Reverse proxy X-Forwarded-For

Ondersteuning
,
1

I recently migrated my forum to a much more performant host, and I am working towards high availability.

in the reverse proxy I added the Forward Proto and For headers but the nginx configuration on the discourse only respected the Proto.

I had to add under server:

set_real_ip_from loadbalancerip;
real_ip_header X-Forwarded-For;

Is there a discourse envvar to add these?
or possibly a argument to add to app.yml?

2

I believe this is what you’re looking for:

3

No this guide explains how to setup an nginx socket that’s shared between the container and host.

I’m trying to find a declarative way to include:

set_real_ip_from loadbalancerip;
real_ip_header X-Forwarded-For;

In the nginx configuration in containers after rebuild.

4

You’re trying to add this to the container’s internal nginx? I believe that’s unnecessary because it’s added by default:

5

This line is needed for that to work.
Without it all the requests are still the loadbalancer IP.
I know because my discourse was down for 429 errors.

In case it’s not clear this is my infra:
user > haproxy > discourse

Discourse of course includes an nginx rproxy

I included the forwarding headers in haproxy but the discourse internal nginx was not respecting forwarded for. I had to add the 2 lines in my OP and restart the container for it to work.

6

are you using a 2-containter build?

i don’t think there is built-in env variable for custom load balancer IPs, because nginx doesn’t natively read those vars for the server block.

also, if you manually edited the nginx config inside the running container, it will be wiped out the next time you rebuild.

i think in order to make it permanent and survive rebuilds, you need to use the replace command in your app.yml (or web_only.yml if dual container) - scroll to the very bottom of your .yml file to the run: section, and add this block. it tells the discourse builder to automatically inject your real ip settings after the server { block opens:

run:
  - replace:
      filename: /etc/nginx/conf.d/discourse.conf
      from: /server.+{/
      to: |
        server {
          set_real_ip_from 192.168.1.100; ## Replace with your actual load balancer ip/subnet
          real_ip_header X-Forwarded-For;
          real_ip_recursive on;

(make sure indentation and spacing match the rest of run block, yml files are super strict)