Add TCPShield / Proxy Protocol support

Adds enforced Proxy Protocol config and docs: a patch-set (config/patches/patch-set.json) that enables proxy protocol, whitelists TCPShield, and sets proxy/direct IPs; exposes PATCH_DEFINITIONS and mounts ./config/patches in docker-compose.yml; adds a featured "Proxy Protocol Support" entry to the dashboard mods page; and adds docs/tcpshield.md describing setup, verification, security model, and first-boot behavior.
2026-07-11 18:51:27 -05:00
1 parent b043f03d28
commit dff2b5a9c4
@@ -0,0 +1,42 @@
+{
+  "patches": [
+    {
+      "file": "/data/config/proxy_protocol_support.json",
+      "file-format": "json",
+      "ops": [
+        {
+          "$set": {
+            "path": "$.enableProxyProtocol",
+            "value": true,
+            "value-type": "bool"
+          }
+        },
+        {
+          "$set": {
+            "path": "$.whitelistTCPShieldServers",
+            "value": true,
+            "value-type": "bool"
+          }
+        },
+        {
+          "$set": {
+            "path": "$.proxyServerIPs",
+            "value": ["127.0.0.1"]
+          }
+        },
+        {
+          "$set": {
+            "path": "$.directAccessIPs",
+            "value": [
+              "127.0.0.1",
+              "::1",
+              "10.0.0.0/8",
+              "172.16.0.0/12",
+              "192.168.0.0/16"
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}