diff options
| author | Mel <mel@rnrd.eu> | 2026-05-01 23:33:19 +0200 |
|---|---|---|
| committer | Mel <mel@rnrd.eu> | 2026-05-01 23:33:19 +0200 |
| commit | be79e9e92b092fc50620084d6532e6de535e6329 (patch) | |
| tree | dfb671a6629af0fcd8ac4854401065b4d0eedf71 | |
| parent | a205d5b3900fd0024fc94a1fa751ec96cc3f6ed8 (diff) | |
| download | network-be79e9e92b092fc50620084d6532e6de535e6329.tar.zst network-be79e9e92b092fc50620084d6532e6de535e6329.zip | |
Don't set real_ip headers for Cloudflare on Tunnel egress hosts
Signed-off-by: Mel <mel@rnrd.eu>
| -rw-r--r-- | modules/foundation/www/default.nix | 13 | ||||
| -rw-r--r-- | modules/tunnel/egress.nix | 3 |
2 files changed, 15 insertions, 1 deletions
diff --git a/modules/foundation/www/default.nix b/modules/foundation/www/default.nix index c41c2f6..7bd1a13 100644 --- a/modules/foundation/www/default.nix +++ b/modules/foundation/www/default.nix @@ -18,7 +18,9 @@ let concatMapStrings concatLines splitString + optional ; + inherit (config.age) secrets; cfg = config.foundation.www; @@ -75,6 +77,15 @@ in type = lib.types.package; default = default-page; }; + + behindCloudflare = mkOption { + type = lib.types.bool; + description = '' + Whether to add real_ip directives to unwrap + Cloudflare IP addresses. + ''; + default = true; + }; }; config = mkIf cfg.enable { @@ -147,7 +158,7 @@ in real_ip_header CF-Connecting-IP; ''; in - concatLines [ logs cloudflare ]; + concatLines ([ logs ] ++ (optional cfg.behindCloudflare cloudflare)); virtualHosts = { base = mkIf cfg.public (defaultHost rnrdUrl "rnrd.eu" cfg.defaultPage "base"); diff --git a/modules/tunnel/egress.nix b/modules/tunnel/egress.nix index 55946ce..228a06a 100644 --- a/modules/tunnel/egress.nix +++ b/modules/tunnel/egress.nix @@ -136,6 +136,9 @@ in settingsFile = "/run/xray-configuration/xray.json"; }; + # don't unwrap cloudflare addresses + foundation.www.behindCloudflare = false; + services.nginx = { defaultListen = [ { addr = "127.0.0.1"; port = nginxPort; ssl = true; proxyProtocol = true; } |