proxy_api.php trusted the posted server_id. Any proxy could report stats
for any server, collect that server's signals (which the proxy runs as
root), and write its servers.whitelist_ips, which feeds allowed_ips, the
source allowlist of every LB's /api.
The server is now the proxy whose server_ip or private_ip is the request's
source address (ProxyIdentity::resolve); a posted server_id naming another
server gets the 404. Posted addresses are kept as telemetry
(watchdog_data.ips_seen) and no longer written to whitelist_ips, which stays
admin-maintained. Phase 0 stop-gap of the MAIN <-> LB API plan, until
proxies move onto the token scheme (D8).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Es8UhyPS8MNjuYTagqfGWi
