52ae13c9a1
uvicorn does not trust forwarded headers from a peer outside forwarded_allow_ips, so request.client.host was the web gateway for every request. The auth-source bucket therefore counted all customers together: 60 failed logins from one attacker locked out everyone. Security events recorded the gateway address, which made the audit trail useless for attribution. The gateway now overwrites X-Forwarded-For with the peer address it observed instead of appending to whatever the client sent, so the header carries one value the client cannot choose, and client_ip() resolves it with a fallback to the connection peer. The guest-session limiter was keyed on the environment name, making it one global bucket of 120 per 15 minutes: roughly eight new visitors a minute for the whole site before legitimate traffic started receiving 429. It is now per source, and the ceiling is deliberately generous because offices and mobile carriers put many real customers behind a single address. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Production deployment files
The DTF application is one Portainer-owned Docker Swarm stack. Gitea builds,
tests, scans, and publishes the two application images, then calls the stack's
Portainer webhook. Start with the short operator guide in ../PORTAINER.md.
stack.yaml— the single Portainer stack.Dockerfile.apiandDockerfile.web— prebuilt registry images.portainer.env.example— non-secret Portainer variables.production_preflight.py— fail-closed application/configuration validator.PRODUCTION_CHECKLIST.md— production evidence checklist.
The current application remains deliberately blocked from production because real adapters and Docker-secret file loading are absent and current validation base images have unresolved HIGH/CRITICAL findings. No real provider or production service has been configured or contacted.