ScuroNeko/mtg
1
0
Fork 0
mirror of https://github.com/ScuroNeko/mtg.git synced 2026-08-31 13:14:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

Pass real client IPs through with PROXY protocol v2

Browse Source 
Without this, mtg and Caddy see HAProxy's container IP for every
connection, which breaks meaningful logging, abuse handling, and any
IP-based blocklist logic.  HAProxy sends a PROXY protocol v2 header on
its TCP backends; mtg enables proxy-protocol-listener, and Caddy wraps
:8443 with a proxy_protocol listener before tls.

The :80 path (ACME HTTP-01 passthrough) is unchanged — client IP there
is not useful and HAProxy's http mode already adds X-Forwarded-For if
anyone wants it.

Requested in https://github.com/9seconds/mtg/pull/462 review.
This commit is contained in:
dolonet
2026-04-13 07:58:16 +00:00
parent d0412b21f6
commit 170346bb74
4 changed files with 44 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
contrib/sni-router/haproxy.cfg
+8 -2
View File
@@ -46,10 +46,16 @@ frontend tls
default_backend web
backend mtg
server mtg mtg:3128
# send-proxy-v2 prepends a PROXY protocol v2 header so mtg sees the
# real client IP instead of HAProxy's. mtg must have
# `proxy-protocol-listener = true` in its config.
server mtg mtg:3128 send-proxy-v2
backend web
server web web:8443
# send-proxy-v2 prepends a PROXY protocol v2 header so Caddy logs the
# real client IP instead of HAProxy's. Caddy must enable the
# proxy_protocol listener wrapper on :8443 (see Caddyfile).
server web web:8443 send-proxy-v2
backend web_acme
mode http