timescale.info
Sign inSign up

How OpenChronology was built

Every merged pull request of openchronology/timeline-app, its first week of commits and its releases; and before them the 2020 PureScript editor, from snapshots of its deleted repositories in the Wayback Machine. Written to this server through the HTTP API.

327 moments · 2020-03-09T00:15:08Z CE – 2026-11-02T20:11:21Z CE · by @athan · @athan

#63 · README: explain the TRUST_PROXY effect on anonymous visitors

  • timeline-app
  • pull request

Adds a paragraph to the README's PostgreSQL deployment section, next to the reverse-proxy setup. Under Next.js the server can't see the connecting address (`server/next-handler.mjs` passes `remoteAddress: 'unknown'`). Without `TRUST_PROXY=1`, every request therefore shares one address, and the per-address limits (about 10 a minute) apply to everyone at once: - password sign-in and registration - social and desktop sign-in starts - email verification and password-reset links - two-factor completion - guests loading or copying a public timeline (`browser-fork`) - SQLite downloads, which are keyed by address even for signed-in users The paragraph also repeats when it is safe to enable: the proxy overwrites `X-Forwarded-For` with one client address, and the app port isn't directly reachable. Docs only. #62 adds one more effect (sign-in checks for everyone after three failures), which is documented in that PR's `docs/authentication.md`.

Sources

Open #63 · README: explain the TRUST_PROXY effect on anonymous visitors in the timeline