openhands 90b65c92a2 feat(proxy): sync Cloudflare ranges at nginx+Traefik, block IP spoofing ...

- cloudflare-ips.conf (new): geo $cms_trusted_edge + set_real_ip_from from
  live CF IPv4/IPv6 ranges plus Traefik bridge and loopback
- nginx-cms.conf: forward real client IP only from trusted peers, strip
  incoming CF-Connecting-IP, 403 any other peer that presents one
  (spoof gate); direct game clients on :9443 stay unaffected
- cf-ips-sync.sh (new): fetch cloudflare.com/ips-v4/-v6, regenerate the
  nginx snippet and Traefik websecure.forwardedHeaders.trustedIPs
- nginx-sync.sh: install the cloudflare-ips.conf snippet
- cms_upstream_servers.conf: point default at the live green slot 3003

2026-09-28 23:35:00 +02:00

..

crowdsec

fix(security): LAPI-only engine boot, import via stdin, correct compose service

2026-09-24 18:59:13 +02:00

proxy

feat(proxy): sync Cloudflare ranges at nginx+Traefik, block IP spoofing

2026-09-28 23:35:00 +02:00