nginx_proxy: Adding support for TCP Proxy Protocol

[miguelrjim]

trafficstars

This allows Nginx to support the TCP proxy protocol, this is useful if you still want to TLS terminate on the home-assistant host but you have another entrypoint for all your TLS connections (i.e. traefik is your entrypoint and you redirect from it to home-assistant based on the HTTPS domain being requested, this makes sure that any kind of network request to home-assistant remains encrypted).

What this allows is that home-assistant will know the true ip of the user making requests (making this change because I saw in the logs that there was a failed log-in but the ip pointed to my traefik instance).

Tested this by installing these changes as a local add-on on home-assistant.

[bvli]

I'd really like to see this PR merged 👍

[miguelrjim]

Hi @agners, just wondering what would be the next step to get the PR merged?

[home-assistant[bot]]

Please take a look at the requested changes, and use the Ready for review button when you are done, thanks :+1:

Learn more about our pull request process.

[miguelrjim]

I am not very familiar with the various proxy options/configurations, but wouldn't the first option documented in https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/ to get the originating IP address more generic? (E.g. not using the RealIP module? 🤔 ).

Hmm it could be? Tbh i've been using $proxy_protocol_addr as that was being used in a couple of other examples with proxy protocol.

[agners]

Hmm it could be? Tbh i've been using $proxy_protocol_addr as that was being used in a couple of other examples with proxy protocol.

There is also this note:

The Real‑IP modules for HTTP and Stream TCP are not included in NGINX Open Source by default; see Installing NGINX Open Source for details. No extra steps are required for NGINX Plus.

:thinking:

I am really not an expert in NGINX/Proxy setups. But I think if things can work without the RealIP module, it seems the better approach to me.

[miguelrjim]

@agners just wondering if we're good to merge the pr after your comments had been taken care of

[miguelrjim]

@agners No worries, thanks for taking your time reviewing it!

I've included your suggested changes, I agree this makes it easier and makes sense! I've tested the latest changes locally as well and it's working as intended.

[coderabbitai[bot]]

Walkthrough

Walkthrough

The changes in the nginx_proxy project introduce version 3.10.0, significantly enhancing proxy server capabilities by adding support for the TCP Proxy Protocol. A key update is the new real_ip_from option for specifying trusted IP addresses, which improves the handling of real client IPs. Additional improvements also include modular configuration options and enhanced logging, collectively increasing the server's efficiency, security, and flexibility.

Changes

Files	Change Summary
nginx_proxy/CHANGELOG.md	Updated for version 3.10.0, adding TCP Proxy Protocol support while retaining previous version updates.
nginx_proxy/DOCS.md, nginx_proxy/translations/en.yaml	Documented the real_ip_from option for specifying trusted IP addresses in NGINX configurations and translations.
nginx_proxy/config.yaml	Upgraded version to 3.10.0; added real_ip_from field for trusted IP addresses.
nginx_proxy/rootfs/etc/nginx/nginx.conf.gtpl	Enhanced real IP handling with conditional logic based on real_ip_from, allowing for flexible server configurations.
nginx_proxy/rootfs/etc/s6-overlay/s6-rc.d/nginx/run	Updated script to manage Nginx configuration dynamically based on the presence of the real_ip_from parameter, improving maintainability and logging.

---

Recent review details

Configuration used: CodeRabbit UI Review profile: CHILL

Commits

Files that changed from the base of the PR and between ac978b542ae4e8f96a30cde19855c2edb6dd0e82 and 762aa039b095452cf1751f1caa537fa58b95a79a.

Files selected for processing (6)

• nginx_proxy/CHANGELOG.md (2 hunks)
• nginx_proxy/DOCS.md (2 hunks)
• nginx_proxy/config.yaml (2 hunks)
• nginx_proxy/rootfs/etc/nginx/nginx.conf.gtpl (3 hunks)
• nginx_proxy/rootfs/etc/s6-overlay/s6-rc.d/nginx/run (2 hunks)
• nginx_proxy/translations/en.yaml (1 hunks)

Files skipped from review due to trivial changes (1)

• nginx_proxy/translations/en.yaml

Files skipped from review as they are similar to previous changes (5)

• nginx_proxy/CHANGELOG.md
• nginx_proxy/DOCS.md
• nginx_proxy/config.yaml
• nginx_proxy/rootfs/etc/nginx/nginx.conf.gtpl
• nginx_proxy/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share

• X
• Mastodon
• Reddit
• LinkedIn

Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai generate interesting stats about this repository and render them as a table.
  • @coderabbitai show all the console.log statements in this repository.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (invoked as PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Additionally, you can add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[miguelrjim]

@agners Made more substantial changes to move replacement logic by taking advantage of templating; tested the changes locally by specifying different values in the ui options (changing the boolean values & text inputs) and the generated nginx.conf was as expected; nginx started successfully and was processing requests as intended, currently using this latest version directly in my home assistant instance.

[kelvan]

hi, just installed the update and now my nginx is unable to start, it seems this option is not optional?

Missing option 'real_ip_from' in root in NGINX Home Assistant SSL proxy (core_nginx_proxy).

Edit: after adding a random IP, saving and removing it again, it starts up again

[mpreitz]

This feature breaks the funcionality of the plugin. Setting a "real_ip_from" is mandantory, otherwise the plugin won't start. If setting the local network as allowed the plugin starts, but no connection is possible.

Would be nice to read a word in the changelog if breaking changes are part of the release.

[agners]

Making real_ip_from mandatory was not really intended :cry:

This should address the issue: https://github.com/home-assistant/addons/pull/3725.

[mad-tunes]

Might this be related to some having trouble getting to HA after updating to 3.10.0? https://discord.com/channels/330944238910963714/672220642099200000/1273278057511387169 Thanks

[mad-tunes]

It seems that adding real_ip_from: [] to settings yaml, or setting anything in the GUI and then removing it, is letting people at HA thorugh nginx with 3.10.0

[miguelrjim]

Sorry! This was definitely not intended to be a breaking change, thanks for the quick fix @agners