fix(docker): expand 0.0.0.0/0 trusted-proxy CIDR for mod_remoteip

.gitattributes

@@ -0,0 +1,10 @@
+
+# Force LF line endings for scripts executed inside Linux containers.
+# A CRLF shebang (`#!/bin/sh` followed by a stray `\r`) makes the
+# kernel look for a nonexistent `/bin/sh\r` interpreter, which
+# surfaces as a confusing "exec: no such file or directory" error
+# instead of a parse error. Contributors on Windows with git's
+# default `core.autocrlf=true` get CRLF in their local working tree;
+# without this override that CRLF also lands in whatever Docker
+# COPYs from disk when building the image locally.
+docker/**/*.sh text eol=lf

docker/php/prod-entrypoint.sh

@@ -408,7 +408,27 @@ configure_apache() {
             printf '# Generated by prod-entrypoint on %s.\n' "$(date -u +%FT%TZ)"
             printf '# Per-deploy trusted-proxy list (SBPP_TRUSTED_PROXIES env var).\n'
             for proxy in $SBPP_TRUSTED_PROXIES; do
-                printf 'RemoteIPInternalProxy %s\n' "$proxy"
+                # mod_remoteip's apr_ipsubnet_create() rejects a /0 mask
+                # outright ("The specified network mask is invalid."),
+                # even though it's the natural way to spell "trust every
+                # proxy" (the documented setting for platforms like
+                # Railway that sit behind their own reverse proxy on an
+                # unpredictable internal IP). Split the whole-range /0
+                # into the two /1 halves that cover the identical range
+                # and that mod_remoteip DOES accept.
+                case "$proxy" in
+                    0.0.0.0/0)
+                        printf 'RemoteIPInternalProxy %s\n' "0.0.0.0/1"
+                        printf 'RemoteIPInternalProxy %s\n' "128.0.0.0/1"
+                        ;;
+                    ::/0)
+                        printf 'RemoteIPInternalProxy %s\n' "::/1"
+                        printf 'RemoteIPInternalProxy %s\n' "8000::/1"
+                        ;;
+                    *)
+                        printf 'RemoteIPInternalProxy %s\n' "$proxy"
+                        ;;
+                esac
             done
             # Apache 2.4+: when X-Forwarded-Proto comes from a trusted
             # proxy (i.e. mod_remoteip rewrote REMOTE_ADDR), mirror it