From eca3f92e71231f2d20c02911c395526f2a7dbc01 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Yusuf=20=C4=B0pek?= Date: Fri, 10 Apr 2026 21:39:30 +0300 Subject: [PATCH] feat(env): add trusted proxy mode configuration for rate limiting --- .env.docker.example | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.env.docker.example b/.env.docker.example index 984990a..e6b8ebc 100644 --- a/.env.docker.example +++ b/.env.docker.example @@ -21,6 +21,13 @@ OPENFRAME_ENABLE_BUNNY_UPLOADS="false" OPENFRAME_REQUIRE_INVITE_CODE="false" SELF_HOSTED_AUTO_CREATE_BUCKET="true" +# Trusted reverse proxy mode — controls which headers getClientIp() trusts for rate limiting. +# Set this only when you have confirmed that your proxy strips/overwrites client-supplied headers. +# cloudflare — trust cf-connecting-ip (Cloudflare edge in front of the origin) +# nginx — trust x-real-ip / last x-forwarded-for (Nginx real_ip_header with set_real_ip_from) +# Leave unset for local dev or when no trusted proxy is in place. +TRUSTED_PROXY_MODE="nginx" + # MinIO-backed S3 storage MINIO_ROOT_USER="replace-with-minio-root-user" MINIO_ROOT_PASSWORD="replace-with-strong-minio-password"