fix(backend): disable one-registration-per-IP by default

Shared NAT egress makes client IP unusable for uniqueness checks. Gate the behavior behind REGISTRATION_ENFORCE_IP (default false) for public/invite signup.
2026-10-07 23:13:22 +03:30
parent 92b1681241
commit 3cce2158e9
15 changed files with 103 additions and 53 deletions
@@ -23,6 +23,8 @@ FRONTEND_ORIGINS=https://localhost,https://127.0.0.1
 # Keep false unless you intentionally want fail-open rate limits / captcha.
 DEV_MODE=false
 SEED_CURRICULUM=false
+# One registration per client IP. Keep false behind NAT / shared egress (default).
+REGISTRATION_ENFORCE_IP=false
 # METRICS_TOKEN=
 # TRUSTED_PROXY_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,::1/128