v0.1.2

• Release 0.1.2 (#10)
• Name the owner as the gem's author and copyright holder (#9)
• Drop the former owner's org name from AGENTS.md (#8)
• Bump ruby/setup-ruby from 1.336.0 to 1.338.0 in the github-actions group across 1 directory (#5)

v0.1.1

• Bump version to 0.1.1 (#7)
• Point the gem at its new owner (#6)

v0.1.0

First release.

A Rack middleware, installed by a Railtie at the top of the middleware stack, for Rails apps served through Cloudflare:

• Refuses requests that did not come through Cloudflare (403, cache-control: no-store), using an origin secret a Cloudflare Transform Rule adds. A GET/HEAD of /up without CF-Ray stays open for the platform's health check.
• Removes Forwarded, Client-IP, X-Forwarded-For, X-Real-IP and X-Forwarded-Host on every request, so no visitor-sent header can choose the client IP or make Rails raise IpSpoofAttackError.
• Sets REMOTE_ADDR from CF-Connecting-IP, so request.ip and request.remote_ip both return the visitor. A verified request without a valid CF-Connecting-IP is reported to Rails.error and raises.
• Reads the current and previous secret from CLOUDFLARE_ORIGIN_SECRET(_PREVIOUS) or from credentials, so the secret rotates without downtime. Installs only when a current secret is set, never in development or test.

Requires Ruby 4.0+ and Rails 8.1+. See the README for the Cloudflare setup it assumes.