feat(proxy): sync Cloudflare ranges at nginx+Traefik, block IP spoofing

Browse Source

- cloudflare-ips.conf (new): geo $cms_trusted_edge + set_real_ip_from from
  live CF IPv4/IPv6 ranges plus Traefik bridge and loopback
- nginx-cms.conf: forward real client IP only from trusted peers, strip
  incoming CF-Connecting-IP, 403 any other peer that presents one
  (spoof gate); direct game clients on :9443 stay unaffected
- cf-ips-sync.sh (new): fetch cloudflare.com/ips-v4/-v6, regenerate the
  nginx snippet and Traefik websecure.forwardedHeaders.trustedIPs
- nginx-sync.sh: install the cloudflare-ips.conf snippet
- cms_upstream_servers.conf: point default at the live green slot 3003

...

This commit is contained in:

openhands committed 2026-09-28 23:35:00 +02:00

1 parent 7697728d07

commit 90b65c92a2

6 files changed

+322 -20

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deployment/proxy/nginx-cms.conf

+45 -18

File diff suppressed because it is too large. Load diff