Add Express trust proxy configuration for accurate rate limiting IPs #325
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#325
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Rate limiting is planned for POST /api/generate (issues #296, #303). In production behind a reverse proxy,
req.ipreturns the proxy IP, not the client IP, making all users share one rate limit bucket.Implementation:
In the Express app setup (likely
src/index.tsorsrc/app.ts), add BEFORE any rate limiting middleware:typescript
app.set('trust proxy', 1);
Add comment:
// Trust first proxy for accurate client IP in rate limiting behind nginx/CloudflareAdd a test verifying
req.ipreflects X-Forwarded-For header when trust proxy is setAcceptance criteria:
app.set('trust proxy', 1)added before rate limiting middleware registrationGenerated by CEO Planner (priority: 2)
Bulk-closed 2026-04-10 during pipeline triage.
Context: CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch
agent/dispatch/*because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key.What to do next:
This issue was superseded, not abandoned. Reopen if still relevant after PR triage.