Client IP detection

How many reverse proxies sit in front of Minstrel. This decides which address is recorded for each sign-in on the Active sessions card, so getting it right is what makes an unfamiliar login visible.

{#if loadError}

Couldn't load network settings.

{:else if settings === null}

Loading…

{:else}

Trusted proxies

Your address right now: {settings.detected_client_ip || 'unknown'}
Direct connection from: {settings.remote_addr || 'unknown'}
Forwarded chain: {settings.forwarded_chain || '(none)'}

{#if suggested > 0 && settings.trusted_proxy_hops !== suggested}

This request arrived with {suggested} {suggested === 1 ? 'forwarded address' : 'forwarded addresses'}, which usually means {suggested} {suggested === 1 ? 'proxy' : 'proxies'} in front of Minstrel.

{/if}

Count your proxies — don't guess high. This number tells Minstrel how much of the X-Forwarded-For header to believe, and that header is written by whoever connects. Set it higher than your real chain, or above 0 with no proxy at all, and a visitor can choose which address their own session shows — which defeats the point of the sessions list.

0 — no proxy; Minstrel is reached directly.
1 — one reverse proxy, e.g. nginx, Caddy or Traefik terminating TLS.
2 — a CDN in front of your own proxy, e.g. Cloudflare → nginx.

{/if}