Thanks to visit codestin.com
Credit goes to github.com

Skip to content

apache: set the remote ip from X-Real-IP by default #297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from Apr 1, 2018
Merged

apache: set the remote ip from X-Real-IP by default #297

merged 1 commit into from Apr 1, 2018

Conversation

@ghost
Copy link

@ghost ghost commented Mar 28, 2018 •
edited by ghost
Loading

Relates to: #294

@ghost
Copy link
Author

ghost commented Mar 28, 2018

Could someone please confirm the travis error:

The command "bash -c "[[ $hash_before = $(git add -A && git write-tree) ]]"" exited with 1.
Skipping the after_script stage due to the configuration.

is related to my change? I'm happy to dig further to figure it out. Just checking that I'm not chasing a gost ;-)

@ghost
Copy link
Author

ghost commented Mar 28, 2018

For the record, I have manually tested the changes with

  • cd docker/13.0/apache
  • sudo docker build -t nextcloud:apache .
  • cd docker/.examples/docker-compose/with-nginx-proxy/postgres/apache
  • sudo docker-compose up app
  • login with a wrong password
  • login with the right password
  • go to /settings/admin/logging and verify the failed login attempt is recorded with the remote-ip instead of the local ip

@pierreozoux
Copy link
Member

This file is generated by script.
Could you add your change to https://github.com/nextcloud/docker/blob/master/update.sh#L20
(then in another commit, run the script itself to update the images)

Nice to see you contribute here, I've been following your work on ceph.

@ghost
Copy link
Author

ghost commented Mar 31, 2018

This file is generated by script.

Oh, thanks for the hint, will do!

Nice to see you contribute here, I've been following your work on ceph.

Thank you for the kind words, makes me feel very welcome :-)

@pierreozoux
Copy link
Member

the 2 commits, can be in the same PR, it just ease the reviewing to separate them.

@ghost
Copy link
Author

ghost commented Mar 31, 2018

@pierreozoux Ok, will do, thanks for the advice :-D

pierreozoux
pierreozoux approved these changes Mar 31, 2018
View reviewed changes
Copy link
Member

@pierreozoux pierreozoux left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me!

@pierreozoux pierreozoux requested a review from tilosp March 31, 2018 10:25
@ghost
Copy link
Author

ghost commented Mar 31, 2018

All pass except https://travis-ci.org/nextcloud/docker/jobs/360574391 because travis has trouble reaching the keyserver. Should I force-repush to trigger another build? It looks like that kind of transient error is fairly common so maybe you prefer to force-merge instead of wasting additional CI runs? I'm happy either way, just let me know ;-)

 gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A
gpg: keybox '/tmp/tmp.AEdOLd/pubring.kbx' created
gpg: keyserver receive failed: Address not available

@pierreozoux
Copy link
Member

One last question, in nginx, you have to tell from whom to trust who can set this header, here in apache, there is no such mechanism? It will just trust everybody including me?

@ghost
Copy link
Author

ghost commented Mar 31, 2018

in apache, there is no such mechanism?

There is but I misread the documentation and incorrectly concluded it would only allow internal IPs by default. Fixing that, thanks for catching this mistake!

@ghost
Copy link
Author

ghost commented Mar 31, 2018 •
edited by ghost
Loading

Added the suggested internal IP ranges and manually tested they work as expected on a live instance.

RemoteIPHeader X-Real-IP
RemoteIPTrustedProxy 10.0.0.0/8
RemoteIPTrustedProxy 172.16.0.0/12
RemoteIPTrustedProxy 192.168.0.0/16

@ghost
Copy link
Author

ghost commented Mar 31, 2018 

W: Failed to fetch http://deb.debian.org/debian/dists/jessie-updates/main/binary-amd64/Packages  Hash Sum mismatch

transient error apparently. I won't repush since it seems more effective for someone with access to re-start the failed jobs instead.

tilosp
tilosp reviewed Apr 1, 2018
View reviewed changes
13.0/apache/Dockerfile Outdated

RUN a2enmod rewrite
RUN a2enmod remoteip
RUN { echo RemoteIPHeader X-Real-IP ; echo RemoteIPTrustedProxy 10.0.0.0/8 ; echo RemoteIPTrustedProxy 172.16.0.0/12 ; echo RemoteIPTrustedProxy 192.168.0.0/16 ; } > /etc/apache2/conf-enabled/remoteip.conf; chown www-data:root /etc/apache2/conf-enabled/remoteip.conf
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please reduce the number of layer by merging these three run statements into one

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good idea, will do!

@tilosp
Copy link
Member

tilosp commented Apr 1, 2018

@dachary i removed the Fixes: #294 because this only fixes it for apache and not fpm

@ghost
Copy link
Author

ghost commented Apr 1, 2018

@tilosp modified and repushed, thanks for your review :-)

tilosp
tilosp reviewed Apr 1, 2018
View reviewed changes
11.0/apache/Dockerfile Outdated
VOLUME /var/www/html

RUN a2enmod rewrite
RUN a2enmod rewrite remoteip ; { echo RemoteIPHeader X-Real-IP ; echo RemoteIPTrustedProxy 10.0.0.0/8 ; echo RemoteIPTrustedProxy 172.16.0.0/12 ; echo RemoteIPTrustedProxy 192.168.0.0/16 ; } > /etc/apache2/conf-enabled/remoteip.conf; chown www-data:root /etc/apache2/conf-enabled/remoteip.conf
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

having the entire run statement in one line makes it difficult to read.
It would look a lot nicer if you formated it similar to the run statement above that sets the recommended PHP.ini settings

tilosp
tilosp requested changes Apr 1, 2018
View reviewed changes
Copy link
Member

@tilosp tilosp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

take a look at https://github.com/docker-library/php/blob/c4f059d09d7eefcb73304d198faa7674610ed810/apache-Dockerfile-block-1#L43

the config file is placed under conf-available and than a2enconf is run to enable it. This makes sense because than you can simply run a2disconf to disable it if you don't want to use it.
And by the way the chmod is unessesary all the other config file are simply owned by root

@ghost
Copy link
Author

ghost commented Apr 1, 2018

@tilosp thanks for the detailed instructions, it makes it super easy for me :-) Amended and repushed !

@pierreozoux pierreozoux merged commit e01caa9 into nextcloud:master Apr 1, 2018
@pierreozoux
Copy link
Member

Thanks both of you for the nice work!

@ghost
Copy link
Author

ghost commented Apr 1, 2018

@pierreozoux silly question: when and how is this going to show in the docker hub?

@pierreozoux
Copy link
Member

I think the docker bot runs once a day.

This was referenced Apr 1, 2018
Merged
Merged
@ErAzOr2k ErAzOr2k mentioned this pull request Jan 29, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

enhancement image

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@pierreozoux @tilosp