Don't set real_ip headers for Cloudflare on Tunnel egress hosts

Signed-off-by: Mel <mel@rnrd.eu>

1 files changed, 12 insertions, 1 deletions

diff --git a/modules/foundation/www/default.nix b/modules/foundation/www/default.nix
index c41c2f6..7bd1a13 100644
--- a/modules/foundation/www/default.nix
+++ b/modules/foundation/www/default.nix
@@ -18,7 +18,9 @@ let
     concatMapStrings
     concatLines
     splitString
+    optional
     ;
+
   inherit (config.age) secrets;
 
   cfg = config.foundation.www;
@@ -75,6 +77,15 @@ in
       type = lib.types.package;
       default = default-page;
     };
+
+    behindCloudflare = mkOption {
+      type = lib.types.bool;
+      description = ''
+        Whether to add real_ip directives to unwrap
+        Cloudflare IP addresses.
+      '';
+      default = true;
+    };
   };
 
   config = mkIf cfg.enable {
@@ -147,7 +158,7 @@ in
             real_ip_header CF-Connecting-IP;
           '';
         in
-        concatLines [ logs cloudflare ];
+        concatLines ([ logs ] ++ (optional cfg.behindCloudflare cloudflare));
 
       virtualHosts = {
         base = mkIf cfg.public (defaultHost rnrdUrl "rnrd.eu" cfg.defaultPage "base");