trusted_ips.map

# Real-IP whitelist for proxy-header matching — exempt from HAProxy rate limits.
# Format: "<IP> 1" (one per line). Referenced by templates/hap_listener.tpl:
#   acl is_whitelisted var(txn.real_ip),map_ip(/etc/haproxy/trusted_ips.map,0) -m int gt 0
#
# Add trusted real IPs below. Do NOT commit real/personal IPs to this repo —
# it is mirrored publicly. Keep real entries in an untracked local copy, or add
# them directly on the server (the file lives in the /etc/haproxy named volume
# and persists across container recreates).
127.0.0.1 1
sanitize public mirror: drop personal IP and infra/customer hostnames - trusted_ips.{list,map}: replace home IP with 127.0.0.1 + usage notes - skill: resolve deploy host from gitignored target-host.local, ask if unset (no hardcoded server FQDN); customer host in WAF test -> <live-vhost> - README / coraza README: registry FQDN in run examples -> placeholder - 403 block page: drop hardcoded support link -> contact provider support - CLAUDE.md: note whitelist files ship without real IPs - .gitignore: ignore target-host.local and *.local Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-04 06:32:15 -07:00			`# Real-IP whitelist for proxy-header matching — exempt from HAProxy rate limits.`
			`# Format: "<IP> 1" (one per line). Referenced by templates/hap_listener.tpl:`
			`# acl is_whitelisted var(txn.real_ip),map_ip(/etc/haproxy/trusted_ips.map,0) -m int gt 0`
			`#`
			`# Add trusted real IPs below. Do NOT commit real/personal IPs to this repo —`
			`# it is mirrored publicly. Keep real entries in an untracked local copy, or add`
			`# them directly on the server (the file lives in the /etc/haproxy named volume`
			`# and persists across container recreates).`
Add trusted IP whitelist for rate limit bypass Adds trusted_ips.list and trusted_ips.map files that exempt specific IPs from all rate limiting rules. Supports both direct source IP matching (is_trusted_ip) and proxy-header real IP matching (is_whitelisted). Files are baked into the image and can be updated by editing and rebuilding. Adds phone system IP 172.116.197.166 to the whitelist. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-03-31 13:39:41 -07:00			`127.0.0.1 1`