release: v1.20.1 — real client IP to backend (last-login fix) + host UTC #265

Merged

developer merged 3 commits from development into master 2026-07-14 09:44:43 +00:00

Conversation 1 Commits 3 Files Changed 6

+88 -2

developer commented 2026-07-14 09:38:56 +00:00

Owner

Copy Link

Copy Source

Промоушен development → master для релиза v1.20.1 (patch поверх v1.20.0).

Что уезжает (1 фикс + 1 chore)

• #264 fix(gateway): реальный client IP пробрасывается в backend на КАЖДОМ вызове (last-login IP в админке был докерным 172.19.0.9); + client_ip в access-лог.
• chore(ansible): system timezone всех хостов пиннится на UTC (tg-хост был MSK; применён живьём + durable в common-роли).

Прод-безопасность (deploy-check)

• Миграций нет → схема не меняется, maintenance-окно не нужно, откат DB-safe.
• Wire не менялся → GATEWAY_MIN_CLIENT_VERSION не трогаем.
• Изменения: gateway/backend Go-код (проброс IP-заголовка) + ansible (не в рантайм-образе). Нет Caddyfile/edge/Alt-Svc/mounted-secrets/DICT_VERSION.
• Итог: низкорисковый image-only rolling deploy.

После мержа

Тег v1.20.1 на master → prod-deploy (confirm=deploy) → watch → проверка: last-login IP в админке реальный.

Промоушен development → master для релиза **v1.20.1** (patch поверх v1.20.0). ## Что уезжает (1 фикс + 1 chore) - **#264** fix(gateway): реальный client IP пробрасывается в backend на КАЖДОМ вызове (last-login IP в админке был докерным `172.19.0.9`); + `client_ip` в access-лог. - chore(ansible): system timezone всех хостов пиннится на UTC (tg-хост был MSK; применён живьём + durable в common-роли). ## Прод-безопасность (deploy-check) - **Миграций нет** → схема не меняется, maintenance-окно не нужно, откат DB-safe. - **Wire не менялся** → `GATEWAY_MIN_CLIENT_VERSION` не трогаем. - Изменения: gateway/backend Go-код (проброс IP-заголовка) + ansible (не в рантайм-образе). Нет Caddyfile/edge/Alt-Svc/mounted-secrets/DICT_VERSION. - Итог: низкорисковый image-only rolling deploy. ## После мержа Тег `v1.20.1` на master → `prod-deploy` (confirm=deploy) → watch → проверка: last-login IP в админке реальный.

developer added 3 commits 2026-07-14 09:38:56 +00:00

fix(gateway): forward the real client IP to the backend on every call ... ff55d5de83

The backend recorded 172.19.0.9 — the gateway's own docker connection address — as
the client IP for all users: the account's last-login IP shown in the admin console,
and it never reached the backend access log. The gateway forwarded the client IP as
X-Forwarded-For only on chat/feedback calls; every other backend call (including the
profile fetch that stamps last_login_ip) sent none, so the backend fell back to the
peer address.

Carry the client IP on the request context (WithClientIP, mirroring WithPlatform) and
set it once per request in the Connect edge, so the backend client injects
X-Forwarded-For on every downstream REST call. Also add the resolved client IP to the
backend access log.

Test: WithClientIP rides a non-chat call (Profile) as X-Forwarded-For, and is absent
when no IP is set. Docs updated (ARCHITECTURE gateway↔backend + edge).

chore(ansible): pin every host's system timezone to UTC ... c16008e67a

The tg (bot) VPS came up on Europe/Moscow while the main host is UTC, so host-level
timestamps (journald, file mtimes, cron) sat 3h apart across the fleet. Add a
community.general.timezone task to the common role so every provisioned host is UTC
(idempotent — a no-op on the already-UTC main host). Applied live to the tg host in
the same change; the containerised services run in UTC regardless, so no restart.

Merge pull request 'fix(gateway): forward the real client IP to the backend on every call (last-login IP was the docker addr)' (#264) from feature/forward-client-ip into development d8d1b06eee

owner approved these changes 2026-07-14 09:39:57 +00:00

developer merged commit 39e03d22e4 into master 2026-07-14 09:44:43 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

owner

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

owner (Ilia) developer

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: developer/scrabble-game#265