Усилить проверку источника и ограничение запросов

2026-07-11 10:54:17 +03:00
parent 502e339809
commit 626f2845e2
13 changed files with 236 additions and 57 deletions
@@ -26,6 +26,10 @@ CRANK_MASTER_KEY=change-me-master-key
 CRANK_SESSION_SECRET=change-me-session-secret
 CRANK_PASSWORD_PEPPER=change-me-password-pepper
 CRANK_SESSION_TTL_HOURS=24
+# Trust X-Real-IP / X-Forwarded-For for client rate limiting. Keep enabled only
+# when admin-api runs behind the bundled nginx (or another trusted reverse
+# proxy). Set to false if you expose admin-api directly to untrusted clients.
+CRANK_TRUST_FORWARDED_HEADERS=true
 CRANK_BOOTSTRAP_ADMIN_EMAIL=owner@crank.local
 CRANK_BOOTSTRAP_ADMIN_PASSWORD=change-me-admin-password
 CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME=Crank Owner