Prevent cross-address login lockouts (Refs #63)

2026-10-17 10:55:28 -04:00
parent f3b9699317
commit 4501eba873
14 changed files with 922 additions and 61 deletions
@@ -56,6 +56,11 @@ including server-rendered pages, page data, and API responses. The build already
 precompresses static JavaScript and CSS assets; dynamically generated responses
 need compression at the proxy.

+Configure `ADDRESS_HEADER` and `XFF_DEPTH` for your trusted proxy so login limits
+use each client's address. Leave `ADDRESS_HEADER` empty for direct connections;
+see the [proxy configuration guide](authentication.md#proxy-and-local-development)
+before enabling forwarded addresses.
+
 Open the dashboard and follow `/setup` to create the first administrator. Then
 remove `EC_SETUP_TOKEN` from `.env` and run `docker compose up -d` to recreate the
 controller. Setup stays closed once an account exists.