From 5819348064dfcb081daca0c71df4d70c8ee6fc93 Mon Sep 17 00:00:00 2001 From: LukeGus Date: Wed, 7 Oct 2026 21:39:31 -0500 Subject: [PATCH] feat: add TRUSTED_PROXIES to choose who nginx takes client IPs from (GHSA-7j7m-85p4-2cpm) --- docker/entrypoint.sh | 19 +++++++++++++++++++ docker/nginx-https.conf | 2 ++ docker/nginx.conf | 2 ++ 3 files changed, 23 insertions(+) diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index 7a7742d2b..39e810eb4 100644 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -68,6 +68,25 @@ fi mkdir -p /tmp/nginx envsubst '${PORT} ${SSL_PORT} ${SSL_CERT_PATH} ${SSL_KEY_PATH}' < $NGINX_CONF_SOURCE > /tmp/nginx/nginx.conf +# Which proxies may set the client IP through X-Forwarded-For. Unset keeps +# the private ranges in the template. +if [ -n "$TRUSTED_PROXIES" ]; then + REAL_IP_LINES="" + for proxy in $(echo "$TRUSTED_PROXIES" | tr ',' ' '); do + case "$proxy" in + *[!0-9a-fA-F:./]*) echo "Ignoring invalid TRUSTED_PROXIES entry: $proxy" ;; + *) REAL_IP_LINES="${REAL_IP_LINES} set_real_ip_from ${proxy};\n" ;; + esac + done + echo "Trusting X-Forwarded-For from: $TRUSTED_PROXIES" + awk -v lines="$REAL_IP_LINES" ' + /# BEGIN TRUSTED_PROXIES/ { printf "%s", lines; skip = 1; next } + /# END TRUSTED_PROXIES/ { skip = 0; next } + !skip + ' /tmp/nginx/nginx.conf > /tmp/nginx/nginx.conf.tmp + mv /tmp/nginx/nginx.conf.tmp /tmp/nginx/nginx.conf +fi + if [ "$ENABLE_SSL" = "true" ] && [ "$PORT" = "$SSL_PORT" ]; then echo "HTTP and HTTPS use port $SSL_PORT; disabling the HTTP redirect listener" sed -i '/# BEGIN HTTP_REDIRECT_SERVER/,/# END HTTP_REDIRECT_SERVER/d' /tmp/nginx/nginx.conf diff --git a/docker/nginx-https.conf b/docker/nginx-https.conf index 2cda0abff..0684f3ed0 100644 --- a/docker/nginx-https.conf +++ b/docker/nginx-https.conf @@ -41,10 +41,12 @@ http { image/svg+xml; client_header_timeout 300s; + # BEGIN TRUSTED_PROXIES set_real_ip_from 127.0.0.1; set_real_ip_from 10.0.0.0/8; set_real_ip_from 172.16.0.0/12; set_real_ip_from 192.168.0.0/16; + # END TRUSTED_PROXIES real_ip_header X-Forwarded-For; real_ip_recursive on; diff --git a/docker/nginx.conf b/docker/nginx.conf index d9cfda5a3..1ecea3455 100644 --- a/docker/nginx.conf +++ b/docker/nginx.conf @@ -41,10 +41,12 @@ http { image/svg+xml; client_header_timeout 300s; + # BEGIN TRUSTED_PROXIES set_real_ip_from 127.0.0.1; set_real_ip_from 10.0.0.0/8; set_real_ip_from 172.16.0.0/12; set_real_ip_from 192.168.0.0/16; + # END TRUSTED_PROXIES real_ip_header X-Forwarded-For; real_ip_recursive on;