fix: resolve webhook client IP behind proxies

deploy/docker/caddy/Caddyfile

@@ -2,11 +2,14 @@
 app.example.com {
 	encode zstd gzip
 
+	# Caddy sets X-Forwarded-For/Host/Proto for reverse_proxy by default.
+	# The backend uses X-Forwarded-For for payment provider IP allowlists.
 	reverse_proxy backend:8080
 }
 
 web.example.com {
 	encode zstd gzip
 
+	# Keep forwarded headers for Web App URL generation and request logging.
 	reverse_proxy frontend:80
 }

deploy/docker/nginx/remnawave-minishop.conf

@@ -72,6 +72,7 @@ server {
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
+        # Required for payment provider IP allowlists in webhook handlers.
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Host $host;
         proxy_set_header X-Forwarded-Proto $scheme;

deploy/examples/caddy/.env.example

@@ -36,5 +36,5 @@ PANEL_API_URL=https://panel.example.com/api
 PANEL_API_KEY=change_me
 PANEL_WEBHOOK_SECRET=change_me
 
-# Caddy and Docker network ranges that may set X-Forwarded-For.
-TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
+# Caddy and private Docker/LAN ranges that may set X-Forwarded-For.
+TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7

deploy/examples/caddy/Caddyfile

@@ -8,12 +8,15 @@
 {$WEBHOOK_HOST} {
 	encode zstd gzip
 
+	# Caddy sets X-Forwarded-For/Host/Proto for reverse_proxy by default.
+	# The backend uses X-Forwarded-For for payment provider IP allowlists.
 	reverse_proxy backend:8080
 }
 
 {$MINIAPP_HOST} {
 	encode zstd gzip
 
+	# Keep forwarded headers for Web App URL generation and request logging.
 	reverse_proxy frontend:80
 }
 

deploy/examples/caddy/docker-compose.yml

@@ -64,7 +64,7 @@ services:
     environment:
       <<: *app_environment
       WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
-      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
+      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7}
     volumes:
       - ./data:/app/data
       - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}

deploy/examples/newt/.env.example

@@ -37,5 +37,5 @@ PANEL_API_URL=https://panel.example.com/api
 PANEL_API_KEY=change_me
 PANEL_WEBHOOK_SECRET=change_me
 
-# Pangolin/Newt and Docker network ranges that may set X-Forwarded-For.
-TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
+# Pangolin/Newt and private Docker/LAN ranges that may set X-Forwarded-For.
+TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7

deploy/examples/newt/docker-compose.yml

@@ -64,7 +64,7 @@ services:
     environment:
       <<: *app_environment
       WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
-      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
+      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7}
     volumes:
       - ./data:/app/data
       - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}

deploy/examples/nginx/.env.example

@@ -36,5 +36,5 @@ PANEL_API_URL=https://panel.example.com/api
 PANEL_API_KEY=change_me
 PANEL_WEBHOOK_SECRET=change_me
 
-# Nginx and Docker network ranges that may set X-Forwarded-For.
-TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
+# Nginx and private Docker/LAN ranges that may set X-Forwarded-For.
+TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7

deploy/examples/nginx/docker-compose.yml

@@ -64,7 +64,7 @@ services:
     environment:
       <<: *app_environment
       WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
-      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
+      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7}
     volumes:
       - ./data:/app/data
       - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}

deploy/examples/nginx/nginx.conf.template

@@ -31,6 +31,7 @@ server {
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
+        # Required for payment provider IP allowlists in webhook handlers.
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Host $host;
         proxy_set_header X-Forwarded-Proto $scheme;