parker/cumulus
Watch
1
0
Fork
You've already forked cumulus
 0
Code Pull requests Activity Actions

Pin the forgejo compose subnet and trust it for forwarded client IPs #50

Merged
parkerhdavis merged 1 commit from forgejo-trusted-proxy into main 2026-10-12 21:33:26 -06:00
Conversation 0 Commits 1 Files changed 1 +9
parkerhdavis commented 2026-10-12 21:33:24 -06:00 (Migrated from github.com)
Copy link

Summary

With the forge behind the tunnel stack, its HTTP connections arrive through the published-port chain, which rewrites the TCP source to the compose network gateway. Forgejo's default REVERSE_PROXY_TRUSTED_PROXIES (loopback only) therefore did not trust the announcer and ignored the X-Forwarded-For chain set at the droplet's Traefik edge — every client appeared as 172.19.0.1 in the forge's logs and rate limiting.

Two changes in docker-compose.phd-tower.yml:

  • Pin the forgejo network subnet (172.30.240.0/24, verified free on the tower) so the trusted range stays correct across network recreations.
  • Trust that subnet (plus loopback) for forwarded client IPs.

Verified live: recreated containers show real client IPs in docker logs forgejo for HTTPS and API traffic through forge.parkerhdavis.com.

## Summary With the forge behind the tunnel stack, its HTTP connections arrive through the published-port chain, which rewrites the TCP source to the compose network gateway. Forgejo's default `REVERSE_PROXY_TRUSTED_PROXIES` (loopback only) therefore did not trust the announcer and ignored the `X-Forwarded-For` chain set at the droplet's Traefik edge — every client appeared as `172.19.0.1` in the forge's logs and rate limiting. Two changes in `docker-compose.phd-tower.yml`: - Pin the `forgejo` network subnet (`172.30.240.0/24`, verified free on the tower) so the trusted range stays correct across network recreations. - Trust that subnet (plus loopback) for forwarded client IPs. Verified live: recreated containers show real client IPs in `docker logs forgejo` for HTTPS and API traffic through `forge.parkerhdavis.com`.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
parker/cumulus!50
No description provided.