Усилить проверку источника и ограничение запросов

deploy/community/.env.images.example

@@ -26,6 +26,10 @@ CRANK_MASTER_KEY=change-me-master-key
 CRANK_SESSION_SECRET=change-me-session-secret
 CRANK_PASSWORD_PEPPER=change-me-password-pepper
 CRANK_SESSION_TTL_HOURS=24
+# Trust X-Real-IP / X-Forwarded-For for client rate limiting. Keep enabled only
+# when admin-api runs behind the bundled nginx (or another trusted reverse
+# proxy). Set to false if you expose admin-api directly to untrusted clients.
+CRANK_TRUST_FORWARDED_HEADERS=true
 CRANK_BOOTSTRAP_ADMIN_EMAIL=owner@crank.local
 CRANK_BOOTSTRAP_ADMIN_PASSWORD=change-me-admin-password
 CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME=Crank Owner

deploy/community/docker-compose.images.yml

@@ -54,6 +54,7 @@ services:
       CRANK_SESSION_SECRET: ${CRANK_SESSION_SECRET}
       CRANK_PASSWORD_PEPPER: ${CRANK_PASSWORD_PEPPER}
       CRANK_SESSION_TTL_HOURS: ${CRANK_SESSION_TTL_HOURS:-24}
+      CRANK_TRUST_FORWARDED_HEADERS: ${CRANK_TRUST_FORWARDED_HEADERS:-true}
       CRANK_BOOTSTRAP_ADMIN_EMAIL: ${CRANK_BOOTSTRAP_ADMIN_EMAIL}
       CRANK_BOOTSTRAP_ADMIN_PASSWORD: ${CRANK_BOOTSTRAP_ADMIN_PASSWORD}
       CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME: ${CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME:-Crank Owner}

deploy/community/docker-compose.yml

@@ -38,6 +38,7 @@ services:
       CRANK_SESSION_SECRET: ${CRANK_SESSION_SECRET}
       CRANK_PASSWORD_PEPPER: ${CRANK_PASSWORD_PEPPER}
       CRANK_SESSION_TTL_HOURS: ${CRANK_SESSION_TTL_HOURS:-24}
+      CRANK_TRUST_FORWARDED_HEADERS: ${CRANK_TRUST_FORWARDED_HEADERS:-true}
       CRANK_BOOTSTRAP_ADMIN_EMAIL: ${CRANK_BOOTSTRAP_ADMIN_EMAIL}
       CRANK_BOOTSTRAP_ADMIN_PASSWORD: ${CRANK_BOOTSTRAP_ADMIN_PASSWORD}
       CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME: ${CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME:-Crank Owner}