Ettore Di Giacinto f5f4b7ea58 feat(http): add --trusted-proxies to resolve the real client address ...

Echo's RealIP trusted X-Forwarded-For and X-Real-Ip from any peer
when no IPExtractor is set. That fed the login and registration rate
limits and the API trace client address, so a client could dodge a
limit by rotating a forged header.

Add pkg/clientip, one resolver for the whole server. With
--trusted-proxies / LOCALAI_TRUSTED_PROXIES (IPs and CIDRs, empty by
default), the forwarded chain is read only when the TCP peer is
listed. The client is the right-most X-Forwarded-For entry that is
not a trusted proxy; a malformed entry stops the walk. With the flag
unset every request resolves to its TCP peer.

The resolver is set as Echo's IPExtractor and used by the access log
(--log-client), so all consumers agree.

Assisted-by: Claude:claude-sonnet-5-5 go gofmt

2026-11-03 15:48:38 +00:00

..

_index.en.md

docs: fix dead anchors and a dead section link (#11885)

2026-09-05 23:47:13 +02:00

advanced-usage.md

docs: point the config example link at the configurations directory

2026-09-27 19:06:33 +00:00

embedded-routing-log.md

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

model-configuration.md

docs(api): explain Responses reasoning controls

2026-11-03 14:40:50 +00:00

private-sources.md

feat(gallery): galleries published as OCI artifacts (#12167)

2026-09-21 09:23:05 +02:00

reverse-proxy-tls.md

feat(http): add --trusted-proxies to resolve the real client address

2026-11-03 15:48:38 +00:00

vram-management.md

fix(distributed): exclude pinned models from cluster eviction and idle scale-down

2026-09-11 23:08:26 +00:00