jwed
b59b5bf6be
Found while implementing the resolver. The spec claimed the difference between "no client matched this IP" and "this IP is the proxy" made a TrustProxies misconfiguration one glance to diagnose. That holds only for the case where the forwarded header arrives and TrustProxies fails to apply it. If Traefik is misconfigured such that no X-Forwarded-For is sent at all, the resolver sees a plain unmatched IP and reports no_client — which reads to the person in front of it as "your device is not on the network", and to an operator as nothing at all. The alarm is silent in precisely one of the two ways the thing it guards can break. Recorded rather than patched, because the fix belongs to Plan 2's health line: it should show the resolved client IP and say what it is, instead of reporting a reason code. And the hardware validation step now has to confirm the true client IP actually arrives — confirming the alarm is quiet is not evidence, since a quiet alarm is what this blind spot produces.