Skip to content

Proxy Protocol Implementation#1384

Draft
joshua-siw wants to merge 9 commits intoTecharoHQ:mainfrom
joshua-siw:feat/1208-proxy-protocol
Draft

Proxy Protocol Implementation#1384
joshua-siw wants to merge 9 commits intoTecharoHQ:mainfrom
joshua-siw:feat/1208-proxy-protocol

Conversation

@joshua-siw
Copy link
Copy Markdown

resolves: #1208

Allows listening to Connections with a Proxy Protocol Header(detects v1 or v2 automatically) and sets x-real-ip accordingly.

Theoretically this would allow to remove the usage of x-real-ip in caddy or ha proxy configs but only if all connections have a proxy header which can be configured with a combination of a "proxy-protocol-allowed-cidrs" and "proxy-protocol-policy".

Also allows sending Proxy Protocol Headers if "proxy-protocol-send-version" is set but it isnt possible to get the correct port if the connection didnt sent a proxy protocol header(eg use-proxy is false and we only have the x-real-ip from for example ha proxy)

Tests are missing as well as i want to get feedback on the implementation before i start, also could do a refactor of my code here and there

Here is a compose file which configured haproxy to send proxy protocol headers(i set ko.local when building the image via npm run container), creates a subnet with a cidr and allows this cidr to use proxy headers in anubis, if traffic comes from a different cidr it gets rejected also if the traffic wouldnt have proxy protocol header.
One could change it when setting the policy to IGNORE but then x-real-ip has to be passed in from haproxy


services:
  haproxy:
    image: haproxy:latest
    ports:
      - "80:80"
    configs:
      - source: haproxy_cfg
        target: /usr/local/etc/haproxy/haproxy.cfg
    networks:
      - anubis_subnet

  anubis:
    image: ko.local/anubis:latest
    pull_policy: if_not_present
    expose:
      - "3000"
    command:
      - --bind=:3000
      - --use-proxy-protocol=true
      - --proxy-protocol-allowed-cidrs=172.20.0.0/24
      - --proxy-protocol-policy=REJECT
      - --target=http://whoami:81
      - --slog-level=DEBUG
    networks:
      - anubis_subnet

  whoami:
    image: traefik/whoami
    pull_policy: always
    ports:
      - "81:81"
    environment:
      WHOAMI_PORT_NUMBER: 81
    networks:
      - anubis_subnet

configs:
  haproxy_cfg:
    content: |
      global
        log stdout format raw daemon

      defaults
          log global
          mode http
          option httplog
          timeout client 30s
          timeout connect 5s
          timeout server 30s
      
      frontend fe_http
          bind *:80
          default_backend be_anubis
      
      backend be_anubis
          mode http
          server anubis anubis:3000 send-proxy

networks:
  anubis_subnet:
    ipam:
      config:
        - subnet: 172.20.0.0/24

Checklist:

  • Added a description of the changes to the [Unreleased] section of docs/docs/CHANGELOG.md
  • Added test cases to the relevant parts of the codebase
  • Ran integration tests npm run test:integration (unsupported on Windows, please use WSL)
  • All of my commits have verified signatures
@joshua-siw
Copy link
Copy Markdown
Author

joshua-siw commented Jan 2, 2026

saw to late that #1381 already exists, feel free to close my pr

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant