One gate to the world: Shorashim and Gitea behind the shared ingress

Three NLBs became one (185.19.28.170, ingress-nginx).

Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923)
is replaced by an Ingress — a host-less catch-all (works by IP, no DNS)
plus a `shorashim.ch` rule ready for the A record; TLS deliberately not
requested until the name resolves. Sanhedrin-length proxy timeouts.

The watch behind the ingress (completes tablet 46): the TCP peer is now
the ingress controller, so Mishmar.peer/1 takes the caller from
X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod
network, configmap); from anyone else the header is the caller's own
claim and is ignored. The ingress Service was already
externalTrafficPolicy: Local with its health-check port open, so the
caller's address arrives without the security-group change the direct
route needed. Verified live: the 11th knock is 429, a forged X-Real-IP
is still 429, and in the same minute the old route (pod sees the node)
was a different subject.

Gitea: no name of its resolves, so it rides the controller's TCP
passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22
(ingress-tcp-services.yaml), on the two NodePorts the security group
already allowed. gitea-mcp now reaches Gitea over the cluster network
instead of out through an NLB and back.

Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842….
Elixir 539/0 (L3 on and off).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

vav_pipeline/lib/vav_pipeline/bigdei_kodesh/mishmar.ex

@@ -107,15 +107,68 @@ defmodule VavPipeline.BigdeiKodesh.Mishmar do
     end
   end
 
-  @doc "The subject for a request at the pe'ah: its peer address, as text."
+  @doc """
+  The subject for a request at the pe'ah: the caller's address, as text.
+
+  Behind the ingress the TCP peer is the ingress controller, not the
+  caller; the controller writes the caller's address in `X-Real-IP`
+  (it overwrites whatever the caller sent). That header is believed
+  ONLY when the peer is inside `:trusted_proxies` (CIDRs — the pod
+  network). From any other peer the header is the caller's own claim
+  and is ignored: otherwise a caller could name a fresh address with
+  every knock and never be counted.
+  """
   @spec peer(Plug.Conn.t()) :: subject()
-  def peer(%Plug.Conn{remote_ip: ip}) do
+  def peer(%Plug.Conn{remote_ip: ip} = conn) do
+    with true <- trusted_proxy?(ip),
+         [claimed] <- Plug.Conn.get_req_header(conn, "x-real-ip"),
+         {:ok, real} <- claimed |> String.trim() |> String.to_charlist() |> :inet.parse_address() do
+      ntoa(real)
+    else
+      _ -> ntoa(ip)
+    end
+  end
+
+  @doc "Is this peer one of the configured proxies (`:trusted_proxies`, a list of CIDR strings)?"
+  @spec trusted_proxy?(:inet.ip_address()) :: boolean()
+  def trusted_proxy?(ip) do
+    :vav_pipeline
+    |> Application.get_env(:trusted_proxies, [])
+    |> Enum.any?(&in_cidr?(ip, &1))
+  end
+
+  defp ntoa(ip) do
     case :inet.ntoa(ip) do
       {:error, _} -> inspect(ip)
       chars -> List.to_string(chars)
     end
   end
 
+  # "192.168.0.0/16" — a malformed entry matches nothing (and so trusts
+  # nobody), which is the safe way for a typo to fail.
+  defp in_cidr?(ip, cidr) when is_binary(cidr) do
+    with [net, bits] <- String.split(String.trim(cidr), "/", parts: 2),
+         {:ok, net_ip} <- net |> String.to_charlist() |> :inet.parse_address(),
+         {prefix, ""} <- Integer.parse(bits),
+         true <- tuple_size(net_ip) == tuple_size(ip) do
+      width = if tuple_size(ip) == 4, do: 8, else: 16
+      total = width * tuple_size(ip)
+
+      if prefix in 0..total do
+        shift = total - prefix
+        Bitwise.bsr(to_int(ip, width), shift) == Bitwise.bsr(to_int(net_ip, width), shift)
+      else
+        false
+      end
+    else
+      _ -> false
+    end
+  end
+
+  defp to_int(ip, width) do
+    ip |> Tuple.to_list() |> Enum.reduce(0, fn part, acc -> Bitwise.bsl(acc, width) + part end)
+  end
+
   @doc "Forget every window. For tests."
   def reset(server \\ __MODULE__), do: GenServer.call(server, :reset)
 

vav_pipeline/lib/vav_pipeline/doorpost.ex

@@ -175,7 +175,7 @@ defmodule VavPipeline.Doorpost do
   # changes; the update is a deliberate operator commit. A bare
   # hash-update commit (without a corresponding spec change in the
   # same commit) is itself a drift signal.
-  @expected_hash "e4e3d56de7422280b5562c4a7ebce02fe05225a938bbce26d6e52f26b6b240eb"
+  @expected_hash "a2ec3842294a7ffd84337aa21e9c5293ba39f70c17134d4edaaa97f207b8ae5e"
 
   @doc "Return the list of files that constitute the category-grade specification."
   @spec files() :: [String.t()]