chore: add back default client_ip_headers and trusted_proxies values

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

CHANGELOG.md

@@ -22,7 +22,7 @@ Since this is not a library, this changelog focuses on the changes that are rele
 
 ### ⚠️ Breaking Changes
 
-- Proxy-provided client IP headers are no longer trusted by default. Configure `client_ip_headers` and `trusted_proxies` to opt in
+- Client IP detection now defaults to `X-Forwarded-For` from IPv4 and IPv6 loopback proxies only. Other headers and proxies must be configured with the `client_ip_headers` and `trusted_proxies` options. See the [configuration reference](https://liwan.dev/reference/configuration/) for details.
 
 ### Features
 

data/config.example.toml

@@ -1,55 +1,49 @@
 base_url = "http://localhost:9042"  # The base URL of the Liwan instance
 listen = 9042  # The port to listen on (http)
 
-# # Disable favicon fetching from the DuckDuckGo API.
-# disable_favicons=false
+## Disable favicon fetching from the DuckDuckGo API.
+# disable_favicons = false
 
-# # Folder to store the database in (Will be created if it doesn't exist)
-# # defaults to $HOME/.local/share/liwan/data on linux/macos
-# # defaults to ./liwan-data on other platforms
+## Folder to store the database in (Will be created if it doesn't exist)
+## defaults to $HOME/.local/share/liwan/data on linux/macos
+## defaults to ./liwan-data on other platforms
 # data_dir="./liwan-data"
 
-# # Trusted client IP headers (used in order).
-# # Empty by default, meaning only the direct peer IP is used.
-# # Presets: cloudflare, fastly, fly, cloudfront, akamai.
-# client_ip_headers="cloudflare"
-# # Provider presets can be combined with standard or custom headers.
-# client_ip_headers=["cloudflare", "fly", "X-Forwarded-For", "X-Client-IP"]
+## Trusted client IP headers (used in order), defaults to X-Forwarded-For.
+## Presets: cloudflare, fastly, fly, cloudfront, akamai.
+## Provider presets can be combined with standard or custom headers.
+client_ip_headers = ["X-Forwarded-For"]
 
-# # Trusted reverse proxies (IP or CIDR).
-# # Empty by default, meaning forwarded client IP and GeoIP headers are not trusted.
-# trusted_proxies=["127.0.0.1", "10.0.0.0/8"]
+## Trusted reverse proxies (IP or CIDR), defaults to the IPv4 and IPv6 loopback ranges.
+trusted_proxies = ["127.0.0.1/8", "::1/128"]
 
-# # Hour of day, in the server's local timezone, when visitor grouping salts rotate.
-# # Defaults to 4, meaning 4am local time.
+## Hour of day, in the server's local timezone, when visitor grouping salts rotate.
+## Defaults to 4, meaning 4am local time.
 # visitor_group_rotation_hour=4
 
-# GeoIp settings (Optional)
-[geoip]
-# # Read location data supplied by a trusted proxy.
-# # Presets: akamai, cloudflare, cloudfront, netlify, vercel.
-# headers="cloudflare"
-# # Multiple presets and custom mappings are also supported, in priority order.
-# headers=["cloudflare", { country="X-Country", city="X-City" }]
-
-# # MaxMind account ID and license key
-# # Required to automatically download the database and keep it up to date
+[geoip]  # GeoIp settings (Optional)
+## MaxMind account ID and license key
+## Required to automatically download the database and keep it up to date
 # maxmind_account_id="MY_ACCOUNT_ID"
 # maxmind_license_key="MY_LICENSE_KEY"
 # maxmind_edition="GeoLite2-City"
 
-# # If you don't want to automatically download the database, you can specify a path to a local file
-# # Otherwise, the database will be downloaded automatically and stored in the data_dir
+## If you don't want to automatically download the database, you can specify a path to a local file
+## Otherwise, the database will be downloaded automatically and stored in the data_dir
 # maxmind_db_path="./GeoLite2-City.mmdb"
 
-# Database settings
-[duckdb]
-# # See https://liwan.dev/guides/duckdb for guidance
+## Read location data supplied by a trusted proxy.
+## Presets: akamai, cloudflare, cloudfront, netlify, vercel.
+## Multiple presets and custom mappings are also supported, in priority order:
+# headers=["cloudflare", { country="X-Country", city="X-City" }]
+# headers="cloudflare"
+
+[duckdb]  # Database settings
+## See https://liwan.dev/guides/duckdb for guidance
 # threads=2
 # memory_limit=2G
 
-# Resource limits for dashboard reports.
-[limits]
+[limits]  # Resource limits for dashboard reports.
 # report_timeout_seconds=30
 # report_max_concurrency=8
 # report_max_range_days=3660

src/config.rs

@@ -37,10 +37,10 @@ pub struct Config {
 
     /// Client IP header names or provider presets.
     /// Presets: `cloudflare`, `fastly`, `fly`, `cloudfront`, and `akamai`.
-    #[serde(default, alias = "trusted_headers")]
+    #[serde(default = "default_client_ip_headers", alias = "trusted_headers")]
     pub client_ip_headers: OneOrMany<ClientIpHeaderSource>,
 
-    #[serde(default)]
+    #[serde(default = "default_trusted_proxies")]
     pub trusted_proxies: OneOrMany<TrustedProxy>,
 
     #[serde(default = "default_visitor_group_rotation_hour")]
@@ -58,8 +58,8 @@ impl Default for Config {
             disable_favicons: false,
             listen: None,
             port: None,
-            client_ip_headers: OneOrMany::default(),
-            trusted_proxies: OneOrMany::default(),
+            client_ip_headers: default_client_ip_headers(),
+            trusted_proxies: default_trusted_proxies(),
             visitor_group_rotation_hour: default_visitor_group_rotation_hour(),
         }
     }
@@ -167,6 +167,18 @@ fn default_visitor_group_rotation_hour() -> u8 {
     4
 }
 
+fn default_client_ip_headers() -> OneOrMany<ClientIpHeaderSource> {
+    vec![ClientIpHeaderSource::Header("x-forwarded-for".to_string())].into()
+}
+
+fn default_trusted_proxies() -> OneOrMany<TrustedProxy> {
+    vec![
+        TrustedProxy::Cidr("127.0.0.1/8".parse().expect("valid default trusted proxy")),
+        TrustedProxy::Cidr("::1/128".parse().expect("valid default trusted proxy")),
+    ]
+    .into()
+}
+
 fn default_report_max_concurrency() -> usize {
     8
 }
@@ -391,6 +403,26 @@ mod test {
         assert_eq!(config.base_url, "http://localhost:8081");
         assert_eq!(config.data_dir, "./liwan-test-data");
         assert_eq!(config.listen_addr(), "0.0.0.0:9042");
+        assert_eq!(config.client_ip_headers, default_client_ip_headers());
+        assert_eq!(Config::default().client_ip_headers, default_client_ip_headers());
+        assert_eq!(config.trusted_proxies, default_trusted_proxies());
+        assert_eq!(Config::default().trusted_proxies, default_trusted_proxies());
+    }
+
+    #[test]
+    fn test_empty_proxy_config_overrides_defaults() {
+        let (_temp_dir, config_path) = temp_config(
+            "empty-proxies.config.toml",
+            r#"
+                client_ip_headers = []
+                trusted_proxies = []
+            "#,
+        );
+
+        let config = Config::load(Some(config_path), Vec::<(String, String)>::new()).expect("failed to load config");
+
+        assert!(config.client_ip_headers.is_empty());
+        assert!(config.trusted_proxies.is_empty());
     }
 
     #[test]
@@ -501,7 +533,7 @@ mod test {
         assert!(config.geoip.maxmind_license_key.is_none());
         assert_eq!(config.base_url, "http://localhost:9042");
         assert_eq!(config.listen_addr(), "0.0.0.0:9042");
-        assert!(config.client_ip_headers.is_empty());
+        assert_eq!(config.client_ip_headers, default_client_ip_headers());
         assert_eq!(config.limits.report_max_concurrency, 8);
         assert_eq!(config.limits.report_timeout_seconds, 30);
         assert_eq!(config.limits.report_max_range_days, 3660);