paivana (2020B)
1 # RFC 7239 node identifier for the peer we accepted from. nginx has 2 # no built-in variable for this: an IPv6 address has to be bracketed 3 # and therefore quoted (RFC 7239 §6), and a peer with no address is 4 # "unknown" (§6.3). 5 map $remote_addr $paivana_forwarded_elem { 6 ~^[0-9.]+$ "for=$remote_addr"; 7 ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\""; 8 default "for=unknown"; 9 } 10 11 server { 12 listen 80; 13 listen [::]:80; 14 15 # server_name example.com 16 17 location / { 18 proxy_pass http://unix:/run/paivana/httpd/paivana-http.sock; 19 proxy_redirect off; 20 proxy_set_header Host $host; 21 22 # paivana-httpd is started with -f (see paivana-httpd.service), so 23 # it takes the client address for the access cookie from the 24 # headers set here. That is only sound because this server is the 25 # outermost hop and *overwrites* them: $remote_addr is the peer we 26 # actually accepted, whereas $proxy_add_x_forwarded_for would 27 # append it to whatever the client claimed, leaving the client in 28 # control of the leftmost entry -- and thus of its own identity. 29 # 30 # If this nginx is itself behind another proxy, switch to 31 # $proxy_add_x_forwarded_for and set real_ip_header / 32 # set_real_ip_from for that hop. 33 proxy_set_header X-Forwarded-For $remote_addr; 34 proxy_set_header X-Forwarded-Proto $scheme; 35 proxy_set_header X-Forwarded-Host $host; 36 proxy_set_header X-Forwarded-Port $server_port; 37 38 # RFC 7239. paivana-httpd prefers this over the X-Forwarded-* 39 # headers above, which are kept for origins that only speak those. 40 # Again a plain "set": nginx offers no $proxy_add_forwarded, and at 41 # the outermost hop we would not want one -- a client-supplied 42 # element must not survive. Behind another proxy, replace this 43 # with the appending form from nginx.org's "Using the Forwarded 44 # header", which validates $http_forwarded before extending it. 45 proxy_set_header Forwarded "$paivana_forwarded_elem;proto=$scheme;host=$host"; 46 } 47 }