[Bortseb]

Summary

• Adds an opt-in public_proxy config flag (default false) so anonymous visitors on an HTTPS wiki can use /proxy to fetch HTTP-only remote pages. (Like much of the resources in how-to-wiki for example)
• Signed-in owners keep the previous /proxy behavior, including localhost and LAN targets.
• Anonymous /proxy requests that target (or resolve to) localhost or private/link-local addresses are rejected; redirects are not followed for those callers.

Why this is useful

Many default and how-to-wiki resources in the federation still live on HTTP-only sites. When a reader is on HTTPS, the browser blocks those fetches as mixed content. The existing /proxy route already solves that for signed-in owners, but ordinary visitors hit 403, so linked how-to-wiki pages and similar neighbor content look broken.

With public_proxy: true, a farm can make that mixed-content bridge available to everyone without changing the client.

Safety (opt-in, not an open proxy)

This is not a general open proxy:

• Opt-in only — default remains login-gated; nothing changes until public_proxy is set.
• GET only — same as today.
• Narrow path types — still limited to .json, .png, .jpg, and plugin/... (wiki-shaped resources, not arbitrary URLs).
• HTTP-only upstream — still forces http:// to the remote host.
• Short timeout — existing 2s abort remains.
• Anonymous SSRF guard — for anonymous callers, the host is DNS-resolved and private/loopback/link-local addresses are refused; redirects are not followed. That restriction does not apply to signed-in owners, so existing local/LAN federation is unchanged.

Enable with: { "public_proxy": true } in the wiki config.

You can test this change out with the public proxy turned on here:
https://public-proxy.aolc.cc/view/welcome-visitors/view/how-to-wiki/fed.wiki.org/field-guide-to-the-federation

Test plan

• With default config (no public_proxy): anonymous /proxy/... still returns 403; signed-in owner still works as before (including localhost if used).
• With public_proxy: true: anonymous fetch of a public HTTP wiki page JSON via /proxy/{host}/{slug}.json succeeds.
• With public_proxy: true: anonymous /proxy/127.0.0.1/... and /proxy/localhost/... return 403.
• With public_proxy: true: a hostname that resolves to a private IP is rejected (403).
• With public_proxy: true: anonymous requests do not follow redirects to another host.
• HTTPS client can resolve an HTTP-only neighbor through /proxy without signing in.

[Bortseb]

Follow-up idea (not in this PR): with public_proxy enabled, anonymous callers can still use the farm as a free fetcher for any public .json / image / plugin/... URL, which is mostly an abuse/bandwidth concern rather than SSRF.

A small next step would be per-IP (and maybe per-remote-host) rate limits plus a response size cap. Happy to open a follow-up if that sounds useful.

[paul90]

Open proxy is a NO NO