fix(workspaces): key basic-auth bypass on resolved client IP

[pcfreak30]

All workspace traffic arrives through the Coolify proxy, whose TCP peer is a private-range address, so the private-peer exemption matched every request and basicauth never fired — auth was silently off for the whole internet.

Switches the bypass to Caddy's client_ip matcher through trusted_proxies private_ranges: proxied public-range clients require credentials, in-network peers (Cast's anonymous probe) and the localhost /healthz check stay exempt, and a public-range peer's forged X-Forwarded-For stays ignored as an untrusted peer. Documents the assumption that the deployment proxy always sets X-Forwarded-For (Traefik/Caddy default).

Adds the missing verification case — a private-range peer forwarding a public-range client — plus credential-matrix and private-client-bypass assertions, and aligns the auth-contract docs.

---

fix(workspaces): key basic-auth bypass on resolved client IP

Summary

Fixes a critical HTTP Basic Auth bypass in the workspace runtime image (images/php-caddy/Caddyfile). The auth exemption previously keyed on Caddy's remote_ip matcher (the raw TCP peer). In production, every request reaches the container through the private-range Coolify proxy, so a peer-based exemption meant all proxied traffic — including every public internet client — bypassed authentication, silently disabling auth.

What changed

• images/php-caddy/Caddyfile: The Basic Auth exemption matcher was switched from remote_ip to client_ip. Through the already-configured trusted_proxies static private_ranges, Caddy now resolves the real client IP from the trusted private-range proxy's X-Forwarded-For (or uses the raw peer when no forwarded chain exists):

  • Proxied public clients (public-range client IP in XFF) are no longer exempt and must present valid Basic Auth credentials → 401 without them.
  • Loopback / private-network resolved clients remain exempt, so the container's Docker health check of /healthz and in-deployment probes (e.g. Cast's anonymous export probe) stay unauthenticated.
  • Public peers are untrusted, so their spoofed X-Forwarded-For / X-Real-IP headers are ignored and auth is enforced against their real peer address.

• scripts/verify-php-caddy.sh: Added regression tests for the production topology:

  • private-range proxy peer forwarding a public client (X-Forwarded-For: 192.0.2.77) → 401 without credentials, 200 with valid credentials, 401 with bad credentials;
  • private-range peer with a private-range XFF → 200 without credentials (stays exempt);
  • trusted loopback peer forwarding a public XFF → now 401 (previously expected 200);
  • loopback with loopback XFF → still 200;
  • public peer spoofing loopback headers → still 401.

• Documentation (AGENTS.md, README.md, images/php-caddy/README.md, images/wordpress/README.md): Updated the auth-contract docs to describe the resolved-client-IP model, the trust assumptions (private-range peers trusted, public peers untrusted), and why a peer-IP-based (remote_ip) bypass is unsafe (it would exempt the private-range proxy peer and disable auth for the whole internet).

Review finding

The automated review reported 1 critical finding: the Caddy client_ip resolution is flagged as parsing X-Forwarded-For non-strictly (left→right), which could allow a public attacker forging a loopback XFF header to bypass Basic Auth via the trusted proxy. This remains recorded as a known risk to follow up on.

[kody-ai]

Found critical issues please review the requested changes

• Caddy client_ip bypass resolves via non-strict left→right XFF parsing, so a public attacker forging a loopback XFF header can bypass Basic Auth through the trusted proxy.

[kody-ai]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​