From 965c5b693ab8cea420db882dce576eb96c35da82 Mon Sep 17 00:00:00 2001 From: bcmmbaga Date: Wed, 5 Aug 2026 14:49:41 +0300 Subject: [PATCH] Pin trustedPeers to the Traefik containe --- infrastructure_files/getting-started-enterprise.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/infrastructure_files/getting-started-enterprise.sh b/infrastructure_files/getting-started-enterprise.sh index 966a508b9..aeffc458b 100755 --- a/infrastructure_files/getting-started-enterprise.sh +++ b/infrastructure_files/getting-started-enterprise.sh @@ -701,8 +701,13 @@ server: cliRedirectURIs: - "http://localhost:53000/" - # Trust X-Forwarded-* only from the Traefik container's static address. + # Trust X-Forwarded-* only from the Traefik container's static address. Both + # keys must stay in step with the ipv4_address pinned in docker-compose.yml: + # trustedPeers decides whether forwarded headers are read at all, and leaving + # it unset falls back to 0.0.0.0/0. reverseProxy: + trustedPeers: + - "${TRAEFIK_IP}/32" trustedHTTPProxies: - "${TRAEFIK_IP}/32"