X-Forwarded headers not handled with Nginx + FPM
@wrenix ci sta già lavorando.
Dal 24/1/2025.
Valutazione
Questa issue non è ancora stata valutata.
Descrizione
Describe your Issue
I run Nextcloud behind a Openstack Octavia Loadbalancer (with HTTPS termination), that send X-Forwarded-For, X-Forwarded-Port and X-Forwarded-Proto headers to the Nginx ingress controller.
The LB pool is configured to use the Proxy Protocol in order to preserve client source IP.
Natively, the chart does not allow me to pass these headers from Nginx to PHP-FPM, so I had to create a custom configuration.
Also, the documentation is wrong about trusted_proxies Nextcloud parameter. In our case, it should be equal to ['127.0.0.1'], since the Nextcloud instance and the Nginx webserver are running under the same pod, and since the trafic is forwarded to the PHP upstream on 127.0.0.1 too.
Logs and Errors
Under Nextcloud Administration Area > Admin Settings > Security, the recognized IP is something like ::ffff:10.42.X.X this is the address of the rke2-nginx-ingress-controller, with a helm configuration that is supposed to be correct (I think)
On the Nginx container logs, $http_x_forwarded_for log value is correct, but not transmitted to PHP.
Describe your Environment
-
Kubernetes distribution: RKE2 v1.31
-
Argo-CD Version : v2.13.1+af54ef8
-
Helm Version : v3.15.4+gfa9efb0
-
Helm Chart Version: 6.5.1
-
values.yaml: (issue non relative content is removed)
ingress:
annotations:
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/enable-cors: "true"
nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
nextcloud:
configs:
proxy.config.php: |-
<?php
$CONFIG = array (
'trusted_proxies' => array('127.0.0.1'),
'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR')
);
nginx:
ipFamilies:
- IPv4
- IPv6
config:
default: false
custom: |-
map $http_x_forwarded_proto $fastcgi_https {
default "";
https "on";
}
...
server {
set_real_ip_from 10.42.0.0/16; # My pod IPv4 subnet
set_real_ip_from fd00:42::/56; # My pod IPv6 subnet
real_ip_header X-Forwarded-For;
real_ip_recursive on;
location ~ \.php(?:$|/) {
fastcgi_param HTTPS $fastcgi_https;
fastcgi_param SERVER_PORT $http_x_forwarded_port;
...
}
...
}
Additional context, if any
With this solution, you can pass all the headers that I mentionned. Working fine :)
Creating conditions on the Helm chart, it would be great to implement these fixes.
- Lingua principale
- Go Template
- Stelle
- 536
- Fork
- 316
- Merge medio
- 4g 16h
- PR unite (30g)
- 2
Preparare l'ambiente
- Nessun Dockerfile né file Docker Compose
- Ha un modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di nextcloud/helm
-
No native support for REDIS_USER enviroment varForse già presa @jholmes802 l’ha presa 2 giorni fa. Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 70/100
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
-
Failed to inspect imageAperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 68/100
-
nextcloud.openmetrics.allowedClients is silently ignored unless nextcloud.configs is setForse già presa @JanWelker l’ha presa 18 giorni fa. Aperta
Difficoltà 3/5 1-2 giorni Idoneità per principianti 78/100
-
External Redis not working: redis-session.ini: Permission deniedForse già presa @antoinetran l’ha presa 23 giorni fa. Aperta
Difficoltà 3/5 1-2 giorni Idoneità per principianti 55/100