Skip to content

Seed trust_proxy=true so per-IP limit works behind StartOS proxy #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wksantiago wants to merge 2 commits into from
Closed

Seed trust_proxy=true so per-IP limit works behind StartOS proxy #6

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f8150e4
Seed trust_proxy=true so per-IP limit works behind StartOS proxy
wksantiago Jun 15, 2026
5dff398
Clarify seedFiles comment: merge only sets trust_proxy
wksantiago Jun 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions startos/init/seedFiles.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,21 @@
import { sdk } from '../sdk'
import { wispToml } from '../fileModels/wisp.toml'

// Seed wisp.toml on every init so new schema defaults (fixed host/port/storage)
// are written on install and applied on upgrade.
// Seed wisp.toml on every init to ensure trust_proxy is configured on install
// and reapplied on upgrade. The merge below only sets security.trust_proxy;
// the host/port/storage defaults come from the schema's .catch() fallbacks in
// fileModels/wisp.toml.ts, applied when the file is read and validated.
//
// trust_proxy must be true: every client reaches Wisp through the StartOS
// reverse proxy, which collapses all of them to the proxy's single source IP.
// Without it, the relay's real client IP is lost and max_connections_per_ip
// caps the whole relay at one bucket. The StartOS ws/wss proxy injects
// X-Forwarded-For, so Wisp can recover the real client IP. trusted_proxies is
// left empty on purpose: with trust_proxy=true that honors X-Forwarded-For from
// any peer, which is safe here because the relay port is only reachable through
// the proxy. (Setting a wrong proxy address would silently disable the fix.)
export const seedFiles = sdk.setupOnInit(async (effects) => {
await wispToml.merge(effects, {})
await wispToml.merge(effects, {
security: { trust_proxy: true },
})
})
Loading