feat: support CIDR notation for ForwardProxies in configuration

README.md

@@ -42,6 +42,7 @@ WebRootPath: "/opt/ss14_admin/bin/wwwroot"
 
 ForwardProxies:
     - 127.0.0.1
+    - 172.16.0.0/12  # Supports CIDR notation for subnets  (Docker)
 
 Auth:
     Authority: "https://central.spacestation14.io/web/"

SS14.Admin/Startup.cs

@@ -99,9 +99,28 @@
                 ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto,
             };
 
-            foreach (var ip in Configuration.GetSection("ForwardProxies").Get<string[]>() ?? Array.Empty<string>())
+            foreach (var entry in Configuration.GetSection("ForwardProxies").Get<string[]>() ?? Array.Empty<string>())
             {
-                forwardedHeadersOptions.KnownProxies.Add(IPAddress.Parse(ip));
+                // Try to parse as CIDR notation first (e.g., 192.168.1.0/24)
+                if (IPHelper.TryParseIpOrCidr(entry, out var parsed))
+                {
+                    var (ipAddress, prefixLength) = parsed;
+                    if (prefixLength.HasValue)
+                    {
+                        // It's a CIDR subnet, add to KnownNetworks
+                        var network = new Microsoft.AspNetCore.HttpOverrides.IPNetwork(ipAddress, prefixLength.Value);
+                        forwardedHeadersOptions.KnownNetworks.Add(network);
+                    }
+                    else
+                    {
+                        // It's a single IP address, add to KnownProxies
+                        forwardedHeadersOptions.KnownProxies.Add(ipAddress);
+                    }
+                }
+                else
+                {
+                    throw new InvalidOperationException($"Invalid IP address or CIDR notation in ForwardProxies: {entry}");
+                }
             }
 
             app.UseForwardedHeaders(forwardedHeadersOptions);

SS14.Admin/appsettings.yml

@@ -18,6 +18,7 @@ Serilog:
 
 ForwardProxies:
   - 127.0.0.1
+  # - 172.16.0.0/12  # Supports CIDR notation for subnets (Docker)
 
 AuthServer: "https://central.spacestation14.io/auth"
 AllowedHosts: "*"