fix(nodes): locate agents behind a proxy and retry missing countries [CI]

backend/fleet/src/Fleet.Server.Abstractions/ServerContracts.cs

@@ -6,6 +6,17 @@ namespace Fleet.Server;
 
 public sealed record EnrollmentContext(string? RemoteIp, JsonElement? ProductMeta);
 
+/// <summary>
+/// 节点的真实来源地址：前面有反向代理时，套接字上只有代理的地址，产品在这里决定信不信转发头。
+/// 没有注册就用套接字地址。
+/// </summary>
+public interface IClientAddressSource
+{
+    /// <param name="socket">套接字上看到的对端地址。</param>
+    /// <param name="header">按名字取请求头的所有值。</param>
+    string? Resolve(System.Net.IPAddress? socket, Func<string, IEnumerable<string>> header);
+}
+
 /// <summary>
 /// 服务器的身份密钥：操作员用 passkey 把它的公钥签进操作员集合。有它的时候，认证挑战会带上服务器的签名，节点据此确认对面是真的服务器，
 /// 并在这条链路上用应用层加密。没有注册就是旧的行为（没有服务器身份）。
@@ -38,7 +49,8 @@ public enum NodeEventKind
     Heartbeat,
 }
 
- public sealed record NodeEvent(NodeEventKind Kind, NodeRecord Node, long AtMs, HelloParams? Hello = null, JsonElement? Extra = null, string? Reason = null);
+ /// <param name="RemoteIp">这条连接的来源地址（经过 <see cref="IClientAddressSource"/>）；没有就是 null。</param>
+public sealed record NodeEvent(NodeEventKind Kind, NodeRecord Node, long AtMs, HelloParams? Hello = null, JsonElement? Extra = null, string? Reason = null, string? RemoteIp = null);
 
 public interface INodeEventSink
 {