fix: check trusted proxy login against nginx's peer, not nginx (#1625)

The backend only sees the bundled nginx on loopback, so the allowlist
could only work by trusting 127.0.0.1, which let any client that reached
nginx log in as anyone by sending the identity headers. nginx now passes
its own TCP peer (before real_ip rewriting) in X-Termix-Proxy-Peer, and
loopback connections are judged by that address instead.

docker/docker-compose.yml

@@ -28,7 +28,11 @@ services:
       # Trusted reverse-proxy authentication is disabled by default. When
       # enabled, do not expose this container directly to untrusted clients.
       # TRUSTED_PROXY_AUTH_ENABLED: "true"
-      # TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.16.0.0/12"
+      # List the address your authenticating proxy connects from, as this
+      # container sees it (for a proxy container on termix-net, its IP there).
+      # Keep it narrow: published ports can reach the container from the
+      # Docker gateway, so do not trust whole private ranges.
+      # TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.20.0.10"
       # TRUSTED_PROXY_AUTH_ROLE_MAP: '{"operators":["user"]}'
       # TRUSTED_PROXY_AUTH_USERNAME_HEADER: "x-forwarded-username"
       # TRUSTED_PROXY_AUTH_ROLE_HEADER: "x-forwarded-role"