One gate to the world: Shorashim and Gitea behind the shared ingress

Three NLBs became one (185.19.28.170, ingress-nginx).

Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923)
is replaced by an Ingress — a host-less catch-all (works by IP, no DNS)
plus a `shorashim.ch` rule ready for the A record; TLS deliberately not
requested until the name resolves. Sanhedrin-length proxy timeouts.

The watch behind the ingress (completes tablet 46): the TCP peer is now
the ingress controller, so Mishmar.peer/1 takes the caller from
X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod
network, configmap); from anyone else the header is the caller's own
claim and is ignored. The ingress Service was already
externalTrafficPolicy: Local with its health-check port open, so the
caller's address arrives without the security-group change the direct
route needed. Verified live: the 11th knock is 429, a forged X-Real-IP
is still 429, and in the same minute the old route (pod sees the node)
was a different subject.

Gitea: no name of its resolves, so it rides the controller's TCP
passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22
(ingress-tcp-services.yaml), on the two NodePorts the security group
already allowed. gitea-mcp now reaches Gitea over the cluster network
instead of out through an NLB and back.

Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842….
Elixir 539/0 (L3 on and off).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

vav_pipeline/config/config.exs

@@ -27,7 +27,10 @@ config :vav_pipeline,
     peah: [minute: 10, hour: 100],
     courtyard: [minute: 20, hour: 200],
     chatzer: [minute: 5, hour: 60]
-  ]
+  ],
+  # Peers whose X-Real-IP is believed (the ingress controller). CIDRs.
+  # Empty → the TCP peer is the caller.
+  trusted_proxies: []
 
 # L3 — Oral Tradition (PostgreSQL)
 # Architecture §3.7: Append-only. INSERT allowed. Never UPDATE. Never DELETE.

vav_pipeline/config/runtime.exs

@@ -32,6 +32,12 @@ if config_env() == :prod do
       System.get_env("KORBAN_SOCKET_PATH") || "/tmp/shorashim/korban.sock",
     # The keys themselves are in the file (a mounted Secret), not in env.
     api_keys_file: System.get_env("API_KEYS_FILE") || "/etc/shorashim/secrets/api_keys",
+    # The ingress controller's network: only from there is X-Real-IP the
+    # caller's address (BigdeiKodesh.Mishmar.peer/1). Comma-separated CIDRs.
+    trusted_proxies:
+      (System.get_env("TRUSTED_PROXIES") || "")
+      |> String.split(",", trim: true)
+      |> Enum.map(&String.trim/1),
     # Shoresh Engine binary — VavPipeline.ShoreshEnginePort opens an
     # Erlang Port with {:spawn_executable, binary}, which spawns a CHILD
     # PROCESS OF THIS CONTAINER. A Port cannot cross a container

vav_pipeline/lib/vav_pipeline/bigdei_kodesh/mishmar.ex

@@ -107,15 +107,68 @@ defmodule VavPipeline.BigdeiKodesh.Mishmar do
     end
   end
 
-  @doc "The subject for a request at the pe'ah: its peer address, as text."
+  @doc """
+  The subject for a request at the pe'ah: the caller's address, as text.
+
+  Behind the ingress the TCP peer is the ingress controller, not the
+  caller; the controller writes the caller's address in `X-Real-IP`
+  (it overwrites whatever the caller sent). That header is believed
+  ONLY when the peer is inside `:trusted_proxies` (CIDRs — the pod
+  network). From any other peer the header is the caller's own claim
+  and is ignored: otherwise a caller could name a fresh address with
+  every knock and never be counted.
+  """
   @spec peer(Plug.Conn.t()) :: subject()
-  def peer(%Plug.Conn{remote_ip: ip}) do
+  def peer(%Plug.Conn{remote_ip: ip} = conn) do
+    with true <- trusted_proxy?(ip),
+         [claimed] <- Plug.Conn.get_req_header(conn, "x-real-ip"),
+         {:ok, real} <- claimed |> String.trim() |> String.to_charlist() |> :inet.parse_address() do
+      ntoa(real)
+    else
+      _ -> ntoa(ip)
+    end
+  end
+
+  @doc "Is this peer one of the configured proxies (`:trusted_proxies`, a list of CIDR strings)?"
+  @spec trusted_proxy?(:inet.ip_address()) :: boolean()
+  def trusted_proxy?(ip) do
+    :vav_pipeline
+    |> Application.get_env(:trusted_proxies, [])
+    |> Enum.any?(&in_cidr?(ip, &1))
+  end
+
+  defp ntoa(ip) do
     case :inet.ntoa(ip) do
       {:error, _} -> inspect(ip)
       chars -> List.to_string(chars)
     end
   end
 
+  # "192.168.0.0/16" — a malformed entry matches nothing (and so trusts
+  # nobody), which is the safe way for a typo to fail.
+  defp in_cidr?(ip, cidr) when is_binary(cidr) do
+    with [net, bits] <- String.split(String.trim(cidr), "/", parts: 2),
+         {:ok, net_ip} <- net |> String.to_charlist() |> :inet.parse_address(),
+         {prefix, ""} <- Integer.parse(bits),
+         true <- tuple_size(net_ip) == tuple_size(ip) do
+      width = if tuple_size(ip) == 4, do: 8, else: 16
+      total = width * tuple_size(ip)
+
+      if prefix in 0..total do
+        shift = total - prefix
+        Bitwise.bsr(to_int(ip, width), shift) == Bitwise.bsr(to_int(net_ip, width), shift)
+      else
+        false
+      end
+    else
+      _ -> false
+    end
+  end
+
+  defp to_int(ip, width) do
+    ip |> Tuple.to_list() |> Enum.reduce(0, fn part, acc -> Bitwise.bsl(acc, width) + part end)
+  end
+
   @doc "Forget every window. For tests."
   def reset(server \\ __MODULE__), do: GenServer.call(server, :reset)
 

vav_pipeline/lib/vav_pipeline/doorpost.ex

@@ -175,7 +175,7 @@ defmodule VavPipeline.Doorpost do
   # changes; the update is a deliberate operator commit. A bare
   # hash-update commit (without a corresponding spec change in the
   # same commit) is itself a drift signal.
-  @expected_hash "e4e3d56de7422280b5562c4a7ebce02fe05225a938bbce26d6e52f26b6b240eb"
+  @expected_hash "a2ec3842294a7ffd84337aa21e9c5293ba39f70c17134d4edaaa97f207b8ae5e"
 
   @doc "Return the list of files that constitute the category-grade specification."
   @spec files() :: [String.t()]

vav_pipeline/test/tablet46_mishmar_test.exs

@@ -88,6 +88,71 @@ defmodule VavPipeline.Tablet46MishmarTest do
     end
   end
 
+  describe "Mishmar.peer/1 — who is knocking, behind the ingress" do
+    setup do
+      original = Application.get_env(:vav_pipeline, :trusted_proxies)
+      Application.put_env(:vav_pipeline, :trusted_proxies, ["192.168.0.0/16", "not-a-cidr", "fd00::/8"])
+      on_exit(fn -> Application.put_env(:vav_pipeline, :trusted_proxies, original) end)
+      :ok
+    end
+
+    test "from the ingress, X-Real-IP is the caller" do
+      conn = %{conn(:post, "/peah/ask") | remote_ip: {192, 168, 150, 211}} |> put_req_header("x-real-ip", "203.0.113.7")
+      assert Mishmar.peer(conn) == "203.0.113.7"
+
+      v6 = %{conn(:post, "/peah/ask") | remote_ip: {0xFD00, 0, 0, 0, 0, 0, 0, 1}} |> put_req_header("x-real-ip", "2001:db8::7")
+      assert Mishmar.peer(v6) == "2001:db8::7"
+    end
+
+    test "from anyone else, X-Real-IP is only a claim — the peer is the caller" do
+      conn = %{conn(:post, "/peah/ask") | remote_ip: {203, 0, 113, 9}} |> put_req_header("x-real-ip", "198.51.100.1")
+      assert Mishmar.peer(conn) == "203.0.113.9"
+
+      # Just outside the /16.
+      edge = %{conn(:post, "/peah/ask") | remote_ip: {192, 169, 0, 1}} |> put_req_header("x-real-ip", "198.51.100.1")
+      assert Mishmar.peer(edge) == "192.169.0.1"
+    end
+
+    test "from the ingress without the header, or with a header that is not an address — the peer" do
+      bare = %{conn(:post, "/peah/ask") | remote_ip: {192, 168, 1, 1}}
+      assert Mishmar.peer(bare) == "192.168.1.1"
+
+      junk = bare |> put_req_header("x-real-ip", "'; drop table")
+      assert Mishmar.peer(junk) == "192.168.1.1"
+    end
+
+    test "no trusted proxies configured — nobody's header is believed" do
+      Application.put_env(:vav_pipeline, :trusted_proxies, [])
+      conn = %{conn(:post, "/peah/ask") | remote_ip: {192, 168, 150, 211}} |> put_req_header("x-real-ip", "203.0.113.7")
+      assert Mishmar.peer(conn) == "192.168.150.211"
+    end
+
+    test "a caller cannot escape the watch by naming a new address with every knock" do
+      knock = fn claimed ->
+        %{conn(:post, "/peah/ask", Jason.encode!(%{question: "x"})) | remote_ip: {203, 0, 113, 50}}
+        |> put_req_header("content-type", "application/json")
+        |> put_req_header("x-real-ip", claimed)
+        |> Router.call(@opts)
+      end
+
+      statuses = for i <- 1..4, do: knock.("198.51.100.#{i}").status
+      assert List.last(statuses) == 429
+    end
+
+    test "two callers through the same ingress are counted apart" do
+      via = fn real ->
+        %{conn(:post, "/peah/ask", Jason.encode!(%{question: "x"})) | remote_ip: {192, 168, 150, 211}}
+        |> put_req_header("content-type", "application/json")
+        |> put_req_header("x-real-ip", real)
+        |> Router.call(@opts)
+      end
+
+      for _ <- 1..3, do: via.("203.0.113.60")
+      assert via.("203.0.113.60").status == 429
+      refute via.("203.0.113.61").status == 429
+    end
+  end
+
   describe "at the router" do
     test "the pe'ah: the fourth knock from one address in a minute is 429 with Retry-After and the manna explanation" do
       statuses = for _ <- 1..4, do: ask({203, 0, 113, 9}).status