Reverse proxy

[sammy007]

Not an issue, but who knows, it could be. Is it okay to run nucypher behind load balancer? When you load balance real client IPs are hidden and keep receive balancer's IP. Has been running it for a day and getting:

number of connected peers: [138]

2024-04-06T19:32:39.662Z	INFO	keep-libp2p	libp2p/libp2p.go:547	established connection to [/ip4/172.18.0.1/tcp/40356/ipfs/16Uiu2HAmNUTrhsXTgrFCEJwngrwhDSf3AZLqMUFbfj7yTaQqG2BT]
2024-04-06T19:32:39.662Z	INFO	keep-libp2p	libp2p/libp2p.go:569	starting ping test for [/ip4/172.18.0.1/tcp/40356/ipfs/16Uiu2HAmNUTrhsXTgrFCEJwngrwhDSf3AZLqMUFbfj7yTaQqG2BT]
2024-04-06T19:32:40.093Z	INFO	keep-libp2p	libp2p/libp2p.go:593	ping test for [/ip4/172.18.0.1/tcp/40356/ipfs/16Uiu2HAmNUTrhsXTgrFCEJwngrwhDSf3AZLqMUFbfj7yTaQqG2BT] completed with success (RTT [143.628337ms])

So everything seems fine (given that 172.18.0.1 is a load balancer IP which is a tcp proxy)a nd I can see my node among other peers in their /diagnostics.

Asking to make sure that it is not a problem to run in behind a proxy.

[sammy007]

Would like to just leave it here for future in case priorities will change https://github.com/pires/go-proxyproto the library provides support for v1 and v2 proxy protocols, should eliminate all issues with running keep-client behind balancer.

[thevops]

Afaik, using load-balancer doesn't cause any problems. At least, for me.

[jose-blockchain]

Running behind a load balancer is fine. The architecture doesn't rely on IP addresses for anything critical.

Peers are identified by their cryptographic peer ID (derived from the operator's public key), not IP. The firewall validates connections through on-chain verification of the operator key, independent of source IP.

IP addresses are only used for transport-layer connections, logging, and DHT discovery. Your logs showing successful connections and ping tests prove it's working correctly.

One thing to check: if you're behind NAT/proxy, make sure your announcedAddresses config has your publicly accessible address so other peers can dial back to you.

Re: the proxy protocol library - it would make logs cleaner by showing real IPs instead of the proxy IP, but it's not functionally necessary.