fix: rate limiting X-Real-IP from the real peer

docs/configuration.md

@@ -28,6 +28,7 @@ Copy [`.env.example`](../.env.example) to `.env` to get started. When a required
 | `CORS_ALLOWED_ORIGINS` | *(empty)*            | Semicolon-separated list of origins allowed to call the API. When empty, no CORS headers are sent. That is the right setting whenever the SPA is served by RenewCMS itself (production) or through the Vite proxy (development). |
 | `AUTH_RATE_LIMIT_MAX_ATTEMPTS` | `5`           | Maximum number of requests a single client IP may send to `POST /v1/auth/login` or `POST /v1/auth/password-reset` within the window, tracked independently per route.                                                          |
 | `AUTH_RATE_LIMIT_WINDOW_SECONDS` | `60`        | Length, in seconds, of the fixed rate-limit window for the two routes above.                                                                                                                                                    |
+| `TRUSTED_PROXIES`      | *(empty)*            | Semicolon-separated list of exact IP addresses (no CIDR) of reverse proxies allowed to supply the client IP via `X-Real-IP` for `POST /v1/auth/login` and `POST /v1/auth/password-reset` rate limiting. When a request's connection address is not in this list, any `X-Real-IP` or `X-Forwarded-For` header it sends is ignored and the connection address is used instead. See [deployment.md](deployment.md).      |
 
 Relative paths are resolved against the process's working directory. In production, use absolute paths (see [deployment.md](deployment.md)).
 

docs/deployment.md

@@ -100,7 +100,9 @@ With `ENVIRONMENT=production` the auth cookie is `Secure`, so **the site must be
 
 ```caddyfile
 cms.example.com {
-	reverse_proxy localhost:8080
+	reverse_proxy localhost:8080 {
+		header_up X-Real-IP {remote_host}
+	}
 }
 ```
 
@@ -117,7 +119,7 @@ server {
     location / {
         proxy_pass http://127.0.0.1:8080;
         proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }
@@ -125,6 +127,8 @@ server {
 
 If RenewCMS runs on the same host as the proxy, consider firewalling port 8080.
 
+Either way, set `TRUSTED_PROXIES` (see [configuration.md](configuration.md)) to the proxy's own address as seen by RenewCMS, typically `127.0.0.1` when the proxy and RenewCMS share a host, so the login/password-reset rate limiter honors the forwarded client IP instead of the proxy's own address.
+
 ## Backups
 
 Everything worth backing up is under the data directory. Take a consistent SQLite copy while the service is running: