Trust reverse proxy client IP headers

tests/test_ui.py

@@ -89,8 +89,8 @@ def test_hostname_without_login_generates_update_and_dashboard_links(tmp_path: P
     assert "Copy setup values" not in response.text
     assert "Paste this exact URL into the FRITZ!Box" in response.text
     assert "Copy manual update commands" in response.text
-    assert response.text.count("Secret") >= 3
-    assert response.text.count("Public") >= 3
+    assert response.text.count("copy-field-secret") >= 3
+    assert response.text.count("copy-field-public") >= 2
     assert ".ddns.example.net" in response.text
     assert 'type="password"' not in response.text
 
@@ -116,6 +116,27 @@ def test_public_examples_use_visitor_public_ip(tmp_path: Path) -> None:
     assert "myip=8.8.8.8" in created.text
 
 
+def test_public_examples_use_cloudflare_ip_from_private_reverse_proxy(tmp_path: Path) -> None:
+    app = make_app(
+        DdnsSettings(
+            database_path=tmp_path / "ddns.sqlite3",
+            admin_password="admin",
+            hostname_suffix="ddns.example.net",
+            public_base_url="https://karldns.de",
+        )
+    )
+    client = TestClient(app, client=("172.18.0.5", 12345))
+
+    home = client.get("/", headers={"cf-connecting-ip": "8.8.4.4"})
+    created = client.post("/", headers={"x-forwarded-for": "8.8.4.4, 172.18.0.5"})
+
+    assert home.status_code == 200
+    assert created.status_code == 200
+    assert "myip=8.8.4.4" in home.text
+    assert "good 8.8.4.4" in home.text
+    assert "myip=8.8.4.4" in created.text
+
+
 def test_generated_hostname_must_be_activated_before_updates_work(tmp_path: Path) -> None:
     database_path = tmp_path / "ddns.sqlite3"
     app = make_app(