Public: anyone can read this; nobody can change it.
The chart can set FORGE_TRUSTED_PROXIES and FORGE_CLIENT_IP_HEADER from optional values, unset by default. #53
Check · Review · Land done · Live — Landed; nothing deploys from this branch, so this is the end of its path.
**Problem.** The chart had no way to set `FORGE_TRUSTED_PROXIES` or `FORGE_CLIENT_IP_HEADER` (review finding M3). Behind the ingress, per-client limits and the signup audit see the proxy address, not the client.
shipped merged
Sign in to join this conversation.
Problem. The chart had no way to set
FORGE_TRUSTED_PROXIESorFORGE_CLIENT_IP_HEADER(review finding M3). Behind the ingress, per-client limits and the signup audit see the proxy address, not the client.Root cause. The deployment template has no env entry for these two settings, and
values.yamlhas no key for them.Fix. Optional values
forge.trustedProxiesandforge.clientIpHeader. When set, the template addsFORGE_TRUSTED_PROXIES/FORGE_CLIENT_IP_HEADER. Unset by default, so a release that sets neither renders the same as before.values.yamldocuments both, commented out. No gitops pin changes.Test.
test/chart-client-ip.test.ts: each env entry is in the template inside itswith .Values.forge.<value>block, and neither value is set invalues.yaml. On main: 2 of 4 fail. With the fix: 4 of 4 pass.helm lintpasses.helm templatewithout the values renders no new env. With--set forge.trustedProxies=10.42.0.0/16 --set forge.clientIpHeader=cf-connecting-ipit renders both.Validate (fast). Result: pass.