Trust reverse proxy client IP headers

karldns/config.py

@@ -18,6 +18,7 @@ def settings_from_env() -> DdnsSettings:
         admin_rate_limit_per_minute=_env_int("DDNS_ADMIN_RATE_LIMIT_PER_MINUTE", 20),
         max_request_body_bytes=_env_int("DDNS_MAX_REQUEST_BODY_BYTES", 16_384),
         trusted_proxy_ips=_csv_set("DDNS_TRUSTED_PROXY_IPS"),
+        trust_private_proxy_headers=_env_flag("DDNS_TRUST_PRIVATE_PROXY_HEADERS", default=True),
         rfc2136_server=os.getenv("DDNS_RFC2136_SERVER") or None,
         rfc2136_zone=os.getenv("DDNS_RFC2136_ZONE") or None,
         rfc2136_key_name=os.getenv("DDNS_RFC2136_KEY_NAME") or None,
@@ -46,8 +47,9 @@ def _csv_set(name: str) -> set[str]:
     return {item.strip().lower() for item in os.getenv(name, "").split(",") if item.strip()}
 
 
-def _env_flag(name: str) -> bool:
-    return os.getenv(name, "0").strip().lower() not in {"0", "false", "no"}
+def _env_flag(name: str, *, default: bool = False) -> bool:
+    default_value = "1" if default else "0"
+    return os.getenv(name, default_value).strip().lower() not in {"0", "false", "no"}
 
 
 def _env_int(name: str, default: int) -> int: