security: implement secure IP retrieval with TRUSTED_PROXIES support (closes #139)

2026-04-24 22:14:53 +02:00
parent 3c5715e0b0
commit 771cee517a
6 changed files with 64 additions and 7 deletions
--- a/.env.local.example
+++ b/.env.local.example
@@ -22,6 +22,10 @@ CACHE_TTL=300
 # Rate limit for image proxy (integer >= 1, requests per minute per IP, default: 120)
 # RATE_LIMIT_RPM=120

+# Trusted Proxies: Comma-separated list of IP addresses (e.g., from Nginx, Traefik, or Vercel).
+# If set, rate limiting will only trust X-Forwarded-For headers from these IPs.
+# TRUSTED_PROXIES=127.0.0.1,10.0.0.1
+
 # Secret for signing auth cookies and encrypting asset tokens (string, min 16 chars).
 # If not provided, IMMICH_API_KEY will be used as a fallback (not recommended).
 # AUTH_SECRET=your-super-long-random-secret-here