From 4f6a4f2d69fb07148bd1b12e35e14dcbe406f4ca Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Mon, 24 Aug 2026 14:29:24 +0000 Subject: [PATCH] feat: public status page endpoint with per-address rate limit --- docs/reference/environment-variables.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/reference/environment-variables.md b/docs/reference/environment-variables.md index fee38df..b0239a3 100644 --- a/docs/reference/environment-variables.md +++ b/docs/reference/environment-variables.md @@ -25,6 +25,7 @@ it is absent. | `VANTAGE_LICENSE` | no | | A licence supplied at startup, so an automated install does not have to paste one in | | `VANTAGE_TRIVY_DB_REF` | no | `ghcr.io/aquasecurity/trivy-db:2` | Where the vulnerability database is pulled from. Point it at a mirror for an air-gapped install | | `VANTAGE_VULNDB_DISABLED` | no | | `true` switches [vulnerability scanning](../vantage/vulnerabilities.md) off entirely. Findings already stored are still served, and still shown as stale | +| `TRUSTED_PROXIES` | no | | Comma-separated CIDRs or addresses of proxies allowed to set `X-Forwarded-For`. Unset trusts none, so the client address is the direct peer — behind a reverse proxy that makes every visitor share one address for rate-limiting purposes. Set it to your proxy's range | :::danger `KEY_ENCRYPTION_KEY` has no recovery path It encrypts SSH private keys, vault secrets, OIDC client secrets and console