One gate to the world: Shorashim and Gitea behind the shared ingress

Three NLBs became one (185.19.28.170, ingress-nginx).

Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923)
is replaced by an Ingress — a host-less catch-all (works by IP, no DNS)
plus a `shorashim.ch` rule ready for the A record; TLS deliberately not
requested until the name resolves. Sanhedrin-length proxy timeouts.

The watch behind the ingress (completes tablet 46): the TCP peer is now
the ingress controller, so Mishmar.peer/1 takes the caller from
X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod
network, configmap); from anyone else the header is the caller's own
claim and is ignored. The ingress Service was already
externalTrafficPolicy: Local with its health-check port open, so the
caller's address arrives without the security-group change the direct
route needed. Verified live: the 11th knock is 429, a forged X-Real-IP
is still 429, and in the same minute the old route (pod sees the node)
was a different subject.

Gitea: no name of its resolves, so it rides the controller's TCP
passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22
(ingress-tcp-services.yaml), on the two NodePorts the security group
already allowed. gitea-mcp now reaches Gitea over the cluster network
instead of out through an NLB and back.

Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842….
Elixir 539/0 (L3 on and off).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

vav_pipeline/test/tablet46_mishmar_test.exs

@@ -88,6 +88,71 @@ defmodule VavPipeline.Tablet46MishmarTest do
     end
   end
 
+  describe "Mishmar.peer/1 — who is knocking, behind the ingress" do
+    setup do
+      original = Application.get_env(:vav_pipeline, :trusted_proxies)
+      Application.put_env(:vav_pipeline, :trusted_proxies, ["192.168.0.0/16", "not-a-cidr", "fd00::/8"])
+      on_exit(fn -> Application.put_env(:vav_pipeline, :trusted_proxies, original) end)
+      :ok
+    end
+
+    test "from the ingress, X-Real-IP is the caller" do
+      conn = %{conn(:post, "/peah/ask") | remote_ip: {192, 168, 150, 211}} |> put_req_header("x-real-ip", "203.0.113.7")
+      assert Mishmar.peer(conn) == "203.0.113.7"
+
+      v6 = %{conn(:post, "/peah/ask") | remote_ip: {0xFD00, 0, 0, 0, 0, 0, 0, 1}} |> put_req_header("x-real-ip", "2001:db8::7")
+      assert Mishmar.peer(v6) == "2001:db8::7"
+    end
+
+    test "from anyone else, X-Real-IP is only a claim — the peer is the caller" do
+      conn = %{conn(:post, "/peah/ask") | remote_ip: {203, 0, 113, 9}} |> put_req_header("x-real-ip", "198.51.100.1")
+      assert Mishmar.peer(conn) == "203.0.113.9"
+
+      # Just outside the /16.
+      edge = %{conn(:post, "/peah/ask") | remote_ip: {192, 169, 0, 1}} |> put_req_header("x-real-ip", "198.51.100.1")
+      assert Mishmar.peer(edge) == "192.169.0.1"
+    end
+
+    test "from the ingress without the header, or with a header that is not an address — the peer" do
+      bare = %{conn(:post, "/peah/ask") | remote_ip: {192, 168, 1, 1}}
+      assert Mishmar.peer(bare) == "192.168.1.1"
+
+      junk = bare |> put_req_header("x-real-ip", "'; drop table")
+      assert Mishmar.peer(junk) == "192.168.1.1"
+    end
+
+    test "no trusted proxies configured — nobody's header is believed" do
+      Application.put_env(:vav_pipeline, :trusted_proxies, [])
+      conn = %{conn(:post, "/peah/ask") | remote_ip: {192, 168, 150, 211}} |> put_req_header("x-real-ip", "203.0.113.7")
+      assert Mishmar.peer(conn) == "192.168.150.211"
+    end
+
+    test "a caller cannot escape the watch by naming a new address with every knock" do
+      knock = fn claimed ->
+        %{conn(:post, "/peah/ask", Jason.encode!(%{question: "x"})) | remote_ip: {203, 0, 113, 50}}
+        |> put_req_header("content-type", "application/json")
+        |> put_req_header("x-real-ip", claimed)
+        |> Router.call(@opts)
+      end
+
+      statuses = for i <- 1..4, do: knock.("198.51.100.#{i}").status
+      assert List.last(statuses) == 429
+    end
+
+    test "two callers through the same ingress are counted apart" do
+      via = fn real ->
+        %{conn(:post, "/peah/ask", Jason.encode!(%{question: "x"})) | remote_ip: {192, 168, 150, 211}}
+        |> put_req_header("content-type", "application/json")
+        |> put_req_header("x-real-ip", real)
+        |> Router.call(@opts)
+      end
+
+      for _ <- 1..3, do: via.("203.0.113.60")
+      assert via.("203.0.113.60").status == 429
+      refute via.("203.0.113.61").status == 429
+    end
+  end
+
   describe "at the router" do
     test "the pe'ah: the fourth knock from one address in a minute is 429 with Retry-After and the manna explanation" do
       statuses = for _ <- 1..4, do: ask({203, 0, 113, 9}).status