rays 0c820bbde1 Revert the ::ffff: peer match: #209 was not a bug ...

Caddy reports an IPv4 peer as plain IPv4 even on its dual-stack socket, so remote_ip
192.168.64.1 matched all along. The stripping seen came from testing on Tower itself, whose
requests reach the published port as 192.168.1.130, rightly not the tunnel. From
cloudflared's network a forged Access token reaches ipx's check and is refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-12 14:20:02 +00:00

2.6 KiB

Raw Blame History

View Raw