jack/PocketVeto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Nginx real IP extraction and access logging

Browse Source 
Trust NPM proxy subnets, extract real client IP from X-Forwarded-For,
log with referrer and user agent.

Authored by: Jack Levy
This commit is contained in:
Jack Levy
2026-03-15 17:42:13 -04:00
parent 8911351c99
commit 5952443cc6
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
nginx/nginx.conf
View File

@@ -8,6 +8,20 @@ http {
sendfile on; sendfile on;
keepalive_timeout 65; keepalive_timeout 65;
# Trust NPM as a proxy — replace $remote_addr with the real client IP
# from X-Forwarded-For when the request comes from NPM's subnet
real_ip_header X-Forwarded-For;
real_ip_recursive on;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
# Log format includes real IP, referrer, and user agent
log_format main '$remote_addr - [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent"';
access_log /var/log/nginx/access.log main;
# Use Docker's internal DNS; valid=10s forces re-resolution after container restarts. # Use Docker's internal DNS; valid=10s forces re-resolution after container restarts.
# Variables in proxy_pass activate this resolver (upstream blocks do not). # Variables in proxy_pass activate this resolver (upstream blocks do not).
resolver 127.0.0.11 valid=10s ipv6=off; resolver 127.0.0.11 valid=10s ipv6=off;