Reverse Proxy not on the same machine and not in docker. Is it possible ?

[crocobc]

Hi there,

First, Thank you for this amazing program :)

I'm having issue to get real ip address in AIO log (nextcloud.log).

My running configuration is:

• Haproxy on a separate VM
• A second VM with classic Nextcloud installation (no Docker).

To get the real IP address from the clients in my nexctloud logs i use a program called mmproxy.
I use it with other VM and other services with no problem. (bitwarden, zabbix...)

(mmproxy is a lightweight TCP proxy that serves exactly one purpose: to smooth the transition of TCP servers to use proxy-protocol.)
https://github.com/cloudflare/mmproxy

I'm testing AIO. I can make it work from inside and outside using informations in https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md with a legit certificate working and with apache_port option command line.
GREAT !
But impossible to get real IP address of the clients.

I tried to change trusted_proxies in config.php with no success.

So in short:

VM1 (Haproxy - no docker) => IP 192.168.10.103
VM2 (nextcloud - no docker) => IP 192.168.10.104 => mmproxy so i can get the real IP of clients. => nextcloud apache
VM3 (nextcloud AIO) => IP 192.168.10.105 with apache_port => 11000

On my VM3 by default i get 192.168.10.103 (reverse-proxy IP) for everything in the logs.

• if i add 192.168.10.103 in the trusted_proxies (config.php) => no change
• if i put only 192.168.10.103 in trusted_proxies => i get 127.0.0.1 for everyone.
• if i try to use haproxy => mmproxy => Aio => i get 172.17.0.1 for everyone in the logs....
• if i put only 172.17.0.1 in trusted_proxies => no change.

I search for this problem for a week now i'm kind of deseperate ^^

Also, i read in the reverse documention:

"Please note: The above configuration will only work if your reverse proxy is running directly on the host that is running the docker daemon."

Maybe what i'm trying to achieve is impossible ? (my Haproxy IS NOT on the same machine)

My haproxy config.

Backend cloud option forwardfor server cloud-aio 192.168.10.105:11000

I'm kind of nubbie in docker configuration...
Sorry for my english

Any help would be appreciate.

Regards

[szaimen]

I'm testing AIO. I can make it work from inside and outside using informations in https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md with a legit certificate working and with apache_port option command line.
GREAT !

Cool! Then it works!

But impossible to get real IP address of the clients.

At which logs are you looking? The logs from the nextcloud container or the nextcloud logs (which you can see in the nextcloud admin settings?)

[crocobc]

Thank you for the reply.

Yes, it's working but not fully :)

I have same Ip Addresses in nextcloud admin log or nextcloud.log file (from volume container)

I have lots of problem with talk but it think it's related (i talk does'nt have right IP...maybe he is not happy)

So, with my configuration, is it possible to get real IP ?

I recheck:

• standard configuration (with apache_port 11000 command from your reverse documentation) and 127.0.0.1 in trusted_proxies => 192.168.10.103 (reverse proxy IP) for everything in my logs (admin web log and nextcloud.log)
• If i replace 127.0.0.1 for trusted_proxies by 192.168.10.103 => i get 127.0.0.1 for everything
• if i put 127.0.0.1 and 192.168.10.103 in trusted_proxies => i get 192.168.10.103 for everything...

Thanks

[szaimen]

Can you try to make it work without mmproxy in between?

[szaimen]

I suppose you need to configure haproxy in a way then that it fowards the ip-address...

[crocobc]

Hi there,

I tried to make it work with mmproxy and it's working. But i get docker0 ip for everything (172.17.0.1).

I install nginx on the server, and made some tests:

If i create a basic vhosts on port 8000 and redirect haproxy => mmproxy => nginx ==> i get the real IP (I made a basic phpinfo(); in index.php).

So mmproxy is forwarding the real IP with no problems. (like in my others VM)

If i tried to redirect mmproxy to localhost:11000 => 172.17.0.1

If i create a configuration like in your documentation => 172.17.0.1

`location / {
proxy_pass http://localhost:11000;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
client_max_body_size 0;

    # Websocket
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
}`

Don't know what to do next ^^

[szaimen]

You may be hit by this: #828

[crocobc]

Great it's working with this !!!

Thanks a lot