* feat(clientip): expose trusted proxy CIDRs in the admin UI and via env var
Trusted reverse-proxy CIDRs (clientip.trusted_proxies) previously required
hand-editing server_settings via SQL and a restart. Now:
- Admin UI: a Network > Trusted Proxies field on the General settings page,
with server-side CIDR validation and normalization on save.
- Env var: SILO_TRUSTED_PROXIES is validated at startup and persisted to
server_settings (re-applied on every boot while set), so Docker operators
never touch the database and the UI shows the effective value.
- Hot reload: the setting now rides the nodeconfig watcher snapshot, so
changes apply without restart on Redis-less deployments too (previously
reload only worked via the Redis event bus, and only when rate limiting
was enabled).
Closes#300
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(clientip): keep key-scoped event-bus reload alongside the config watcher
A malformed unrelated setting fails the whole-config watcher reload; the
direct subscription re-reads only clientip.trusted_proxies so the trust
boundary still updates on Redis-backed multi-instance deployments.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(clientip): key-scoped same-process reload in OnServerSettingUpdated
Covers the Redis-less path: an unrelated malformed setting that fails the
whole-config watcher reload can no longer leave stale trusted-proxy CIDRs
after a successful admin save.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(clientip): reload with a fresh context in OnServerSettingUpdated
The setting is already persisted when the hook runs; a canceled admin
request must not skip the trust-boundary reload.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* style(web): wrap long trusted-proxies hint to the 100-char width
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): add guidance tip for trusted proxy ranges
Explains that the setting replaces the private-network defaults, the
recommended /32 pattern, CDN multi-range caveats (Cloudflare), and why
0.0.0.0/0 is unsafe.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
