feat(forgejo): Configure trusted proxies via ansible vars #357

histalek · 2025-08-23T18:22:04+02:00

histalek commented

2025-08-23 18:22:04 +02:00

This allows forgejo to trust the X-Forwarded-For or the X-Real-IP
header from the configured proxies and therefore set the correct remote
ip in logs.

This allows forgejo to trust the `X-Forwarded-For` or the `X-Real-IP` header from the configured proxies and therefore set the correct remote ip in logs.

histalek self-assigned this

2025-08-23 18:22:04 +02:00

histalek added 1 commit

2025-08-23 18:22:05 +02:00

feat(forgejo): Configure trusted proxies via ansible vars

ci/woodpecker/pr/ansible-lint Pipeline was successful

Details

0642e755f2

This allows forgejo to trust the `X-Forwarded-For` or the `X-Real-IP`
header from the configured proxies and therefore set the correct remote
ip in logs.

requested review from Owners

2025-08-23 18:22:05 +02:00

histalek commented

2025-08-24 16:55:52 +02:00

Tbh i don't know how this would interact (or would even be needed) if we would proxy to forgejo via fcgi, http+unix or fcgi+unix.

Currently we only really need this as forgejo defaults to the localhost ip networks for this setting but in our setup forgejo sees the "podman" ip of the caddy container which is not in the localhost network.

For the 2 fcgi options i would assume this to not be necessary but i don't actually know. Maybe these would be alternatives to consider (fcgi would also get around the http/1.1 desync shenanigans)

Tbh i don't know how this would interact (or would even be needed) if we would proxy to forgejo via `fcgi`, `http+unix` or `fcgi+unix`. Currently we only really need this as forgejo defaults to the localhost ip networks for this setting but in our setup forgejo sees the "podman" ip of the caddy container which is not in the localhost network. For the 2 fcgi options i would assume this to not be necessary but i don't actually know. Maybe these would be alternatives to consider (fcgi would also get around the http/1.1 desync shenanigans)

saibotk requested changes

2025-08-31 16:06:51 +02:00

Dismissed

roles/forgejo/defaults/main.yml Outdated

					
				@ -28,6 +28,10 @@ forgejo_first_admin_email: "forgejo@example.com"

				# forgejo_lfs_jwt_secret: ""

				# forgejo_oauth2_jwt_secret: ""

				# A comma seperated list of ip networks for trusted reverse proxy servers

saibotk commented

2025-08-31 16:06:48 +02:00

This is good as is, but because it is not a working default value, we should add a note on what IPs to enter here (caddy network).

histalek commented

2025-09-03 16:20:36 +02:00

Fair point about the note.

However, just to be clear: this default value is the same as forgejo's default value for this setting. If this ansible var does not get changed by anyone running this role this change as a whole does not result in a meaningful config change (the file contents will of course be changed but the resulting config is the same as far as forgejo is concerned)

Fair point about the note. However, just to be clear: this default value is the same as forgejo's default value for this setting. If this ansible var does not get changed by anyone running this role this change as a whole does not result in a meaningful config change (the file contents will of course be changed but the resulting config is the same as far as forgejo is concerned)

👍 1

histalek commented

2025-09-20 10:43:07 +02:00

fixed in 10226bb603

fixed in 10226bb603bf703d62f1080fbb89d447225a1619

saibotk marked this conversation as resolved