded-For on every request, so any client reaching a pod directly (cluster-internal, kubectl port-forward, misconfigured Service) could spoof conn.remote_ip, which flows into session storage and logs. Now only honour those headers when the immediate TCP peer sits inside a configured CIDR list. Default list covers loopback, RFC1918, CGNAT, link-local, and IPv6 ULA — matches the k8s pod/service network. Override via config :microwaveprop, :trusted_proxies, or per-environment via the TRUSTED_PROXY_CIDRS env var in runtime.exs. Also refresh the stale "nginx/dokku proxy" moduledoc — deployment has been k8s + Cloudflare for a while.		2026-04-21 13:19:52 -05:00
..
fixtures	NarrClient.extract_profile_from_file/3 + fetch_profile_at/2	2026-04-15 18:54:02 -05:00
microwaveprop	feat(workers): add GridCachePruneWorker	2026-04-21 13:19:52 -05:00
microwaveprop_web	fix(security): only trust forwarded-ip headers from known proxies	2026-04-21 13:19:52 -05:00
mix/tasks	fix enrichment	2026-04-02 15:30:41 -05:00
support	feat(rainscatter): classify QSO propagation mechanism from common-volume radar	2026-04-17 15:57:59 -05:00
test_helper.exs	Exclude slow GRIB2 fixture tests by default (81s -> 16s)	2026-03-31 10:00:13 -05:00