sync repo docs

Author: github-bot-metro

docs/archipelago-deployment-live-readme.md

@@ -271,6 +271,24 @@ If you want to run NGINX first without any intercepting please do. You can alway
 ```
 cp config_storage/nginxconfig/template/nginx.conf.template.default config_storage/nginxconfig/template/nginx.conf.template
 ```
+#### IMPORTANT!! (IP Based embargoes and Anubis)
+
+If you decided to run Anubis, you must be aware that because of how it acts as "middleware" in NGINX, the client IP, Port and other original Client Information are going to be sent via headers from NGINX to PHP on the backend. By default Drupal and Symfony will not trust those headers (nor its origin) and that will intefere with IP Based embargo Bypass Logic as defined on the Format Strawberry Field Module (if you set that up). If you don't act on this, still any IP based embargoed ADOs will be secure. Without making the changes recommended below, your site's embargoed objects will be *so secure* that literally nobody other than a logged in (via Drupal) user will be able to access them because the Client IP that PHP will see is the one of the NGINX Container (inside Docker).
+
+Only IF you are running Anubis (don't do this if not - DANGER -), and to ensure trustable information from the Forwarded IP headers is decoded as trusted "Client IP" on PHP, please edit your `drupal\web\sites\default\settings.php` and ensure that you replace the following `if (PHP_SAPI !== 'cli')` statement with the following snippet (or if recently deployed just comment/uncomment what is there already).
+
+```PHP
+if (PHP_SAPI !== 'cli') {
+  $settings['reverse_proxy'] = TRUE;
+  # $settings['reverse_proxy_addresses'] = [@\$_SERVER['REMOTE_ADDR']];
+  # If Running Anubis via NGINX, as Documented in this release, comment (or keep commented out) the previous line
+  # and (keep) uncomment The two following Lines. Add/Replace Any Private IP Ranges under which your Docker Containers Run. 
+  # The ranges set there are the most common ones found for Docker Networks, but could be different if you customized it.
+  # You can also disable some of the trusted headers for extra security (most important one is the .
+  $settings['reverse_proxy_addresses'] = ['10.0.0.0/8','192.168.0.0/16', '172.16.0.0/12'];
+  $settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED;
+}
+```
 
 That is all. DONE! Danke!