Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nginx x-forwarded-header #8447

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

nginx x-forwarded-header #8447

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions components/automate-load-balancer/habitat/config/automate-cs-nginx-location.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,18 @@
# Bookshelf requests are handled specially so that we can cache
# cookbook data at the edge of the system.
#
location /cs-nginx {
set_real_ip_from 127.0.0.1; # Set your load balancer IP here
real_ip_header X-Forwarded-For;
real_ip_recursive on;
# Define $source_ip variable to capture the client's original IP
set $source_ip $remote_addr;
if ($http_x_forwarded_for) {
set $source_ip $http_x_forwarded_for;
}
access_log {{ cfg.ngx.http.access_log }} chef;
}

location ~ "^/bookshelf/organization-.+" {
set $destination @bookshelf_cached;
if ($request_method !~ ^(GET)$) {
Expand Down
37 changes: 34 additions & 3 deletions components/automate-load-balancer/habitat/config/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,9 +56,27 @@ http {
scgi_temp_path {{ pkg.svc_var_path }}/scgi_temp_path;
uwsgi_temp_path {{ pkg.svc_var_path }}/uwsgi;

log_format chef '$remote_user [$time_local] '
'"$request" $status "$request_time" $body_bytes_sent '
'"$http_referer" "$http_user_agent" "$upstream_addr" "$upstream_status" "$upstream_response_time" $request_length';
log_format chef '$remote_addr - $remote_user [$time_local] '
'"$request" $status "$request_time" $body_bytes_sent '
'"$http_referer" "$http_user_agent" "$upstream_addr" '
'"$upstream_status" "$upstream_response_time" '
'"$http_x_chef_version" "$http_x_ops_sign" '
'"$http_x_ops_userid" "$http_x_ops_timestamp" '
'"$http_x_ops_content_hash" $request_length '
'"$http_x_forwarded_for" "$source_ip"';

# Define a map to handle the Forwarded header elements
map $remote_addr $proxy_forwarded_elem {
~^[0-9.]+$ "for=$remote_addr";
~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";
default "for=unknown";
}

# Define a map to append or replace the Forwarded header
map $http_forwarded $proxy_add_forwarded {
"~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
default "$proxy_forwarded_elem";
}

access_log {{ cfg.ngx.http.access_log }} chef;

Expand Down Expand Up @@ -120,6 +138,8 @@ http {
# TODO: I hate redirecting to https://host:443/ but handlebars has its limits :(
return 301 https://$server_name:{{ cfg.service.https_port }}$request_uri;
}
proxy_set_header Forwarded $proxy_add_forwarded;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

{{#each cfg.frontend_tls as |tls| ~}}
server {
Expand Down Expand Up @@ -156,6 +176,8 @@ http {
# Required to make persistent connections happen
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Forwarded $proxy_add_forwarded;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# By default, we don't want anything cached, ever. The big exception is
# automate-ui, with its own Cache-Control header below (location "/").
Expand Down Expand Up @@ -346,6 +368,15 @@ http {
deny all;
}

location /x_forwarded_for{
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass https://cs-nginx;
proxy_redirect https://cs-nginx /;
}

include {{../pkg.svc_config_path}}/*location.conf;
{{/if}}
}
Expand Down
Loading