bvandeusenandClaude Opus 5.5
7fca1f6c7f
CI & Build / Python lint (push) Successful in 2s
CI & Build / Build now, or wait for Android? (push) Successful in 3s
Android / Build, or is the channel already serving this? (push) Successful in 3s
Android / Core and FFI clippy and tests (push) Skipped
Android / Kotlin + Rust (APK) (push) Skipped
Android / Build the server image (push) Skipped
Desktop (Tauri) / Build, or is the channel already serving this? (push) Successful in 2s
Desktop (Tauri) / Web tests, clippy, Rust tests and rustfmt (push) Skipped
Desktop (Tauri) / Tauri desktop (Linux) (push) Skipped
Desktop (Tauri) / Windows installer (cross-compiled) (push) Skipped
Desktop (Tauri) / Update manifest (push) Skipped
CI & Build / Web typecheck and unit tests (push) Successful in 9s
CI & Build / Python tests (push) Successful in 17s
CI & Build / integration (push) Successful in 1m30s
CI & Build / Build & push image (push) Successful in 45s
At Trusted proxy hops 2 (Cloudflare → Traefik → app), a LAN request reaching Traefik directly carries one X-Forwarded-For entry. trusted_entry returned None for it, so every LAN visitor was filed under Traefik's overlay address in the throttles and the audit log. Cloudflare's single X-Forwarded-Proto: https read as plain HTTP, so the public road lost the Secure cookie and HSTS. A short header now clamps to its leftmost entry, the one the first proxy wrote, as family canon #5004 does in Minstrel, Librarian and Forge. A caller's own entries can only make the header longer, so this trusts nothing more than before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>