Skip to content

Commit f618470

Browse files
luislhlluislhl
authored
fix[nginx]: Make sure we trust the GCP IPs to get the real client IP (#1595)
1 parent 8ea0e10 commit f618470

File tree

3 files changed

+76
-108
lines changed

3 files changed

+76
-108
lines changed

‎extras/nginx_docker/Makefile‎

Lines changed: 42 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ DEFAULT_NO_RATE_LIMIT_TAG = no-rate-limit-latest
99

1010
# GCP / Hathor Testnet
1111
HATHOR_TESTNET_REGISTRY = us-central1-docker.pkg.dev/hathor-testnet/fullnodes/webtank
12+
HATHOR_TESTNET_TRUSTED_PROXIES = --trusted-proxy-ip 34.117.203.223 --trusted-proxy-ip 2600:1901:0:982d::
1213

1314
HATHOR_TESTNET_INDIA_TAG_LATEST = india-latest
1415
HATHOR_TESTNET_INDIA_TAG_NO_RATE_LIMIT = india-no-rate-limit-latest
@@ -18,114 +19,87 @@ hathor-testnet: hathor-testnet-default hathor-testnet-no-rate-limit hathor-testn
1819
@echo "All Hathor Testnet images built and pushed successfully!"
1920

2021
.PHONY: hathor-testnet-default
21-
hathor-testnet-default: clean nginx.conf set_real_ip_from_cloudfront
22+
hathor-testnet-default: clean set_real_ip_from_cloudfront
2223
@echo "Building and pushing latest image for Hathor Testnet..."
24+
$(call generate_nginx_conf,$(HATHOR_TESTNET_TRUSTED_PROXIES))
2325
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(HATHOR_TESTNET_REGISTRY):$(DEFAULT_LATEST_TAG) .
2426

2527
.PHONY: hathor-testnet-no-rate-limit
26-
hathor-testnet-no-rate-limit: clean nginx_no_rate_limit.conf set_real_ip_from_cloudfront
28+
hathor-testnet-no-rate-limit: clean set_real_ip_from_cloudfront
2729
@echo "Building and pushing no-rate-limit image for Hathor Testnet..."
28-
mv nginx_no_rate_limit.conf nginx.conf
30+
$(call generate_nginx_conf,--disable-rate-limits $(HATHOR_TESTNET_TRUSTED_PROXIES))
2931
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(HATHOR_TESTNET_REGISTRY):$(DEFAULT_NO_RATE_LIMIT_TAG) .
3032

3133
.PHONY: hathor-testnet-india-default
32-
hathor-testnet-india-default: clean nginx_india.conf set_real_ip_from_cloudfront
34+
hathor-testnet-india-default: clean set_real_ip_from_cloudfront
3335
@echo "Building and pushing india image for Hathor Testnet..."
34-
mv nginx_india.conf nginx.conf
36+
$(call generate_nginx_conf,--override hathor-testnet-india $(HATHOR_TESTNET_TRUSTED_PROXIES))
3537
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(HATHOR_TESTNET_REGISTRY):$(HATHOR_TESTNET_INDIA_TAG_LATEST) .
3638

3739
.PHONY: hathor-testnet-india-no-rate-limit
38-
hathor-testnet-india-no-rate-limit: clean nginx_india_no_rate_limit.conf set_real_ip_from_cloudfront
40+
hathor-testnet-india-no-rate-limit: clean set_real_ip_from_cloudfront
3941
@echo "Building and pushing no-rate-limit india image for Hathor Testnet..."
40-
mv nginx_india_no_rate_limit.conf nginx.conf
42+
$(call generate_nginx_conf,--override hathor-testnet-india --disable-rate-limits $(HATHOR_TESTNET_TRUSTED_PROXIES))
4143
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(HATHOR_TESTNET_REGISTRY):$(HATHOR_TESTNET_INDIA_TAG_NO_RATE_LIMIT) .
4244

43-
# GCP / Nano Testnet
44-
NANO_TESTNET_REGISTRY = us-central1-docker.pkg.dev/nano-testnet/fullnodes/webtank
45-
46-
NANO_TESTNET_BRAVO_TAG_LATEST = bravo-latest
47-
NANO_TESTNET_BRAVO_TAG_NO_RATE_LIMIT = bravo-no-rate-limit-latest
48-
49-
.PHONY: nano-testnet
50-
nano-testnet: nano-testnet-default nano-testnet-no-rate-limit nano-testnet-bravo-default nano-testnet-bravo-no-rate-limit
51-
@echo "All Nano Testnet images built and pushed successfully!"
52-
53-
.PHONY: nano-testnet-default
54-
nano-testnet-default: clean nginx.conf set_real_ip_from_cloudfront
55-
@echo "Building and pushing latest image for Nano Testnet..."
56-
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(NANO_TESTNET_REGISTRY):$(DEFAULT_LATEST_TAG) .
57-
58-
.PHONY: nano-testnet-no-rate-limit
59-
nano-testnet-no-rate-limit: clean nginx_no_rate_limit.conf set_real_ip_from_cloudfront
60-
@echo "Building and pushing no-rate-limit image for Nano Testnet..."
61-
mv nginx_no_rate_limit.conf nginx.conf
62-
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(NANO_TESTNET_REGISTRY):$(DEFAULT_NO_RATE_LIMIT_TAG) .
63-
64-
.PHONY: nano-testnet-bravo-default
65-
nano-testnet-bravo-default: clean nginx_bravo.conf set_real_ip_from_cloudfront
66-
@echo "Building and pushing bravo image for Nano Testnet..."
67-
mv nginx_bravo.conf nginx.conf
68-
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(NANO_TESTNET_REGISTRY):$(NANO_TESTNET_BRAVO_TAG_LATEST) .
69-
70-
.PHONY: nano-testnet-bravo-no-rate-limit
71-
nano-testnet-bravo-no-rate-limit: clean nginx_bravo_no_rate_limit.conf set_real_ip_from_cloudfront
72-
@echo "Building and pushing no-rate-limit bravo image for Nano Testnet..."
73-
mv nginx_bravo_no_rate_limit.conf nginx.conf
74-
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(NANO_TESTNET_REGISTRY):$(NANO_TESTNET_BRAVO_TAG_NO_RATE_LIMIT) .
75-
7645
# GCP / Standalone Fullnodes
7746
STANDALONE_FULLNODES_REGISTRY = us-central1-docker.pkg.dev/standalone-fullnodes/fullnodes/webtank
47+
STANDALONE_FULLNODES_TRUSTED_PROXIES = --trusted-proxy-ip 34.54.38.76 --trusted-proxy-ip 2600:1901:0:75ca::
7848

7949
.PHONY: standalone-fullnodes
8050
standalone-fullnodes: standalone-fullnodes-default standalone-fullnodes-no-rate-limit
8151
@echo "All Standalone Fullnodes images built and pushed successfully!"
8252

8353
.PHONY: standalone-fullnodes-default
84-
standalone-fullnodes-default: clean nginx.conf set_real_ip_from_cloudfront
54+
standalone-fullnodes-default: clean set_real_ip_from_cloudfront
8555
@echo "Building and pushing latest image for Standalone Fullnodes..."
56+
$(call generate_nginx_conf,$(STANDALONE_FULLNODES_TRUSTED_PROXIES))
8657
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(STANDALONE_FULLNODES_REGISTRY):$(DEFAULT_LATEST_TAG) .
8758

8859
.PHONY: standalone-fullnodes-no-rate-limit
89-
standalone-fullnodes-no-rate-limit: clean nginx_no_rate_limit.conf set_real_ip_from_cloudfront
60+
standalone-fullnodes-no-rate-limit: clean set_real_ip_from_cloudfront
9061
@echo "Building and pushing no-rate-limit image for Standalone Fullnodes..."
91-
mv nginx_no_rate_limit.conf nginx.conf
62+
$(call generate_nginx_conf,--disable-rate-limits $(STANDALONE_FULLNODES_TRUSTED_PROXIES))
9263
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(STANDALONE_FULLNODES_REGISTRY):$(DEFAULT_NO_RATE_LIMIT_TAG) .
9364

9465
# GCP / Ekvilibro
9566
EKVILIBRO_REGISTRY = us-central1-docker.pkg.dev/ekvilibro/fullnodes/webtank
67+
EKVILIBRO_TRUSTED_PROXIES = --trusted-proxy-ip 34.54.235.41 --trusted-proxy-ip 2600:1901:0:ef2::
9668

9769
.PHONY: ekvilibro
9870
ekvilibro: ekvilibro-default ekvilibro-no-rate-limit
9971
@echo "All Ekvilibro images built and pushed successfully!"
10072

10173
.PHONY: ekvilibro-default
102-
ekvilibro-default: clean nginx.conf set_real_ip_from_cloudfront
74+
ekvilibro-default: clean set_real_ip_from_cloudfront
10375
@echo "Building and pushing latest image for Ekvilibro..."
76+
$(call generate_nginx_conf,$(EKVILIBRO_TRUSTED_PROXIES))
10477
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(EKVILIBRO_REGISTRY):$(DEFAULT_LATEST_TAG) .
10578

10679
.PHONY: ekvilibro-no-rate-limit
107-
ekvilibro-no-rate-limit: clean nginx_no_rate_limit.conf set_real_ip_from_cloudfront
80+
ekvilibro-no-rate-limit: clean set_real_ip_from_cloudfront
10881
@echo "Building and pushing no-rate-limit image for Ekvilibro..."
109-
mv nginx_no_rate_limit.conf nginx.conf
82+
$(call generate_nginx_conf,--disable-rate-limits $(EKVILIBRO_TRUSTED_PROXIES))
11083
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(EKVILIBRO_REGISTRY):$(DEFAULT_NO_RATE_LIMIT_TAG) .
11184

11285
# GCP / Hathor Testnet Playground
11386
HATHOR_TESTNET_PLAYGROUND_REGISTRY = us-central1-docker.pkg.dev/hathor-testnet-playground/fullnodes/webtank
87+
HATHOR_TESTNET_PLAYGROUND_TRUSTED_PROXIES = --trusted-proxy-ip 136.110.240.80 --trusted-proxy-ip 2600:1901:0:c75a::
11488

11589
.PHONY: hathor-testnet-playground
11690
hathor-testnet-playground: hathor-testnet-playground-default hathor-testnet-playground-no-rate-limit
11791
@echo "All Hathor Testnet Playground images built and pushed successfully!"
11892

11993
.PHONY: hathor-testnet-playground-default
120-
hathor-testnet-playground-default: clean nginx_playground.conf set_real_ip_from_cloudfront
94+
hathor-testnet-playground-default: clean set_real_ip_from_cloudfront
12195
@echo "Building and pushing latest image for Hathor Testnet Playground..."
122-
mv nginx_playground.conf nginx.conf
96+
$(call generate_nginx_conf,--override hathor-testnet-playground $(HATHOR_TESTNET_PLAYGROUND_TRUSTED_PROXIES))
12397
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(HATHOR_TESTNET_PLAYGROUND_REGISTRY):$(DEFAULT_LATEST_TAG) .
12498

12599
.PHONY: hathor-testnet-playground-no-rate-limit
126-
hathor-testnet-playground-no-rate-limit: clean nginx_playground_no_rate_limit.conf set_real_ip_from_cloudfront
100+
hathor-testnet-playground-no-rate-limit: clean set_real_ip_from_cloudfront
127101
@echo "Building and pushing no-rate-limit image for Hathor Testnet Playground..."
128-
mv nginx_playground_no_rate_limit.conf nginx.conf
102+
$(call generate_nginx_conf,--override hathor-testnet-playground --disable-rate-limits $(HATHOR_TESTNET_PLAYGROUND_TRUSTED_PROXIES))
129103
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(HATHOR_TESTNET_PLAYGROUND_REGISTRY):$(DEFAULT_NO_RATE_LIMIT_TAG) .
130104

131105
# AWS / Main Account
@@ -136,19 +110,20 @@ aws-main: aws-main-default aws-main-no-rate-limit
136110
@echo "All AWS Main images built and pushed successfully!"
137111

138112
.PHONY: aws-main-default
139-
aws-main-default: clean nginx.conf set_real_ip_from_cloudfront
113+
aws-main-default: clean set_real_ip_from_cloudfront
140114
@echo "Building and pushing latest image for AWS Main..."
115+
$(call generate_nginx_conf,)
141116
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(AWS_MAIN_REGISTRY):$(DEFAULT_LATEST_TAG) .
142117

143118
.PHONY: aws-main-no-rate-limit
144-
aws-main-no-rate-limit: clean nginx_no_rate_limit.conf set_real_ip_from_cloudfront
119+
aws-main-no-rate-limit: clean set_real_ip_from_cloudfront
145120
@echo "Building and pushing no-rate-limit image for AWS Main..."
146-
mv nginx_no_rate_limit.conf nginx.conf
121+
$(call generate_nginx_conf,--disable-rate-limits)
147122
docker buildx build --pull --push --platform linux/arm64/v8,linux/amd64 --tag $(AWS_MAIN_REGISTRY):$(DEFAULT_NO_RATE_LIMIT_TAG) .
148123

149124
# Build All (convenience command)
150125
.PHONY: build-all
151-
build-all: hathor-testnet nano-testnet standalone-fullnodes ekvilibro hathor-testnet-playground aws-main
126+
build-all: hathor-testnet standalone-fullnodes ekvilibro hathor-testnet-playground aws-main
152127
@echo "All images built and pushed successfully!"
153128

154129
# Legacy commands for backward compatibility
@@ -164,45 +139,19 @@ docker-no-rate-limit: aws-main-no-rate-limit
164139
# Configuration Generation
165140
# ========================
166141

167-
nginx.conf: export PYTHONPATH := ../..
168-
nginx.conf:
169-
@python -c "import os; import hathor; print('Using hathor-core from:', os.path.dirname(hathor.__file__))"
170-
python -m hathor generate_nginx_config - > $@
171-
172-
nginx_no_rate_limit.conf: export PYTHONPATH := ../..
173-
nginx_no_rate_limit.conf:
174-
@python -c "import os; import hathor; print('Using hathor-core from:', os.path.dirname(hathor.__file__))"
175-
python -m hathor generate_nginx_config --disable-rate-limits - > $@
176-
177-
nginx_bravo.conf: export PYTHONPATH := ../..
178-
nginx_bravo.conf:
179-
@python -c "import os; import hathor; print('Using hathor-core from:', os.path.dirname(hathor.__file__))"
180-
python -m hathor generate_nginx_config --override nano-testnet-bravo - > $@
181-
182-
nginx_bravo_no_rate_limit.conf: export PYTHONPATH := ../..
183-
nginx_bravo_no_rate_limit.conf:
184-
@python -c "import os; import hathor; print('Using hathor-core from:', os.path.dirname(hathor.__file__))"
185-
python -m hathor generate_nginx_config --override nano-testnet-bravo --disable-rate-limits - > $@
186-
187-
nginx_india.conf: export PYTHONPATH := ../..
188-
nginx_india.conf:
142+
export PYTHONPATH := ../..
143+
define generate_nginx_conf
189144
@python -c "import os; import hathor; print('Using hathor-core from:', os.path.dirname(hathor.__file__))"
190-
python -m hathor generate_nginx_config --override hathor-testnet-india - > $@
145+
python -m hathor generate_nginx_config $(1) - > nginx.conf
146+
endef
191147

192-
nginx_india_no_rate_limit.conf: export PYTHONPATH := ../..
193-
nginx_india_no_rate_limit.conf:
194-
@python -c "import os; import hathor; print('Using hathor-core from:', os.path.dirname(hathor.__file__))"
195-
python -m hathor generate_nginx_config --override hathor-testnet-india --disable-rate-limits - > $@
196-
197-
nginx_playground.conf: export PYTHONPATH := ../..
198-
nginx_playground.conf:
199-
@python -c "import os; import hathor; print('Using hathor-core from:', os.path.dirname(hathor.__file__))"
200-
python -m hathor generate_nginx_config --override hathor-testnet-playground - > $@
201-
202-
nginx_playground_no_rate_limit.conf: export PYTHONPATH := ../..
203-
nginx_playground_no_rate_limit.conf:
204-
@python -c "import os; import hathor; print('Using hathor-core from:', os.path.dirname(hathor.__file__))"
205-
python -m hathor generate_nginx_config --override hathor-testnet-playground --disable-rate-limits - > $@
148+
# Generate nginx.conf only (for testing or manual use).
149+
# Usage:
150+
# make nginx.conf
151+
# make nginx.conf NGINX_ARGS="--trusted-proxy-ip 34.54.38.76 --trusted-proxy-ip 2600:1901:0:75ca::"
152+
.PHONY: nginx.conf
153+
nginx.conf: set_real_ip_from_cloudfront
154+
$(call generate_nginx_conf,$(NGINX_ARGS))
206155

207156
set_real_ip_from_cloudfront:
208157
curl https://ip-ranges.amazonaws.com/ip-ranges.json -s \
@@ -216,7 +165,7 @@ set_real_ip_from_cloudfront:
216165

217166
.PHONY: clean
218167
clean:
219-
rm -f nginx.conf nginx_no_rate_limit.conf nginx_bravo.conf nginx_bravo_no_rate_limit.conf nginx_india.conf nginx_india_no_rate_limit.conf set_real_ip_from_cloudfront
168+
rm -f nginx.conf set_real_ip_from_cloudfront
220169

221170
.PHONY: help
222171
help:
@@ -228,11 +177,6 @@ help:
228177
@echo " hathor-testnet-no-rate-limit - Build and push no-rate-limit image for GCP Project Hathor Testnet"
229178
@echo " hathor-testnet-india-default - Build and push india image for GCP Project Hathor Testnet"
230179
@echo " hathor-testnet-india-no-rate-limit - Build and push no-rate-limit india image for GCP Project Hathor Testnet"
231-
@echo " nano-testnet - Build and push all images for GCP Project Nano Testnet"
232-
@echo " nano-testnet-default - Build and push default image for GCP Project Nano Testnet"
233-
@echo " nano-testnet-no-rate-limit - Build and push no-rate-limit image for GCP Project Nano Testnet"
234-
@echo " nano-testnet-bravo-default - Build and push bravo image for GCP Project Nano Testnet"
235-
@echo " nano-testnet-bravo-no-rate-limit - Build and push no-rate-limit bravo image for GCP Project Nano Testnet"
236180
@echo " standalone-fullnodes - Build and push all images for GCP Project Standalone Fullnodes"
237181
@echo " standalone-fullnodes-default - Build and push default image for GCP Project Standalone Fullnodes"
238182
@echo " standalone-fullnodes-no-rate-limit - Build and push no-rate-limit image for GCP Project Standalone Fullnodes"
@@ -247,6 +191,7 @@ help:
247191
@echo " aws-main-no-rate-limit - Build and push no-rate-limit image for AWS Main Account"
248192
@echo ""
249193
@echo "Utility Commands:"
194+
@echo " nginx.conf - Generate nginx.conf only (use NGINX_ARGS for extra options)"
250195
@echo " build-all - Build and push all active project images"
251196
@echo " clean - Remove generated files"
252197
@echo " help - Show this help message"
@@ -258,7 +203,6 @@ help:
258203
@echo ""
259204
@echo "Supported Projects/Accounts:"
260205
@echo " - Hathor Testnet: $(HATHOR_TESTNET_REGISTRY)"
261-
@echo " - Nano Testnet: $(NANO_TESTNET_REGISTRY)"
262206
@echo " - Standalone Fullnodes: $(STANDALONE_FULLNODES_REGISTRY)"
263207
@echo " - Ekvilibro: $(EKVILIBRO_REGISTRY)"
264208
@echo " - Hathor Testnet Playground: $(HATHOR_TESTNET_PLAYGROUND_REGISTRY)"

‎hathor/nanocontracts/resources/nc_exec_logs.py‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -115,12 +115,7 @@ class NCExecLogsResponse(Response):
115115

116116
NCExecLogsResource.openapi = {
117117
'/nano_contract/logs': {
118-
'x-visibility': 'private',
119-
'x-visibility-override': {
120-
'nano-testnet-bravo': 'public',
121-
'hathor-testnet-india': 'public',
122-
'hathor-testnet-playground': 'public',
123-
},
118+
'x-visibility': 'public',
124119
'x-rate-limit': {
125120
'global': [
126121
{

‎hathor_cli/nginx_config.py‎

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,8 @@ def _get_visibility(source: dict[str, Any], fallback: Visibility, override: str)
113113
def generate_nginx_config(openapi: dict[str, Any], *, out_file: TextIO, rate_k: float = 1.0,
114114
fallback_visibility: Visibility = Visibility.PRIVATE,
115115
disable_rate_limits: bool = False,
116-
override: str = "") -> None:
116+
override: str = "",
117+
trusted_proxy_ips: list[str] | None = None) -> None:
117118
""" Entry point of the functionality provided by the cli
118119
"""
119120
from datetime import datetime
@@ -216,6 +217,18 @@ def generate_nginx_config(openapi: dict[str, Any], *, out_file: TextIO, rate_k:
216217
event_websocket_max_conn_global = 100
217218
event_websocket_max_conn_per_ip = 4
218219

220+
# Build trusted proxy IP lines
221+
geo_trusted_proxy_lines = ''
222+
set_real_ip_trusted_proxy_lines = ''
223+
if trusted_proxy_ips:
224+
geo_trusted_proxy_lines = ' # Trusted proxy IPs (project-specific):\n'
225+
set_real_ip_trusted_proxy_lines = ' # Trusted proxy IPs (project-specific):\n'
226+
for ip in trusted_proxy_ips:
227+
# Add /32 or /128 suffix if not already a CIDR
228+
cidr = ip if '/' in ip else (f'{ip}/128' if ':' in ip else f'{ip}/32')
229+
geo_trusted_proxy_lines += f' {cidr} 0;\n'
230+
set_real_ip_trusted_proxy_lines += f' set_real_ip_from {cidr};\n'
231+
219232
header = f'''# THIS FILE WAS AUTOGENERATED BY THE `hathor-cli nginx-config` TOOL AT {datetime.now()}
220233
221234
server_tokens off;
@@ -226,7 +239,13 @@ def generate_nginx_config(openapi: dict[str, Any], *, out_file: TextIO, rate_k:
226239
10.0.0.0/8 0;
227240
172.16.0.0/12 0;
228241
192.168.0.0/16 0;
229-
}}
242+
# Whitelist GCP Load Balancer / Health Check IPs:
243+
# See: https://docs.cloud.google.com/load-balancing/docs/firewall-rules
244+
35.191.0.0/16 0;
245+
130.211.0.0/22 0;
246+
2600:2d00:1:b029::/64 0;
247+
2600:2d00:1:1::/64 0;
248+
{geo_trusted_proxy_lines}}}
230249
231250
map $should_limit $per_ip_key {{
232251
0 "";
@@ -264,7 +283,13 @@ def generate_nginx_config(openapi: dict[str, Any], *, out_file: TextIO, rate_k:
264283
set_real_ip_from 10.0.0.0/8;
265284
set_real_ip_from 172.16.0.0/12;
266285
set_real_ip_from 192.168.0.0/16;
267-
# Trust CloudFront
286+
# Trust GCP Load Balancer / Health Check IPs
287+
# See: https://docs.cloud.google.com/load-balancing/docs/firewall-rules
288+
set_real_ip_from 35.191.0.0/16;
289+
set_real_ip_from 130.211.0.0/22;
290+
set_real_ip_from 2600:2d00:1:b029::/64;
291+
set_real_ip_from 2600:2d00:1:1::/64;
292+
{set_real_ip_trusted_proxy_lines} # Trust CloudFront
268293
# See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/LocationsOfEdgeServers.html
269294
include set_real_ip_from_cloudfront;
270295
@@ -365,6 +390,9 @@ def main():
365390
help='Disable including rate-limits in the config, defaults to False')
366391
parser.add_argument('--override', type=str, default='',
367392
help='Override visibility for paths with `x-visibility-override` for the given value')
393+
parser.add_argument('--trusted-proxy-ip', type=str, action='append', default=None,
394+
help='IP address of a trusted proxy (e.g. a load balancer) to add to set_real_ip_from and '
395+
'the rate-limit whitelist. Can be specified multiple times.')
368396
parser.add_argument('out', type=argparse.FileType('w', encoding='UTF-8'), default=sys.stdout, nargs='?',
369397
help='Output file where nginx config will be written')
370398
args = parser.parse_args()
@@ -373,4 +401,5 @@ def main():
373401
generate_nginx_config(openapi, out_file=args.out, rate_k=args.rate_multiplier,
374402
fallback_visibility=args.fallback_visibility,
375403
disable_rate_limits=args.disable_rate_limits,
376-
override=args.override)
404+
override=args.override,
405+
trusted_proxy_ips=args.trusted_proxy_ip)

0 commit comments

Comments
 (0)