feat(security): Cloudflare-aware IP trust and admin-tunable anti-DDoS

Browse Source

- resolveClientIp: trust cf-connecting-ip only behind cf-ray/cdn-loop, use nginx x-real-ip otherwise (anti-spoof)
- antiddos-config: Redis-backed live config (antiddos:config) with 30s cache, 13 ANTI_DDOS_* env vars
- ddos-guard: consume tunable rates/tiers via getAntiddosConfig
- admin panel at /admin/devops/antiddos (save/reset/unban actions, PERMS.SETTINGS_VIEW)
- register new admin page in housekeeping migration matrix (146 -> 147)

...

This commit is contained in:

openhands committed 2026-09-22 22:22:51 +02:00

1 parent fd4d0fa1cb

commit f0c27eb815

17 files changed

+1151 -63

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/app/admin/devops/antiddos/page.tsx

+393

File diff suppressed because it is too large. Load diff