euler-xyz · Seranged · Sep 10, 2026 · Sep 9, 2026 · Sep 9, 2026 · Aug 21, 2026
diff --git a/.env.example b/.env.example
@@ -2,8 +2,36 @@
 # origin rejection, and HSTS. Injected automatically by Doppler at runtime.
 DOPPLER_ENVIRONMENT=dev
 
-# Fallback country when cf-ipcountry is absent (local dev, PR previews, any env without Cloudflare).
-# Bypasses fail-closed geo-gate — do not set in production behind Cloudflare.
+# Fronting edge provider preset (cloudflare | google | cloudfront | none).
+# Selects which trusted request headers carry the client IP, country, and
+# VPN evidence (the mapping lives in utils/edge-presets.ts). Default: none —
+# no edge-derived trust, geo-blocking off, rate limiting on best-effort
+# identity. Fork- and preview-friendly, but REQUIRED in production
+# (DOPPLER_ENVIRONMENT=prd): the server refuses to boot when unset there.
+# Setting it to "none" in production is an explicit opt-out with no trusted
+# identity (rate-limit keys are forgeable) and is logged as a warning at boot.
+# The google preset additionally needs the LB configured to stamp
+# x-client-geo: {client_region} as a custom request header.
+EDGE_PROVIDER=
+
+# Origin-auth shared secret (server-side only). When set, every request
+# must carry a matching x-edge-origin-auth header — stamped by the edge
+# (e.g. a request-header transform rule) — or the edge-derived inputs are
+# treated as absent and the fail-closed paths apply. This replaces the
+# "origin is only reachable through the edge" topology assumption with a
+# check the app enforces itself. Optional for the cloudflare/none presets;
+# REQUIRED for google/cloudfront (their edges forward client headers
+# untouched, so without origin auth their trusted inputs would be forgeable
+# — the server refuses to boot without it). Internal server-to-server
+# fetches authenticate with a random per-process marker when this is unset,
+# so no preset depends on the secret for internal traffic. Configure the
+# edge to stamp the header BEFORE setting this, and to strip
+# client-supplied x-edge-internal.
+EDGE_ORIGIN_SECRET=
+
+# Fallback country when the edge provides none (local dev, PR previews, any
+# env without a geo-capable edge). Bypasses the fail-closed geo-gate, so
+# production (DOPPLER_ENVIRONMENT=prd) refuses to boot when it is set.
 DEV_GEO_COUNTRY=GB
 
 # Reown (AppKit) configuration

diff --git a/AGENTS.md b/AGENTS.md
@@ -108,9 +108,11 @@ Euler Lite is the only service. Standard commands live in `README.md` ("Availabl
   Note: `internal/screen-address` is additionally consumed cross-origin by first-party
   `*.euler.finance` SPAs via a path-scoped CORS exception in `cors.ts` — keep its contract
   backward-compatible.
-- **Server middleware:** `geo-gate.ts` (451 for sanctioned countries via Cloudflare `CF-IPCountry`;
-  set `DEV_GEO_COUNTRY` locally since there's no CF header), `cors.ts`, `security-headers.ts`,
-  `body-limit.ts`, `ensure-vault.ts`.
+- **Server middleware:** `geo-gate.ts` (451 for sanctioned countries via the country from
+  `getEdgeContext` — trusted-header mapping per `EDGE_PROVIDER` preset in `utils/edge-presets.ts`;
+  set `DEV_GEO_COUNTRY` locally since there's no edge header), `cors.ts`, `security-headers.ts`,
+  `body-limit.ts`, `ensure-vault.ts`. Middleware and routes stay vendor-neutral: edge header
+  names live only in the presets file, consumed through `server/utils/edge.ts`.
 - **Server plugins (load order matters):** `app-config.ts` / `chain-config.ts` inject the `window`
   config; `csp.ts` (nonce-based CSP) must run after them; `warm-cache.ts` warms labels/token-list/
   vault caches in the background. Caching internals are in `docs/server-side-caching.md`.

diff --git a/Dockerfile b/Dockerfile
@@ -63,8 +63,12 @@ COPY --from=doppler /usr/local/bin/doppler ./doppler
 
 EXPOSE ${APP_PORT}
 
+# Liveness probe: /healthz lives outside /api/ so it is exempt from the
+# geo-gate, rate limiting, and internal-request authentication — the probe
+# must not depend on edge configuration (EDGE_PROVIDER / EDGE_ORIGIN_SECRET)
+# and must never carry the origin secret in its arguments.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD ["/nodejs/bin/node", "-e", "fetch('http://localhost:'+process.env.PORT+'/api/internal/tenderly/status',{headers:{'cf-connecting-ip':'127.0.0.1'}}).then(r=>{if(!r.ok)throw r.status}).catch(()=>process.exit(1))"]
+  CMD ["/nodejs/bin/node", "-e", "fetch('http://localhost:'+process.env.PORT+'/healthz').then(r=>{if(!r.ok)throw r.status}).catch(()=>process.exit(1))"]
 
 # Doppler injects all secrets at runtime via DOPPLER_TOKEN, DOPPLER_PROJECT, DOPPLER_CONFIG env vars.
 # server/plugins/chain-config.ts scans env vars and injects chain config via render:html hook.

diff --git a/README.md b/README.md
@@ -77,7 +77,7 @@ Euler Lite uses the [Euler V2 SDK](https://github.com/euler-xyz/euler-sdks) for
 | `CORS_ALLOWED_ORIGINS` | Comma-separated allowlist for `/api/*`; falls back to `NUXT_PUBLIC_APP_URL`. |
 | `FIRST_PARTY_COOKIE_SECRET` | Optional server-only secret that keeps the internal API marker cookie stable across replicas and deploys. Defaults to a value derived from `NUXT_PUBLIC_APP_URL` or `RAILWAY_PUBLIC_DOMAIN`. |
 | `CSP_EXTRA_CONNECT_SRC` | Extra `connect-src` origins for development or staging endpoints. |
-| `DEV_GEO_COUNTRY` | Local/preview country fallback when Cloudflare geo headers are absent. Do not set in production behind Cloudflare. |
+| `DEV_GEO_COUNTRY` | Local/preview country fallback when the edge provides no country. Production (`DOPPLER_ENVIRONMENT=prd`) refuses to boot with it set. |
 | `ADDRESS_SCREENING_URI` / `ADDRESS_SCREENING_API_KEY` | Server-side data-v3 compliance endpoint + restricted API key, proxied by `/api/internal/screen-address` (also serves first-party `*.euler.finance` SPAs). Both unset ⇒ screening disabled (all addresses pass) — except in production (`DOPPLER_ENVIRONMENT=prd`), where missing configuration fails closed; only one set ⇒ fails closed everywhere. URI must be https (localhost http allowed for dev). |
 | `MERKL_API_KEY` | Optional server-side Merkl key. The Merkl API works anonymously (10 req/sec shared across all users via `/api/internal/proxy/merkl`); set this to send `X-API-Key` upstream for a higher quota. Server-only — never exposed to the browser. |
 | `TENDERLY_ACCESS_KEY`, `TENDERLY_ACCOUNT_SLUG`, `TENDERLY_PROJECT_SLUG` | Optional Tenderly simulation configuration. |

diff --git a/composables/useAddressScreen.ts b/composables/useAddressScreen.ts
@@ -50,15 +50,7 @@ export const useAddressScreen = () => {
       const vpnIsUsed = await detectVpn()
       if (gen !== screeningGeneration) return false
 
-      // A positive local signal is independently blocking. A clean or failed
-      // remote address-screen response must never erase it.
-      if (vpnIsUsed) {
-        await disconnect()
-        if (gen !== screeningGeneration) return false
-        showBlockedModal(address)
-        return true
-      }
-
+      // VPN usage is audit metadata; only the address-screening verdict gates access.
       const isRestricted = await screenAddress(address, vpnIsUsed)
       if (gen !== screeningGeneration) return false
 

diff --git a/composables/useEnvConfig.ts b/composables/useEnvConfig.ts
@@ -22,8 +22,9 @@ import {
   EMPTY_ANNOUNCEMENT_CONFIG,
   type AnnouncementConfig,
 } from '~/utils/announcement-config'
+import { edgeProvidesVpnEvidence, parseEdgeProvider } from '~/utils/edge-presets'
 
-interface EnvConfig {
+export interface EnvConfig {
   appTitle: string
   appDescription: string
   logoUrl: string
@@ -42,6 +43,16 @@ interface EnvConfig {
   swapApiUrl: string
   eulerInterfacesBranch: string
   announcement: AnnouncementConfig
+  /** Whether the deployment's edge provider measures VPN usage. Drives the
+   *  client VPN probe in services/vpn.ts — false skips it entirely. */
+  vpnDetection: boolean
+}
+
+declare global {
+  interface Window {
+    /** Server-injected runtime config (server/plugins/app-config.ts). */
+    __APP_CONFIG__?: EnvConfig
+  }
 }
 
 const DEFAULTS: EnvConfig = {
@@ -58,6 +69,7 @@ const DEFAULTS: EnvConfig = {
   swapApiUrl: '',
   eulerInterfacesBranch: 'master',
   announcement: EMPTY_ANNOUNCEMENT_CONFIG,
+  vpnDetection: false,
 }
 
 let cached: EnvConfig | null = null
@@ -94,6 +106,7 @@ function scanEnv(): EnvConfig {
       items: env('CONFIG_ANNOUNCEMENT_ITEMS', 'NUXT_PUBLIC_CONFIG_ANNOUNCEMENT_ITEMS'),
       url: env('CONFIG_ANNOUNCEMENT_URL', 'NUXT_PUBLIC_CONFIG_ANNOUNCEMENT_URL'),
     }),
+    vpnDetection: edgeProvidesVpnEvidence(parseEdgeProvider(process.env.EDGE_PROVIDER)),
   }
 }
 
@@ -130,6 +143,10 @@ function fromRuntimeConfig(): EnvConfig {
       items: rc.configAnnouncementItems,
       url: rc.configAnnouncementUrl,
     }),
+    // Static/CDN deployments carry no edge preset information — skip the
+    // VPN probe (the server derives the authoritative verdict from edge
+    // request headers regardless).
+    vpnDetection: false,
   }
 }
 
@@ -139,10 +156,8 @@ export const useEnvConfig = (): EnvConfig => {
   if (import.meta.server) {
     cached = scanEnv()
   }
-  /* eslint-disable @typescript-eslint/no-explicit-any -- server-injected window global */
-  else if (typeof window !== 'undefined' && (window as any).__APP_CONFIG__) {
-    cached = (window as any).__APP_CONFIG__
-  /* eslint-enable @typescript-eslint/no-explicit-any */
+  else if (typeof window !== 'undefined' && window.__APP_CONFIG__) {
+    cached = window.__APP_CONFIG__
   }
   else {
     cached = fromRuntimeConfig()