nginx-paivana (2351B)
1 # RFC 7239 node identifier for the peer we accepted from. nginx has 2 # no built-in variable for this: an IPv6 address has to be bracketed 3 # and therefore quoted (RFC 7239 §6), and a peer with no address is 4 # "unknown" (§6.3). 5 map $remote_addr $paivana_forwarded_elem { 6 ~^[0-9.]+$ "for=$remote_addr"; 7 ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\""; 8 default "for=unknown"; 9 } 10 11 server { 12 listen 80; 13 listen [::]:80; 14 15 # server_name example.com 16 17 location / { 18 proxy_pass http://unix:/run/paivana/httpd/paivana-http.sock; 19 proxy_redirect off; 20 proxy_set_header Host $host; 21 22 # paivana-httpd is started with -f (see paivana-httpd.service), so 23 # it takes the client address for the access cookie from the 24 # headers set here. It believes the RIGHTMOST element of the 25 # chain, which is whatever the hop it accepted from wrote -- so 26 # what matters is that this server writes these headers at all. 27 # $remote_addr is the peer we actually accepted; the danger is not 28 # $proxy_add_x_forwarded_for (appending is safe, since our own 29 # element still ends up rightmost) but leaving a header unset and 30 # letting nginx forward the client's copy of it verbatim. 31 # 32 # If this nginx is itself behind another proxy, switch to 33 # $proxy_add_x_forwarded_for, set real_ip_header / 34 # set_real_ip_from for that hop, and list it in paivana's 35 # TRUSTED_PROXIES so the walk may step past it. 36 proxy_set_header X-Forwarded-For $remote_addr; 37 proxy_set_header X-Forwarded-Proto $scheme; 38 proxy_set_header X-Forwarded-Host $host; 39 proxy_set_header X-Forwarded-Port $server_port; 40 41 # RFC 7239. paivana-httpd prefers this over the X-Forwarded-* 42 # headers above, which are kept for origins that only speak those. 43 # Setting it is not optional: nginx forwards a client-supplied 44 # Forwarded header verbatim, and since paivana prefers this header 45 # over X-Forwarded-For, omitting this line would hand the client 46 # the element paivana believes -- however carefully the 47 # X-Forwarded-For above is set. Behind another proxy, replace this 48 # with the appending form from nginx.org's "Using the Forwarded 49 # header", which validates $http_forwarded before extending it. 50 proxy_set_header Forwarded "$paivana_forwarded_elem;proto=$scheme;host=$host"; 51 } 52 }