Repository navigation
Config 'trusted_proxies'. Allow networks with CIDR #6550
Description
Steps to reproduce
- Add config 'trusted_proxies' with IP like '10.42.0.0/16'
- Add config 'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
Expected behaviour
The real IP should be logged.
Actual behaviour
The IP of the reverse proxy is logged
Server configuration
Operating system:
Official docker-image
Web server:
Official docker-image
Database:
MySQL
PHP version:
Nextcloud version: (see Nextcloud admin page)
12.0.2
Where did you install Nextcloud from:
Docker
Signing status:
Signing status
No errors have been found.
We are using Rancher in our environment. In front of nextcloud is an nginx reverse proxy. In rancher, any container get a random IP from the internal rancher-network 10.42.0.0/16. If the reverse proxy will be restarted, the container get a new random IP from 10.42.0.0/16.
Is it possible to allow in the config 'trusted_proxies' whole networks in the format 10.42.0.0/16? Currently I would have to write all IPs from 10.42.0.0/16 in the array and this is too much.
Activity
jowenn commentedon Dec 6, 2017
This missing feature is quite annoying with docker swarm mode, since all logins get delayed because the brute force detections only sees the proxy which has a dynamic ip address
hannut commentedon Jan 18, 2018
I stumbled to this same problem on docker/traefik/letsencrypt -combination
svengo commentedon Mar 29, 2018
I have the same problem (docker-compose/traefik/letsencrypt) - and we're not the only ones: nextcloud/docker#294
sehucke commentedon May 8, 2018
Any news on this?
Only workaround so far is to use a static ip for the reverse proxy.
olivermg commentedon Oct 11, 2018
We're also running into this issue currently.
Any news?
sehucke commentedon Oct 11, 2018
Seems this is not the case. I still face this issue, too. I had no time to work around it, though.
My idea: Starting a sidekick container on proxy bootup to alter the NC config entry. Just wondering if this is a secure way to approach the issue...
sehucke commentedon Oct 11, 2018
In addition, If you are using Kubernetes I would think of using ConfigMaps/Secrets to populate your NC config at start time.