-
Notifications
You must be signed in to change notification settings - Fork 272
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Service is seeing the IP address from the ingress controller instead of client IPs #164
Comments
@jokoso, what load balancer are you using? Are you able to see your source IP in ingress logs? |
@jokoso, try adding this to your configs:
proxy.config.php: |-
<?php
$CONFIG = array (
'trusted_proxies' => array(
0 => '127.0.0.1',
1 => '10.0.0.0/8',
),
'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
); |
I'm using |
I have the same problem, the pod logs are showing the proxy IP instead of the real client. The reason is that my clients are in the local network with private IP addresses and that is not supported on RemoteIPTrustedProxy, only on RemoteIPInternalProxy. Setting trusted_proxies on Nextcloud configuration doesn't help as access/error logs are generated by Apache. The current configuration is a reasonable default, you can overlay an updated configuration file by creating a new external ConfigMap and then map the specific file over: ConfigMap apiVersion: v1
kind: ConfigMap
metadata:
name: nextcloud-apache-config
namespace: apps
data:
remoteip.conf: |-
RemoteIPHeader X-Real-IP
RemoteIPInternalProxy 10.0.0.0/8 values.yaml: nextcloud:
extraVolumes:
- name: nextcloud-apache-config
configMap:
defaultMode: 420
name: nextcloud-apache-config
extraVolumeMounts:
- mountPath: /etc/apache2/conf-enabled/remoteip.conf
name: nextcloud-apache-config
subPath: remoteip.conf I hope it helps! |
You're absolutely right, @sgissi.
Thanks for the hint, I think that's an elegant solution. 👌 Closing the issue. |
Absolutely perfect solution, @sgissi 👌 |
This can be observed by looking at the log from the pod.
I would like client IP addresses to be observable from the Nextcloud service, e.g. so it can throttle login attempts properly.
I'm using
ingress-nginx
as my k8s cluster ingress controller and it sets the appropriate headers automatically. However, theapache2
config file/etc/apache2/conf-available/remoteip.conf
of the web server on the pod/container is configured as follows:which is not bad, but I had to change mine to something like:
for client IPs to be accepted by
apache2
and thus the Nextcloud service.It would be really nice to be able to configure the contents of this file in
values.yaml
if necessary.The text was updated successfully, but these errors were encountered: