From f8150e4772d96fc616330fd26868ac757fc76a28 Mon Sep 17 00:00:00 2001 From: "William K. Santiago" Date: Mon, 15 Jun 2026 19:42:18 -0400 Subject: [PATCH 1/2] Seed trust_proxy=true so per-IP limit works behind StartOS proxy --- startos/init/seedFiles.ts | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/startos/init/seedFiles.ts b/startos/init/seedFiles.ts index 92fe370..c4b9b45 100644 --- a/startos/init/seedFiles.ts +++ b/startos/init/seedFiles.ts @@ -3,6 +3,17 @@ import { wispToml } from '../fileModels/wisp.toml' // Seed wisp.toml on every init so new schema defaults (fixed host/port/storage) // are written on install and applied on upgrade. +// +// trust_proxy must be true: every client reaches Wisp through the StartOS +// reverse proxy, which collapses all of them to the proxy's single source IP. +// Without it, the relay's real client IP is lost and max_connections_per_ip +// caps the whole relay at one bucket. The StartOS ws/wss proxy injects +// X-Forwarded-For, so Wisp can recover the real client IP. trusted_proxies is +// left empty on purpose: with trust_proxy=true that honors X-Forwarded-For from +// any peer, which is safe here because the relay port is only reachable through +// the proxy. (Setting a wrong proxy address would silently disable the fix.) export const seedFiles = sdk.setupOnInit(async (effects) => { - await wispToml.merge(effects, {}) + await wispToml.merge(effects, { + security: { trust_proxy: true }, + }) }) From 5dff39830b5510e056a1e56b018fdfb0bf11db97 Mon Sep 17 00:00:00 2001 From: "William K. Santiago" Date: Mon, 15 Jun 2026 20:04:00 -0400 Subject: [PATCH 2/2] Clarify seedFiles comment: merge only sets trust_proxy --- startos/init/seedFiles.ts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/startos/init/seedFiles.ts b/startos/init/seedFiles.ts index c4b9b45..5d0b574 100644 --- a/startos/init/seedFiles.ts +++ b/startos/init/seedFiles.ts @@ -1,8 +1,10 @@ import { sdk } from '../sdk' import { wispToml } from '../fileModels/wisp.toml' -// Seed wisp.toml on every init so new schema defaults (fixed host/port/storage) -// are written on install and applied on upgrade. +// Seed wisp.toml on every init to ensure trust_proxy is configured on install +// and reapplied on upgrade. The merge below only sets security.trust_proxy; +// the host/port/storage defaults come from the schema's .catch() fallbacks in +// fileModels/wisp.toml.ts, applied when the file is read and validated. // // trust_proxy must be true: every client reaches Wisp through the StartOS // reverse proxy, which collapses all of them to the proxy's single source IP.