feat: ip

.env.example

@@ -5,6 +5,10 @@ APP_DEBUG=true
 APP_URL=http://127.0.0.1:8000
 APP_TIMEZONE=Asia/Singapore
 
+# Behind Cloudflare / Nginx reverse proxy: trust X-Forwarded-* for real client IP.
+# Use * when origin is only reachable via the proxy; otherwise list proxy CIDRs.
+TRUSTED_PROXIES=*
+
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
 APP_FAKER_LOCALE=en_US

bootstrap/app.php

@@ -23,6 +23,18 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        // Cloudflare / reverse proxy: honor X-Forwarded-* so $request->ip()
+        // is the visitor IP. TRUSTED_PROXIES=* | CIDR list | empty to disable.
+        $trustedProxies = env('TRUSTED_PROXIES', '*');
+        if ($trustedProxies === '*') {
+            $middleware->trustProxies(at: '*');
+        } elseif (is_string($trustedProxies) && trim($trustedProxies) !== '') {
+            $middleware->trustProxies(at: array_values(array_filter(array_map(
+                'trim',
+                explode(',', $trustedProxies)
+            ))));
+        }
+
         $middleware->alias([
             'admin.super' => \App\Http\Middleware\EnsureSuperAdmin::class,
             'panel.host' => \App\Http\Middleware\EnsurePanelHost::class,

tests/Feature/PageVisitTest.php

@@ -42,6 +42,24 @@ class PageVisitTest extends TestCase
         $this->assertSame($ua, $row->user_agent);
     }
 
+    #[Test]
+    public function hit_uses_x_forwarded_for_when_proxies_trusted(): void
+    {
+        Cache::flush();
+
+        $this->call('GET', '/statistic/t', [
+            'c' => self::CHANNEL,
+            'u' => '11111111-2222-4333-8444-555555555555',
+        ], [], [], [
+            'REMOTE_ADDR' => '104.16.1.1',
+            'HTTP_X_FORWARDED_FOR' => '203.0.113.50',
+        ])->assertOk();
+
+        $row = PageVisit::query()->first();
+        $this->assertNotNull($row);
+        $this->assertSame('203.0.113.50', $row->ip);
+    }
+
     #[Test]
     public function hit_debounces_duplicate_uid(): void
     {