documentation/content/en/admin
Mark Doliner 17a5e151a5
Improve documentation for TRUSTED_PROXY_IP (#1144)
* Improve documentation for TRUSTED_PROXY_IP

The documentation previously only indicated that `localhost` was trusted, but it appears that all private networks are trusted by default. I believe this because:

- I'm running my web and streaming processes within Docker containers and running Nginx on the Docker host. I believe they communicate over a 172.16.0.0/12 network that Docker creates. I tried looking at logs a bit and it _seems_ like things are working correctly. But if anyone has suggestions on how to verify that my Mastodon processes are recording the correct client IP, please let me know! We could include that advice in this documentation.
- I looked at the source code a bit and it appears that both the streaming and web processes use localhost and the private network ranges. But this is really my first time looking at the Mastodon code and I don't even know Ruby, so please double check me!
  - I believe the streaming processes uses Express JS. I believe it sets the trusted proxy IP [here](d11d15748c/streaming/index.js (L150)). Express documents the `loopback` and `uniquelocal` values [here](https://expressjs.com/en/guide/behind-proxies.html).
  - I'm less certain about web. It looks like the env var is parsed [here](d11d15748c/config/environments/production.rb (L44-L45)). It looks like `trusted_proxies` will be unset if the env var is unset. And maybe that results in [this check](https://github.com/mastodon/mastodon/blob/main/config/initializers/trusted_proxies.rb) getting bypassed? But it looks like Action Dispatch does it's own check [here](https://api.rubyonrails.org/classes/ActionDispatch/RemoteIp.html)?

* Try to improve the phrasing

Specifically I tried to make it less likely that people would do the wrong thing if they're using Cloudflare or a similar proxy service. It does seem pretty wordy now. I'm open to suggestions.
2023-01-06 07:54:14 +01:00
..
optional Update content for 4.0, part 2 (#1060) 2022-12-14 22:55:30 +01:00
troubleshooting Update content for 4.0 (part 1) (#991) 2022-11-20 07:34:38 +01:00
backups.md Update content for 4.0, part 2 (#1060) 2022-12-14 22:55:30 +01:00
config.md Improve documentation for TRUSTED_PROXY_IP (#1144) 2023-01-06 07:54:14 +01:00
install.md Added text after a colon in install.md (there was none) (#957) 2022-11-20 08:03:43 +01:00
migrating.md Update content for 4.0, part 2 (#1060) 2022-12-14 22:55:30 +01:00
moderation.md Update content for 4.0, part 2 (#1060) 2022-12-14 22:55:30 +01:00
optional.md Add links to sub-pages for optional stuff (#1013) 2022-11-20 08:12:08 +01:00
prerequisites.md Update content for 4.0, part 2 (#1060) 2022-12-14 22:55:30 +01:00
scaling.md Update content for 4.0, part 2 (#1060) 2022-12-14 22:55:30 +01:00
setup.md Specify where to find Site Settings page (#1044) 2022-11-20 07:42:42 +01:00
tootctl.md Update content for 4.0, part 2 (#1060) 2022-12-14 22:55:30 +01:00
troubleshooting.md Update content for 4.0 (part 1) (#991) 2022-11-20 07:34:38 +01:00
upgrading.md Update content for 4.0 (part 1) (#991) 2022-11-20 07:34:38 +01:00