Yet another problem with displaying public IP

[dawiddyd]

Hey, I'm struggling to display correct IP address in Pangolin's requests log. I have only IPv6 VPS, Pangolin runned via Docker with IPv6 network enabled, not in network host mode.

I'm using Cloudflare proxy and Caddy is installed on VPS as well.

So stack is: Cloudflare -> Caddy -> Traefik -> Pangolin

Caddyfile

service.example.com {
	reverse_proxy https://127.0.0.1:8488 {
		transport http {
			tls_insecure_skip_verify
		}
	}
}

in Traefik's access log, I have following records when accessing exposed service:

{
  "ClientAddr": "172.25.0.1:41546",
  "ClientHost": "2400:cb00:978:1000:92d9:3193:17a9:4299", // cloudflare ipv6
  "RequestHost": "service.example.com",
  "RequestPath": "/api/",
  "ServiceName": "service-name@http",
  "origin_Content-Type": "application/json",
  "request_X-Forwarded-For": "2a0d:restofpublicipv6address", // my correct public ipv6 address
  "request_X-Forwarded-Proto": "https",
  "request_X-Real-Ip": "172.25.0.1"
}

Any ideas where is the missing point?

docker compose file:

services:
  pangolin:
    image: fosrl/pangolin # https://github.com/fosrl/pangolin/releases
    container_name: pangolin
    restart: unless-stopped
    networks:
      - pangolin
    volumes:
      - ./config:/app/config
      - pangolin-data:/var/certificates
      - pangolin-data:/var/dynamic
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3101/api/v1/"]
      interval: "3s"
      timeout: "3s"
      retries: 15

  gerbil:
    image: fosrl/gerbil:latest # https://github.com/fosrl/gerbil/releases
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://gerbil:3104
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3101/api/v1/
      - --listen=:3104
    volumes:
      - ./config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
      net.ipv6.conf.all.forwarding: "1"
    ports:
      - 51820:51820/udp
      - 21820:21820/udp
      - 8488:8488 # Port for traefik because of the network_mode
      - 8088:8088 # Port for traefik because of the network_mode
    networks:
      - pangolin

  traefik:
    image: traefik:v3.4.0
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil # Ports appear on the gerbil service
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
      - ./config/traefik:/etc/traefik:ro 
      - ./config/letsencrypt:/letsencrypt
      - ./config/logs/:/var/log/traefik/
      - pangolin-data:/var/certificates:ro
      - pangolin-data:/var/dynamic:ro

networks:
  pangolin:
    driver: bridge
    enable_ipv6: true

volumes:
  pangolin-data:

config.json

...
trust_proxy: 2
...

traefik_config.yml

api:
  insecure: true
  dashboard: true

providers:
  http:
    endpoint: "http://pangolin:3101/api/v1/traefik-config"
    pollInterval: "5s"
  file:
    filename: "/etc/traefik/dynamic_config.yml"

experimental:
  plugins:
    badger:
      moduleName: "github.com/fosrl/badger"
      version: "v1.3.1"
    cloudflarewarp:
      modulename: github.com/BetterCorp/cloudflarewarp
      version: v1.3.0

log:
  level: "INFO"
  format: "common"

certificatesResolvers:
  letsencrypt:
    acme:
      httpChallenge:
        entryPoint: web
      email: myemail@mail.com
      storage: "/letsencrypt/acme.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"

entryPoints:
  web:
    address: ":8088"
    forwardedHeaders:
      trustedIPs: &trustedIps
        - "172.25.0.0/16"

  websecure:
    address: ":8488"
    forwardedHeaders:
      trustedIPs: *trustedIps # Reuse Trusted IP List from web entryPoint
    transport:
      respondingTimeouts:
        readTimeout: "30m"
    http:
      middlewares:
        - cloudflarewarp@file
      tls:
        certResolver: "letsencrypt"

serversTransport:
  insecureSkipVerify: true

ping:
    entryPoint: "web"

dynamic_config.yml

http:
  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https
    cloudflarewarp:
      plugin:
        cloudflarewarp:
          disableDefault: false
          trustip:
            - "127.0.0.1/32"
            - "172.25.0.0/16"
    badger:
      plugin:
        badger:
          disableForwardAuth: true
         # disableDefaultCFIPs: true
         # customIPHeader: "X-Forwarded-For"
          trustip:
            - "127.0.0.1/32"
            - "172.25.0.0/16"

  routers:
    # HTTP to HTTPS redirect router
    main-app-router-redirect:
      rule: "Host(`pangolin.example.com`)"
      service: next-service
      entryPoints:
        - web
      middlewares:
        - redirect-to-https
        - badger
        - cloudflarewarp

    # Next.js router (handles everything except API and WebSocket paths)
    next-router:
      rule: "Host(`pangolin.example.com`) && !PathPrefix(`/api/v1`)"
      service: next-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
      middlewares:
        - badger
        - cloudflarewarp

    # API router (handles /api/v1 paths)
    api-router:
      rule: "Host(`pangolin.example.com`) && PathPrefix(`/api/v1`)" 
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
      middlewares:
        - badger
        - cloudflarewarp

    # WebSocket router
    ws-router:
      rule: "Host(`pangolin.example.com`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
      middlewares:
        - badger
        - cloudflarewarp

  services:
    next-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3102" 

    api-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3100"