austnv/remnawave-minishop
1
0
Fork 0
Code Issues 1 Pull Requests Activity

fix: resolve webhook client IP behind proxies

Browse Source
This commit is contained in:
3252a8
2026-06-08 11:25:02 +03:00
parent 23ad893f69
commit c2f0ae0b8b
21 changed files with 161 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/examples/caddy/.env.example
+2 -2
View File
@@ -36,5 +36,5 @@ PANEL_API_URL=https://panel.example.com/api
PANEL_API_KEY=change_me
PANEL_WEBHOOK_SECRET=change_me
# Caddy and Docker network ranges that may set X-Forwarded-For.
TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
# Caddy and private Docker/LAN ranges that may set X-Forwarded-For.
TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
deploy/examples/caddy/Caddyfile
+3
View File
@@ -8,12 +8,15 @@
{$WEBHOOK_HOST} {
encode zstd gzip
# Caddy sets X-Forwarded-For/Host/Proto for reverse_proxy by default.
# The backend uses X-Forwarded-For for payment provider IP allowlists.
reverse_proxy backend:8080
}
{$MINIAPP_HOST} {
encode zstd gzip
# Keep forwarded headers for Web App URL generation and request logging.
reverse_proxy frontend:80
}
deploy/examples/caddy/docker-compose.yml
+1 -1
View File
@@ -64,7 +64,7 @@ services:
environment:
<<: *app_environment
WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7}
volumes:
- ./data:/app/data
- ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}
deploy/examples/newt/.env.example
+2 -2
View File
@@ -37,5 +37,5 @@ PANEL_API_URL=https://panel.example.com/api
PANEL_API_KEY=change_me
PANEL_WEBHOOK_SECRET=change_me
# Pangolin/Newt and Docker network ranges that may set X-Forwarded-For.
TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
# Pangolin/Newt and private Docker/LAN ranges that may set X-Forwarded-For.
TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
deploy/examples/newt/docker-compose.yml
+1 -1
View File
@@ -64,7 +64,7 @@ services:
environment:
<<: *app_environment
WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7}
volumes:
- ./data:/app/data
- ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}
deploy/examples/nginx/.env.example
+2 -2
View File
@@ -36,5 +36,5 @@ PANEL_API_URL=https://panel.example.com/api
PANEL_API_KEY=change_me
PANEL_WEBHOOK_SECRET=change_me
# Nginx and Docker network ranges that may set X-Forwarded-For.
TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
# Nginx and private Docker/LAN ranges that may set X-Forwarded-For.
TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
deploy/examples/nginx/docker-compose.yml
+1 -1
View File
@@ -64,7 +64,7 @@ services:
environment:
<<: *app_environment
WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7}
volumes:
- ./data:/app/data
- ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}
deploy/examples/nginx/nginx.conf.template
+1
View File
@@ -31,6 +31,7 @@ server {
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
# Required for payment provider IP allowlists in webhook handlers.
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;