abhigyanpatwari/GitNexus · warning

[gitnexus serve] Ignoring ${TRUST_PROXY_ENV}=${value} (${rea

Error message

[gitnexus serve] Ignoring ${TRUST_PROXY_ENV}=${value} (${reason}); falling back to '${DEFAULT_TRUST_PROXY}'.

What it means

rejectTrustProxy fires when GITNEXUS_TRUST_PROXY is set to a value that fails resolveTrustProxy's validation (the parenthesized reason in the message says why). The value is ignored and trust falls back to DEFAULT_TRUST_PROXY ('loopback, linklocal, uniquelocal') with this warning. A separate earlier warning covers the unset case; this one covers set-but-invalid.

Source

Thrown at gitnexus/src/server/middleware.ts:392

 *   accepts traffic on every interface, a load balancer included.
 */
export function warnIfRateLimitKeysCollapse(boundHost?: string): void {
  if (process.env[TRUST_PROXY_ENV]?.trim()) return;
  if (!boundHost) return;
  // normalizeBoundHost returns undefined for a wildcard or unparseable host,
  // neither of which is loopback — so both warn.
  if (isLoopbackHostname(normalizeBoundHost(boundHost))) return;
  logger.warn(
    { host: boundHost, trustProxy: DEFAULT_TRUST_PROXY },
    `[gitnexus serve] Bound to ${boundHost} with ${TRUST_PROXY_ENV} unset, so 'trust proxy' is ` +
      `'${DEFAULT_TRUST_PROXY}'. A load balancer outside those ranges is not trusted, so req.ip ` +
      `is the balancer on every request and the per-IP rate limit becomes one shared limit across ` +
      `all callers. Set ${TRUST_PROXY_ENV} to the number of proxies you control.`,
  );
}

function rejectTrustProxy(value: string, reason: string): string {
  logger.warn(
    { [TRUST_PROXY_ENV]: value },
    `[gitnexus serve] Ignoring ${TRUST_PROXY_ENV}=${value} (${reason}); falling back to ` +
      `'${DEFAULT_TRUST_PROXY}'.`,
  );
  return DEFAULT_TRUST_PROXY;
}

View on GitHub (pinned to aac7515d2a)

Solutions

1. Set it to an integer hop count: GITNEXUS_TRUST_PROXY=1 for one trusted proxy, 2 behind two
2. Re-check startup logs after changing it: silence of both trust-proxy warnings means it parsed
3. Remember an invalid value falls back to the safe default — it never widens trust

Example fix

# before
export GITNEXUS_TRUST_PROXY=true      # rejected, falls back to default

# after
export GITNEXUS_TRUST_PROXY=1         # one trusted proxy hop

const v = process.env.GITNEXUS_TRUST_PROXY?.trim();
if (v !== undefined && !/^\d+$/.test(v)) {
  throw new Error(`GITNEXUS_TRUST_PROXY=${v} will be rejected; use an integer hop count`);
}

function isValidTrustProxy(value: string): boolean {
  return /^\d+$/.test(value.trim()) && Number(value) > 0;
}

When it happens

Trigger: Starting serve with GITNEXUS_TRUST_PROXY set to something that is not a valid proxy-hop count — 'true', 'yes', '1.5', 'one proxy' — so the value is rejected at validation and the default is used.

Common situations: Assuming boolean env-var semantics; copying an nginx-style config value; trailing units or whitespace. The server keeps running, but proxy headers are not honored and rate-limit keys collapse exactly as in the unset case.

Related errors

• ${name} must be a positive integer, got "${raw}"
• ${name} must be a non-negative integer, got "${raw}"
• GITNEXUS_EMBEDDING_DIMS must be a positive integer, got "${r
• ${source} must be a positive integer.
• GITNEXUS_MCP_READ_ONLY must be 0 or 1.

AI-assisted analysis of abhigyanpatwari/GitNexus@aac7515d2a (2026-08-20). Data as JSON: /api/errors/25c3b96f12a6cefa. Report an issue: GitHub.