Log the X-Forwarded-For header and stop logging the Referer header in HAProxy.

Author: benbz

.github/element-docs-words.txt

@@ -8,8 +8,8 @@ dockerhub
 Gematik
 GHSA
 homeserver
-homeservers
 Homeserver
+homeservers
 Jetstack
 kubeconform
 kubernetes
@@ -22,6 +22,7 @@ postgres
 PostgreSQL
 pytest
 Pytest
+Referer
 SCIM
 shellcheck
 templatable

charts/matrix-stack/configs/haproxy/haproxy.cfg.tpl

@@ -88,9 +88,9 @@ frontend http-blackhole
   # same as http log, with %Th (handshake time)
   log-format "%ci:%cp [%tr] %ft %b/%s %Th/%TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
 
-  capture request header Host len 32
-  capture request header Referer len 200
-  capture request header User-Agent len 200
+  http-request capture hdr(host) len 32
+  http-request capture req.fhdr(x-forwarded-for) len 64
+  http-request capture req.fhdr(user-agent) len 200
 
   http-request deny content-type application/json string '{"errcode": "M_FORBIDDEN", "error": "Blocked"}'
 

charts/matrix-stack/configs/synapse/partial-haproxy.cfg.tpl

@@ -35,9 +35,9 @@ frontend synapse-http-in
   # same as http log, with %Th (handshake time)
   log-format "%ci:%cp [%tr] %ft %b/%s %Th/%TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
 
-  capture request header Host len 32
-  capture request header Referer len 200
-  capture request header User-Agent len 200
+  http-request capture hdr(host) len 32
+  http-request capture req.fhdr(x-forwarded-for) len 64
+  http-request capture req.fhdr(user-agent) len 200
 
   # before we change the 'src', stash it in a session variable
   http-request set-var(sess.orig_src) src if !{ var(sess.orig_src) -m found }

charts/matrix-stack/configs/well-known/partial-haproxy.cfg.tpl

@@ -13,9 +13,9 @@ frontend well-known-in
   # same as http log, with %Th (handshake time)
   log-format "%ci:%cp [%tr] %ft %b/%s %Th/%TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
 
-  capture request header Host len 32
-  capture request header Referer len 200
-  capture request header User-Agent len 200
+  http-request capture hdr(host) len 32
+  http-request capture req.fhdr(x-forwarded-for) len 64
+  http-request capture req.fhdr(user-agent) len 200
 
   acl is_delete_put_post_method method DELETE POST PUT
   http-request deny status 405 if is_delete_put_post_method

newsfragments/788.changed.1.md

@@ -0,0 +1 @@
+Log the X-Forwarded-For header and stop logging the Referer header in HAProxy.