From be79e9e92b092fc50620084d6532e6de535e6329 Mon Sep 17 00:00:00 2001
From: Mel <mel@rnrd.eu>
Date: Fri, 1 May 2026 23:33:19 +0200
Subject: Don't set real_ip headers for Cloudflare on Tunnel egress hosts

Signed-off-by: Mel <mel@rnrd.eu>
---
 modules/tunnel/egress.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'modules/tunnel/egress.nix')

diff --git a/modules/tunnel/egress.nix b/modules/tunnel/egress.nix
index 55946ce..228a06a 100644
--- a/modules/tunnel/egress.nix
+++ b/modules/tunnel/egress.nix
@@ -136,6 +136,9 @@ in
     settingsFile = "/run/xray-configuration/xray.json";
   };
 
+  # don't unwrap cloudflare addresses
+  foundation.www.behindCloudflare = false;
+
   services.nginx = {
     defaultListen = [
       { addr = "127.0.0.1"; port = nginxPort; ssl = true; proxyProtocol = true; }
-- 
cgit 1.4.1