Skip to content

Proxy Protocol Implementation#1384

Draft
joshua-siw wants to merge 9 commits intoTecharoHQ:mainfrom
joshua-siw:feat/1208-proxy-protocol
Draft

Proxy Protocol Implementation#1384
joshua-siw wants to merge 9 commits intoTecharoHQ:mainfrom
joshua-siw:feat/1208-proxy-protocol

Conversation

@joshua-siw
Copy link

resolves: #1208

Allows listening to Connections with a Proxy Protocol Header(detects v1 or v2 automatically) and sets x-real-ip accordingly.

Theoretically this would allow to remove the usage of x-real-ip in caddy or ha proxy configs but only if all connections have a proxy header which can be configured with a combination of a "proxy-protocol-allowed-cidrs" and "proxy-protocol-policy".

Also allows sending Proxy Protocol Headers if "proxy-protocol-send-version" is set but it isnt possible to get the correct port if the connection didnt sent a proxy protocol header(eg use-proxy is false and we only have the x-real-ip from for example ha proxy)

Tests are missing as well as i want to get feedback on the implementation before i start, also could do a refactor of my code here and there

Here is a compose file which configured haproxy to send proxy protocol headers(i set ko.local when building the image via npm run container), creates a subnet with a cidr and allows this cidr to use proxy headers in anubis, if traffic comes from a different cidr it gets rejected also if the traffic wouldnt have proxy protocol header.
One could change it when setting the policy to IGNORE but then x-real-ip has to be passed in from haproxy


services:
  haproxy:
    image: haproxy:latest
    ports:
      - "80:80"
    configs:
      - source: haproxy_cfg
        target: /usr/local/etc/haproxy/haproxy.cfg
    networks:
      - anubis_subnet

  anubis:
    image: ko.local/anubis:latest
    pull_policy: if_not_present
    expose:
      - "3000"
    command:
      - --bind=:3000
      - --use-proxy-protocol=true
      - --proxy-protocol-allowed-cidrs=172.20.0.0/24
      - --proxy-protocol-policy=REJECT
      - --target=http://whoami:81
      - --slog-level=DEBUG
    networks:
      - anubis_subnet

  whoami:
    image: traefik/whoami
    pull_policy: always
    ports:
      - "81:81"
    environment:
      WHOAMI_PORT_NUMBER: 81
    networks:
      - anubis_subnet

configs:
  haproxy_cfg:
    content: |
      global
        log stdout format raw daemon

      defaults
          log global
          mode http
          option httplog
          timeout client 30s
          timeout connect 5s
          timeout server 30s
      
      frontend fe_http
          bind *:80
          default_backend be_anubis
      
      backend be_anubis
          mode http
          server anubis anubis:3000 send-proxy

networks:
  anubis_subnet:
    ipam:
      config:
        - subnet: 172.20.0.0/24

Checklist:

  • Added a description of the changes to the [Unreleased] section of docs/docs/CHANGELOG.md
  • Added test cases to the relevant parts of the codebase
  • Ran integration tests npm run test:integration (unsupported on Windows, please use WSL)
  • All of my commits have verified signatures

@joshua-siw
Copy link
Author

joshua-siw commented Jan 2, 2026

saw to late that #1381 already exists, feel free to close my pr

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature request] PROXY protocol support

1 participant