fix(backend): disable one-registration-per-IP by default

Shared NAT egress makes client IP unusable for uniqueness checks. Gate the behavior behind REGISTRATION_ENFORCE_IP (default false) for public/invite signup.
2026-10-07 23:13:22 +03:30
parent 92b1681241
commit 3cce2158e9
15 changed files with 103 additions and 53 deletions
@@ -23,6 +23,8 @@ FRONTEND_ORIGINS=https://app.example.com

 DEV_MODE=false
 SEED_CURRICULUM=false
+# Keep false behind NAT until the edge forwards real client IPs.
+REGISTRATION_ENFORCE_IP=false
 METRICS_TOKEN=replace-with-metrics-scrape-token
 # TRUSTED_PROXY_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16