ScuroNeko/mtg
1
0
Fork 0
mirror of https://github.com/ScuroNeko/mtg.git synced 2026-09-02 00:11:56 +03:00
Code Issues Packages Projects Releases Wiki Activity

Pass real client IPs through with PROXY protocol v2

Browse Source 
Without this, mtg and Caddy see HAProxy's container IP for every
connection, which breaks meaningful logging, abuse handling, and any
IP-based blocklist logic.  HAProxy sends a PROXY protocol v2 header on
its TCP backends; mtg enables proxy-protocol-listener, and Caddy wraps
:8443 with a proxy_protocol listener before tls.

The :80 path (ACME HTTP-01 passthrough) is unchanged — client IP there
is not useful and HAProxy's http mode already adds X-Forwarded-For if
anyone wants it.

Requested in https://github.com/9seconds/mtg/pull/462 review.
This commit is contained in:
dolonet
2026-04-13 07:58:16 +00:00
parent d0412b21f6
commit 170346bb74
4 changed files with 44 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
contrib/sni-router/mtg-config.toml
+4
View File
@@ -7,6 +7,10 @@
secret = "PASTE_YOUR_SECRET_HERE"
bind-to = "0.0.0.0:3128"
# HAProxy in front sends PROXY protocol v2 headers so mtg can see the
# real client IP. Keep this in sync with haproxy.cfg (`send-proxy-v2`).
proxy-protocol-listener = true
[defense.anti-replay]
enabled = true
max-size = "1mib"