From fbdabfd64535a78dbd9cabf09ce9d91cb82c5082 Mon Sep 17 00:00:00 2001 From: micbar Date: Fri, 30 Oct 2026 18:01:34 +0100 Subject: [PATCH] docs: describe the client address with PROXY_CLIENT_IP_HEADER --- services/audit/README.md | 2 +- services/proxy/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/services/audit/README.md b/services/audit/README.md index 34c0ff725f..6f0ab8eaa4 100644 --- a/services/audit/README.md +++ b/services/audit/README.md @@ -107,7 +107,7 @@ The audit service acknowledges an event only after it was written. If it stops o ## Client Address -The proxy determines the client address. It only uses the `X-Forwarded-For` and `X-Real-IP` headers when the request comes from a trusted reverse proxy, see `PROXY_TRUSTED_PROXIES`. The default trusts the loopback and the private network ranges. This also changes the client address in the access log. +The proxy determines the client address. It only uses the `X-Forwarded-For` header, or the header set in `PROXY_CLIENT_IP_HEADER`, when the request comes from a trusted reverse proxy, see `PROXY_TRUSTED_PROXIES`. The default trusts the loopback and the private network ranges. Check the setting if your reverse proxy is not in a private network: diff --git a/services/proxy/README.md b/services/proxy/README.md index 9caf1d8775..a169e7055e 100644 --- a/services/proxy/README.md +++ b/services/proxy/README.md @@ -304,7 +304,7 @@ Check `PROXY_TRUSTED_PROXIES` as described in [Trusted Reverse Proxies](#trusted ### Trusted Reverse Proxies -Behind a reverse proxy, the proxy service sees the address of the reverse proxy, the address of the client comes in the `X-Forwarded-For` header. Any client can send this header, so the proxy service only uses it when the request comes from a trusted reverse proxy. The client address is used in the access log. +Behind a reverse proxy, the proxy service sees the address of the reverse proxy, the address of the client comes in the `X-Forwarded-For` header. Any client can send this header, so the proxy service only uses it when the request comes from a trusted reverse proxy. The client address is used in the access log and in the audit log. `PROXY_TRUSTED_PROXIES` takes a list of IP addresses and CIDR ranges. The default trusts the loopback and the private network ranges: `127.0.0.0/8`, `::1/128`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` and `fc00::/7`. This works for a reverse proxy in the same Docker network or a Kubernetes ingress.