From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 270DA1FF161 for ; Tue, 10 Sep 2024 02:30:55 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 40FC71BC43; Tue, 10 Sep 2024 02:30:52 +0200 (CEST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725928242; x=1726533042; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3XzZRSo42tOxEQR/ld66gyt/j9gGLYIsMjAu0gFPb1I=; b=o1wAHVw+xcBEB8K2PxaihXtvzz12S6B3pHSITF7L8Q+xJ+P/shBSnq2puGtsdvk6FF DiMc1kjKzyOBnrzNYVoOORbcrqhJcgnUsvmSwqSPfcJRTYUtgvwIF/+f/rfDhE9eEbCl /Fzry33Sj7xQuCKhFKNzHuRndBbf5QVHk+YkNZ4BhkIsIpSC7e2Z5y7oReMKB7qHj4In KTEO8Ub5P9mwglPMzjKU/C/oGqxzzLOyFIBVDUOXBHNw2y05Q8pAUiB9CrXFEDlfqxNu V9s+9xxO7tJm3ztmRorWSyzAp1jODhIKf9QOBKNXDtTJnPOiw1+fixCIiHd8FHiwvDo9 E4YQ== X-Gm-Message-State: AOJu0Yx7MeRzDnY0v6K11PleV0S9DOBT+mySyPyJeLIM8fOjnmgYCt1R XtaUPEXWuVDZ6C9+5ClRQL3hhJ5Uy9m4lcrRtL5B9gnTNoI1o4Cz36tzAg== X-Google-Smtp-Source: AGHT+IHOUOTliAuK6TYzA7pPJDkLKls+6Wy/gfPmfh6MonL/x/9vyAOSzbQACDgbfHBf5Ukx5vGdBg== X-Received: by 2002:a05:690c:87:b0:6b7:a7b3:8db2 with SMTP id 00721157ae682-6db4516ca91mr151139087b3.30.1725928242019; Mon, 09 Sep 2024 17:30:42 -0700 (PDT) From: Thomas Skinner To: pve-devel@lists.proxmox.com Date: Mon, 9 Sep 2024 19:30:24 -0500 Message-Id: <20240910003026.667328-2-thomas@atskinner.net> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240910003026.667328-1-thomas@atskinner.net> References: <20240910003026.667328-1-thomas@atskinner.net> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.003 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy FREEMAIL_FORGED_FROMDOMAIN 0.001 2nd level domains in From and EnvelopeFrom freemail headers are different FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider HEADER_FROM_DIFFERENT_DOMAINS 0.249 From and EnvelopeFrom 2nd level mail domains are different KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_MSPIKE_H2 -0.001 Average reputation (+2) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH docs 1/1] fix #5699: pveproxy: add docs for real IP support X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" --- pveproxy.adoc | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/pveproxy.adoc b/pveproxy.adoc index 4b5dac0..f0ae0f7 100644 --- a/pveproxy.adoc +++ b/pveproxy.adoc @@ -198,6 +198,35 @@ content, if the client supports it. This can disabled in `/etc/default/pveproxy` COMPRESSION=0 +[[pveproxy_real_ip]] +Real Client IP Logging +---------------------- + +By default, `pveproxy` logs the IP address of the client that sent the request. +In cases where a proxy server is in front of `pveproxy`, it may be desirable to +log the IP of the client making the request instead of the proxy IP. + +To enable processing of a HTTP header set by the proxy for logging purposes, set +`PROXY_REAL_IP_HEADER` to the name of the header to retrieve the client IP from. For +example: + + PROXY_REAL_IP_HEADER="X-Forwarded-For" + +Any invalid values passed in this header will be ignored. + +The default behavior is log the value in this header on all incoming requests. +To define a list of proxy servers that should be trusted to set the above HTTP +header, set `TRUSTED_PROXY_IPS`, for example: + + TRUSTED_PROXY_IPS="192.168.0.2" + +The `TRUSTED_PROXY_IPS` setting also supports values similar to the `ALLOW_FROM` +and `DENY_FROM` settings. + +IP addresses can be specified using any syntax understood by `Net::IP`. The +name `all` is an alias for `0/0` and `::/0` (meaning all IPv4 and IPv6 +addresses). + ifdef::manvolnum[] include::pve-copyright.adoc[] endif::manvolnum[] -- 2.39.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel