Remote-User/Name/Email/Groups were read from every request, so a LAN host
connecting to the container directly could claim any user and group. Add
auth.trusted_proxies and ignore those headers unless the request came from
one of them: the X-Real-IP the local nginx sets, or the peer address when
gunicorn is reached directly. With nothing configured, nobody is trusted.
Rejected attempts are logged, and /api/avatar now uses the same check.
The container's nginx site blanks the same headers for non-NPM sources
(pve-infra 4e3ab7c).
Closes#3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jaredandClaude Opus 5.5