| -@gerrit:opendev.org- Zuul merged on behalf of Takashi Kajinami: [openstack/project-config] 996035: Retire puppet-vitrage - Step 5: Remove Project https://review.opendev.org/c/openstack/project-config/+/996035 | 05:39 | |
| @fungicide:matrix.org | Clark: Anil Belur: is that working through anubis? i thought it didn't have working support for proxy protocol yet, but maybe that simply means it passes it through unchanged instead | 13:26 |
|---|---|---|
| @fungicide:matrix.org | popping out to lunch and some errands, should be back by 17:00 utc though | 14:59 |
| @abelur:matrix.org | fungi: you're right that Anubis has no PROXY-protocol support - but it never needs it. PROXY protocol terminates at Apache: mod_remoteip + RemoteIPProxyProtocol On consumes the haproxy PROXY header and recovers the client IP there. Everything downstream of Apache is plain HTTP. Apache hands the client to Anubis as X-Real-Ip (RequestHeader set X-Real-Ip expr=%{REMOTE_ADDR} - which Anubis's own Apache docs require anyway) plus X-Forwarded-For. So it's not that Anubis passes PROXY through unchanged - it never sees PROXY at all; it reads the client from an HTTP header like any reverse proxy. | 22:47 |
| @abelur:matrix.org | I've run the full chain in the POC (real techarohq/anubis:v1.25.0, haproxy send-proxy → apache → anubis → gitea), and the real client IP lands in Gitea's log. One subtlety worth knowing: Anubis overwrites X-Forwarded-For with its own upstream (Apache) but preserves X-Real-Ip - so X-Real-Ip is the actual carrier through Anubis, and Gitea resolves the client from it (Gitea trusts ::1 /Anubis by default, no app.ini change needed) | 22:49 |
| @abelur:matrix.org | And the ::1 gate failure is orthogonal to Anubis - it's the direct git clone https://localhost:3081 functional-test connection hitting Apache over IPv6 loopback with no PROXY header. RemoteIPProxyProtocol On drops header-less connections unless excepted, and PS6 only excepted 127. | 22:53 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!