From 291bfa952ba6d237aa75d83178205c1230e050f9 Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Wed, 2 Sep 2026 10:37:37 +0200
Subject: [PATCH] fix trusted proxies

Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 Containers/apache/Caddyfile |  8 +++++---
 Containers/apache/start.sh  | 13 ++++++++-----
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/Containers/apache/Caddyfile b/Containers/apache/Caddyfile
index 00177969..1e96f281 100644
--- a/Containers/apache/Caddyfile
+++ b/Containers/apache/Caddyfile
@@ -11,13 +11,15 @@
         # trusted_proxies placeholder
     }
 
-    # The endpoint below is plain http on purpose, so limit it to h1 to avoid caddy warning that
-    # HTTP/2 and HTTP/3 were skipped. Excluding the `http` logger would also hide acme messages.
+    # Plain http on purpose, so limit it to h1 to avoid caddy warning that HTTP/2 and HTTP/3 were
+    # skipped. Excluding the `http` logger would also hide acme messages.
     servers :23973 {
         protocols h1
+        # A scoped block overrides the address-less one above, so repeat trusted_proxies here.
+        # trusted_proxies placeholder
     }
 
-    # apache-port protocols placeholder
+    # apache-port servers placeholder
 
     log {
         level {$CADDY_LOG_LEVEL}
diff --git a/Containers/apache/start.sh b/Containers/apache/start.sh
index 3d74418f..35bf5046 100644
--- a/Containers/apache/start.sh
+++ b/Containers/apache/start.sh
@@ -56,23 +56,26 @@ else
 fi
 echo "$CADDYFILE" > /tmp/Caddyfile
 
-# Change the trusted_proxies in case of reverse proxies
+# Determine the trusted_proxies in case of reverse proxies
 if [ "$APACHE_PORT" != '443' ]; then
     # Here the 100.64.0.0/10 range gets added which is the CGNAT range used by Tailscale nodes
     # See https://github.com/nextcloud/all-in-one/pull/6703 for reference
-    CADDYFILE="$(sed 's|# trusted_proxies placeholder|trusted_proxies static private_ranges 100.64.0.0/10|' /tmp/Caddyfile)"
+    TRUSTED_PROXIES="trusted_proxies static private_ranges 100.64.0.0/10"
 else
-    CADDYFILE="$(sed "s|# trusted_proxies placeholder|trusted_proxies static $IPv4_ADDRESS|" /tmp/Caddyfile)"
+    TRUSTED_PROXIES="trusted_proxies static $IPv4_ADDRESS"
 fi
-echo "$CADDYFILE" > /tmp/Caddyfile
 
 # In case of reverse proxies the APACHE_PORT listener is plain http, so limit it to h1 to avoid
 # caddy warning that HTTP/2 and HTTP/3 were skipped. See the Caddyfile for further details.
 if [ "$APACHE_PORT" != '443' ]; then
-    CADDYFILE="$(sed "s|# apache-port protocols placeholder|servers :$APACHE_PORT {\n\t\tprotocols h1\n\t}|" /tmp/Caddyfile)"
+    CADDYFILE="$(sed "s|# apache-port servers placeholder|servers :$APACHE_PORT {\n\t\tprotocols h1\n\t\t# trusted_proxies placeholder\n\t}|" /tmp/Caddyfile)"
     echo "$CADDYFILE" > /tmp/Caddyfile
 fi
 
+# Change all trusted_proxies placeholders, also the ones inside the scoped `servers` blocks
+CADDYFILE="$(sed "s|# trusted_proxies placeholder|$TRUSTED_PROXIES|g" /tmp/Caddyfile)"
+echo "$CADDYFILE" > /tmp/Caddyfile
+
 # Remove additional domain if not given
 if [ -z "$ADDITIONAL_TRUSTED_DOMAIN" ]; then
     CADDYFILE="$(sed '/ADDITIONAL_TRUSTED_DOMAIN/d' /tmp/Caddyfile)"