daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-09-18 09:17:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix trusted proxies

Browse Source 
Signed-off-by: Simon L. <szaimen@e.mail.de>
This commit is contained in:
Simon L.
2026-09-02 10:37:37 +02:00
parent d268ca2bde
commit 291bfa952b
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Containers/apache/Caddyfile
+5 -3
View File
@@ -11,13 +11,15 @@
# trusted_proxies placeholder
}
# The endpoint below is plain http on purpose, so limit it to h1 to avoid caddy warning that
# HTTP/2 and HTTP/3 were skipped. Excluding the `http` logger would also hide acme messages.
# Plain http on purpose, so limit it to h1 to avoid caddy warning that HTTP/2 and HTTP/3 were
# skipped. Excluding the `http` logger would also hide acme messages.
servers :23973 {
protocols h1
# A scoped block overrides the address-less one above, so repeat trusted_proxies here.
# trusted_proxies placeholder
}
# apache-port protocols placeholder
# apache-port servers placeholder
log {
level {$CADDY_LOG_LEVEL}
Containers/apache/start.sh
+8 -5
View File
@@ -56,23 +56,26 @@ else
fi
echo "$CADDYFILE" > /tmp/Caddyfile
# Change the trusted_proxies in case of reverse proxies
# Determine the trusted_proxies in case of reverse proxies
if [ "$APACHE_PORT" != '443' ]; then
# Here the 100.64.0.0/10 range gets added which is the CGNAT range used by Tailscale nodes
# See https://github.com/nextcloud/all-in-one/pull/6703 for reference
CADDYFILE="$(sed 's|# trusted_proxies placeholder|trusted_proxies static private_ranges 100.64.0.0/10|' /tmp/Caddyfile)"
TRUSTED_PROXIES="trusted_proxies static private_ranges 100.64.0.0/10"
else
CADDYFILE="$(sed "s|# trusted_proxies placeholder|trusted_proxies static $IPv4_ADDRESS|" /tmp/Caddyfile)"
TRUSTED_PROXIES="trusted_proxies static $IPv4_ADDRESS"
fi
echo "$CADDYFILE" > /tmp/Caddyfile
# In case of reverse proxies the APACHE_PORT listener is plain http, so limit it to h1 to avoid
# caddy warning that HTTP/2 and HTTP/3 were skipped. See the Caddyfile for further details.
if [ "$APACHE_PORT" != '443' ]; then
CADDYFILE="$(sed "s|# apache-port protocols placeholder|servers :$APACHE_PORT {\n\t\tprotocols h1\n\t}|" /tmp/Caddyfile)"
CADDYFILE="$(sed "s|# apache-port servers placeholder|servers :$APACHE_PORT {\n\t\tprotocols h1\n\t\t# trusted_proxies placeholder\n\t}|" /tmp/Caddyfile)"
echo "$CADDYFILE" > /tmp/Caddyfile
fi
# Change all trusted_proxies placeholders, also the ones inside the scoped `servers` blocks
CADDYFILE="$(sed "s|# trusted_proxies placeholder|$TRUSTED_PROXIES|g" /tmp/Caddyfile)"
echo "$CADDYFILE" > /tmp/Caddyfile
# Remove additional domain if not given
if [ -z "$ADDITIONAL_TRUSTED_DOMAIN" ]; then
CADDYFILE="$(sed '/ADDITIONAL_TRUSTED_DOMAIN/d' /tmp/Caddyfile)"