mirror of
https://github.com/henrygd/beszel.git
synced 2026-09-21 00:47:47 +02:00
4bf70700f2
With TRUSTED_AUTH_HEADER set, the hub authenticates a request from the header alone, whichever address it comes from. That is right when every request passes through the reverse proxy, and not when the hub can also be reached directly: anyone who can reach it sets the header themselves. TRUSTED_PROXY_IPS takes a comma-separated list of IPs or CIDR ranges. When set, the header is only honored on requests whose peer address is in the list; other requests fall through to the normal authentication. When unset, nothing changes. The check uses the connection's RemoteAddr, not a forwarded header, so the list names the proxy itself. IPv4-mapped IPv6 entries are treated as IPv4. Entries that do not parse are skipped with a warning on the console; a list with no valid entry trusts nobody, so a typo narrows the allowlist instead of widening it.