Server-validated X-Real-IP proxy handling, publicPort lifecycle fix, peer-statistic iam parameter, transfer-IP fallback, and matching tests/docs

1 files changed, 9 insertions, 5 deletions

diff --git a/defaults/yacy.init b/defaults/yacy.init
index 471a39ec2..d9d2c2007 100644
--- a/defaults/yacy.init
+++ b/defaults/yacy.init
@@ -32,9 +32,12 @@ upnp.remoteHost =
 bindPort = 

 
 # Comma-separated regular expressions matching trusted reverse-proxy socket IPs.
-# X-Real-IP is used for access tracking only when the direct connection comes
-# from one of these addresses. Authentication and access control always use the
-# direct socket IP. Keep this list restricted to proxies controlled by you.
+# A single valid IPv4 or IPv6 address from X-Real-IP is used as the effective
+# client address for routing, logging, and other request attribution only when
+# the direct connection comes from one of these addresses. Authentication and
+# access control always use the direct socket IP.
+# Keep this list restricted to proxies controlled by you, and configure them to
+# overwrite rather than pass through a client-supplied X-Real-IP value.
 server.reverseProxy.trusted=127[.]0[.]0[.]1,0:0:0:0:0:0:0:1,::1
 

 # TLS/SSL support:

@@ -549,8 +552,9 @@ debug.snippets.statistics.enabled=false
 #staticIP if you have a static IP, you can use this setting

 staticIP=

 

-#publicPort if you use a different port to access YaCy than the one it listens on, you can use this setting

-publicPort=

+# Optional public HTTP/P2P port (1-65535) advertised instead of the UPnP or
+# local listening port. Leave empty to disable the manual override.
+publicPort=
 

 # each time YaCy starts up, it can trigger the local browser to show the

 # status page. This is active by default, to make it easier for first-time