Networking and reverse proxies
The backend rate-limits requests by client IP address, so it needs to know each client's real address. Set TRUSTED_PROXY_PROVIDER to match how requests reach it.
| Setting | Use it when |
|---|---|
none (default) | Phones connect straight to the backend, with nothing in between. |
trusted-proxy | There's one reverse proxy in front, such as nginx, Caddy or Traefik. |
cloudflare | Requests only reach the backend through Cloudflare, for example with Cloudflare Tunnel or a firewall that only allows Cloudflare's addresses. |
cloudflare-authenticated | Requests come through Cloudflare, and the backend could also be reached another way. |
Don't leave it on none behind a reverse proxy. Every client would appear to have the proxy's address and share one rate limit.
Behind a reverse proxy
With trusted-proxy, the backend uses the last entry in X-Forwarded-For. Your proxy must add the connecting address to that header (in nginx, $proxy_add_x_forwarded_for), and the backend's port must only be reachable through the proxy.
Behind Cloudflare
cloudflare trusts the CF-Connecting-IP header without checking that the request came from Cloudflare, so only use it when Cloudflare is the only way in.
Otherwise, use cloudflare-authenticated:
- Set
CLOUDFLARE_ORIGIN_SECRETto a random value of at least 32 characters, for example fromopenssl rand -hex 32. - In Cloudflare, add a rule that sets the
X-OpenBeacon-Origin-Secretheader to that value, only on HTTPS requests to your server's hostname. - Use Full (strict) TLS for that hostname.
The backend then rejects every request without the secret, except GET /health. Never add the secret to plain HTTP requests, and keep it out of Git and logs.