acme2certifier docker behind a proxy and real IP, how ?

[StefanSa]

Hi there,
First of all, thanks for the great tool.
I use acme2certifier with behind traefik as a proxy, for this to work i need the real IP from the client.
These headers are also sent:

X-Forwarded-For: 172.
X-Forwarded-Host: acme.
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 4f71e6154983
X-Real-Ip: 172.

I have adjusted the following in the nginx nginx_acme_srv.conf.

    location / {

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Port $remote_port;

        include uwsgi_params;
        uwsgi_pass unix:/run/uwsgi/acme.sock;
        if ($request_method = "HEAD" ) {
           add_header Content-length 0;
           # add_header Transfer-Encoding identity;
        }

But no success, any idea what could be missing here ?
Thanks for any help.

Stefan

[grindsa]

Is there a specific reason that you need the client ip?

[grindsa]

If you dont mind, can you please share your traffik configuration?

[grindsa]

Hi Stefan,

The functionality you need is achievable with some minor adjustments to the nginx configuration used by acme2certifier. I have created a test build that includes these changes and stored it on Docker Hub. For testing, you can pull it using the following command:

docker pull grindsa/acme2certifier:nginx_improvements

When using this build or any release from acme2certifier v0.37 onwards, you will need to update the logging configuration. The simplest way to do this is to create a modified nginx.conf file and mount it into your acme2certifier container during startup. Below is the example configuration I used during my tests (please note the changed "Logging Settings" section:

# nginx.conf
http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##
        log_format combined_realip '$http_x_forwarded_for - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent"';
        access_log /var/log/nginx/access.log combined_realip;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}

Further my (very simple) docker-compose.yml bringing up traeffik and acme2certifer

version: '3.3'

services:
  traefik:
    image: traefik:latest
    container_name: "traefik"
    command:
      - "--log.level=DEBUG"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"

  acme2certifier:
    image: grindsa/acme2certifier:nginx_improvements
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.a2c.rule=Host(`a2c.acme`)"
      - "traefik.http.routers.a2c.entrypoints=web"
    volumes:
      - "./acme2certifier:/var/www/acme2certifier/volume"
      - "./nginx.conf:/etc/nginx/nginx.conf"

networks:
  default:
    external:
      name: acme

With these modifications see the client ip (192.168.14.1 in my example) in the logs:

PS C:\temp> Invoke-WebRequest -Uri http://a2c.acme/directory

StatusCode        : 200
...
ParsedHtml        : mshtml.HTMLDocumentClass

docker logs

docker logs traefik-acme2certifier-1

172.18.0.3 /directory
192.168.14.1 - - [01/Mar/2025:06:26:30 +0000] "GET /directory HTTP/1.1" 200 620 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.5486"

HTH. Feel free to try and to provide feedback...

G.