blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge docs/remote-mode-proxy-clarification into develop (#65)

Browse Source 
Corrige une documentation qui a réellement induit l'utilisateur en erreur :
l'exemple du cas « Remote HTTPS » bindait `127.0.0.1` en supposant sans le dire
que le reverse proxy est co-localisé. Suivi tel quel avec un proxy sur une autre
machine, il produit un serveur injoignable.

Précise le cas co-localisé vs le cas distant, la configuration exigée pour tout
bind non-loopback, l'égalité stricte de `--public-origin` contre l'`Origin`
(ouvrir l'UI par le domaine, pas par l'IP, sinon 403), et le pare-feu hôte comme
cause de timeout depuis les autres machines.

Conserve l'obligation normative « ne pas exposer sans proxy TLS » que la
première rédaction avait perdue au profit d'une garantie que le code n'offre
pas : `ServerConfig::validate()` valide la configuration, pas la présence réelle
d'un proxy.

Indépendant de #68 et #71 : n'a attendu aucun de leurs lots.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-16 18:51:23 +02:00
parent f915635e07 677f64d18e
commit e8a72f5173
1 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
docs/server-client-mode-remote.md
View File

@ -59,8 +59,27 @@ idea --serve \
--trust-reverse-proxy --trust-reverse-proxy
``` ```
This example is for a reverse proxy running on the same machine as the server.
If the proxy runs on another machine, bind an address reachable by that proxy,
for example `--listen 192.168.1.75:17373`, and point the proxy upstream to that
address and port. The link from proxy to server is still plain HTTP on the LAN;
only the public access is HTTPS.
For any non-loopback bind, keep the full remote HTTPS configuration:
`--allow-remote`, `--public-origin https://...`, and `--trust-reverse-proxy`.
`ServerConfig::validate()` rejects a non-loopback bind without it.
That check covers the configuration, not reality: it cannot verify that a proxy
is actually terminating HTTPS in front of the server. Do not expose the backend
on a public non-loopback address without TLS proxying.
The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`. The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`.
Do not expose the backend on a public non-loopback address without TLS proxying. `--public-origin` is matched by strict equality against the request `Origin`:
open the UI through the configured domain, not through the server IP, otherwise
API calls are rejected with 403.
With a LAN bind, also check the host firewall. If the server is reachable from
the local machine but times out from every other host, open the port for the LAN
subnet or, preferably, only for the proxy IP. Avoid opening it broadly: the
server does not provide its own TLS.
Secrets must never be placed in URLs; pairing uses `POST /api/pair` and then an Secrets must never be placed in URLs; pairing uses `POST /api/pair` and then an
`HttpOnly`, `Secure`, `SameSite=Strict` session cookie. `HttpOnly`, `Secure`, `SameSite=Strict` session cookie.