Erik 5f7b4dcd55 fix(tracker-go): key login rate limiter on X-Real-IP, not spoofable XFF ... nginx's X-Forwarded-For is $proxy_add_x_forwarded_for, which only appends to whatever the client sends — a forged leftmost hop passed straight through, letting an attacker rotate spoofed values to dodge the 5s login cooldown. X-Real-IP is set by nginx to $remote_addr on every proxied location and can't be forged by the client, so key on that instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>		2026-07-04 22:43:43 +02:00
..
aclog.go	feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes	2026-06-24 19:46:40 +02:00
auth.go	feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes	2026-06-24 19:46:40 +02:00
charstats.go	feat(go-services): Phase 2 — combat_stats accumulator (cross-language exact)	2026-06-24 10:42:15 +02:00
combat.go	feat(go-services): Phase 2 — combat_stats accumulator (cross-language exact)	2026-06-24 10:42:15 +02:00
combat_test.go	feat(go-services): Phase 2 — combat_stats accumulator (cross-language exact)	2026-06-24 10:42:15 +02:00
Dockerfile	feat(go-services): Phase 2 — combat_stats accumulator (cross-language exact)	2026-06-24 10:42:15 +02:00
go.mod	feat(go-services): tracker-go Phase 0/1 — /live + /trails read parity	2026-06-24 09:24:22 +02:00
ingest.go	feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes	2026-06-24 19:46:40 +02:00
inventory_forward.go	feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes	2026-06-24 19:46:40 +02:00
live.go	feat(go-services): tracker-go Phase 0/1 — /live + /trails read parity	2026-06-24 09:24:22 +02:00
main.go	feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes	2026-06-24 19:46:40 +02:00
memstate.go	feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes	2026-06-24 19:46:40 +02:00
proxy.go	feat(go-services): tracker-go — complete the Phase 1 read API	2026-06-24 09:38:10 +02:00
reads.go	feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes	2026-06-24 19:46:40 +02:00
schema.go	feat(go-services): Phase 2 foundation — isolated shadow DB + schema	2026-06-24 10:18:30 +02:00
shadow.go	feat(go-services): tracker share_* handlers (complete ingest) + shadow tuning	2026-06-24 11:27:25 +02:00
share.go	feat(go-services): tracker share_* handlers (complete ingest) + shadow tuning	2026-06-24 11:27:25 +02:00
store.go	feat(go-services): Phase 2 foundation — isolated shadow DB + schema	2026-06-24 10:18:30 +02:00
totals.go	feat(go-services): tracker-go — complete the Phase 1 read API	2026-06-24 09:38:10 +02:00
website.go	fix(tracker-go): key login rate limiter on X-Real-IP, not spoofable XFF	2026-07-04 22:43:43 +02:00
website_admin.go	feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes	2026-06-24 19:46:40 +02:00
website_issues.go	feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes	2026-06-24 19:46:40 +02:00
website_test.go	fix(tracker-go): key login rate limiter on X-Real-IP, not spoofable XFF	2026-07-04 22:43:43 +02:00
wslive.go	feat(go-services): tracker WS servers (/ws/position + /ws/live) + robust shadow	2026-06-24 11:15:05 +02:00
wsposition.go	feat(go-services): tracker share_* handlers (complete ingest) + shadow tuning	2026-06-24 11:27:25 +02:00