From fda35307c6542778d34556cd51d54c819ddd6303 Mon Sep 17 00:00:00 2001 From: Finn Stutzenstein Date: Thu, 22 Oct 2026 18:02:36 +0000 Subject: [PATCH] Document the reverse proxy requirement for X-Real-IP Co-Authored-By: Claude Opus 5.5 --- README.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 884f86f..d55f97e 100644 --- a/README.md +++ b/README.md @@ -2,8 +2,6 @@ A small little program to manage emails. -The proxy should add X-Real-IP to get a better logging. - ## Setup Requirements: Docker, Make @@ -17,6 +15,15 @@ Start with `make run-dev` - `MAX_PRODUCTION=1` is set in the Docker image and makes MAX refuse to start in debug mode (`FLASK_DEBUG`). Do not override it. +## Reverse proxy + +In production, the reverse proxy must set `X-Real-IP` to the client's address and **overwrite** any +value the client sends. Max uses this address for audit logging. For nginx: + +```nginx +proxy_set_header X-Real-IP $remote_addr; +``` + ## Dependencies Direct dependencies are listed in `requirements.in` (production) and