fix(multiplayer): resolve client IP behind proxies

server/cmd/control-plane/main.go

@@ -33,6 +33,7 @@ func main() {
 	rateLimit := flag.Int("rate-limit", 120, "maximum requests per per-credential/IP fixed window")
 	rateWindow := flag.Duration("rate-limit-window", time.Minute, "fixed window for the per-replica request limiter")
 	rateMaxKeys := flag.Int("rate-limit-max-keys", 10000, "maximum credential/IP keys retained by the per-replica request limiter")
+	trustedProxyCIDRs := flag.String("trusted-proxy-cidrs", os.Getenv("COSMIC_CLASH_TRUSTED_PROXY_CIDRS"), "comma-separated immediate proxy CIDRs allowed to supply X-Forwarded-For")
 	flag.Parse()
 	if *role != "api" {
 		fatalf("unsupported role %q (only api is implemented)", *role)
@@ -47,6 +48,10 @@ func main() {
 	if err != nil {
 		fatalf("invalid request limiter configuration: %v", err)
 	}
+	clientIPs, err := api.NewClientIPResolver(*trustedProxyCIDRs)
+	if err != nil {
+		fatalf("invalid trusted proxy configuration: %v", err)
+	}
 	db, err := sql.Open("pgx", *dsn)
 	if err != nil {
 		fatalf("open PostgreSQL: %v", err)
@@ -72,6 +77,7 @@ func main() {
 	}
 	service := newAPIService(db, *workloadSecret, candidateIndex)
 	service.RateLimiter = rateLimiter
+	service.ClientIPs = clientIPs
 	admission := api.NewAdmissionGate(*degraded)
 	service.Admission = admission
 	server := &http.Server{Addr: *listen, Handler: service.Handler(), ReadHeaderTimeout: 5 * time.Second}