milestone 17: real deadlines, validator holes, upstream editor, trusted proxies, contract samples, badvers

docs/how-to/set-up-admin-authentication.md

@@ -259,6 +259,22 @@ interface at the very least, and preferably set a password.
   wrong, and they would retype a password that can never verify.
 - Requests from the box itself skip the API rate limit by default
   (`web.api_localhost_exempt`).
+- **If you put a reverse proxy in front of the admin interface, configure
+  `web.trusted_proxies` or turn `web.api_localhost_exempt` off.** A proxy on the
+  same box connects from loopback, so every request arrives exempt and the API
+  limiter — the only brake on guessing the admin password — stops applying to
+  anyone. Listing the proxy's address in `web.trusted_proxies` makes nxdns read
+  the client's address from the `X-Forwarded-For` the proxy appends, so the
+  limiter and the SSE connection cap bind each real client again:
+
+  ```zig
+  .web = .{
+      .trusted_proxies = "127.0.0.1",
+  },
+  ```
+
+  The proxy must append its own entry to that header. A proxy that forwards a
+  client-supplied `X-Forwarded-For` unchanged is not one to trust.
 - `web.session_ttl_hours`, `web.api_rate_limit_per_min` and the rest are in the
   [configuration reference](../reference/configuration.md); the routes are in
   the [API reference](../reference/api.md).