FIX: fastly template should be teaching nginx what to trust - #1077
Merged
Conversation
The idea of replacing proxy_add_x_forwarded_for is ghastly - we have the ability to teach nginx how to discern the correct values for the actual end user IP instead of telling it to pass through the header to Discourse. This means the server-side nginx logs will be correct, plus allows for more complex setups.
fitzy101
approved these changes
Jun 15, 2026
Supermathie
added a commit
to discourse/discourse
that referenced
this pull request
Jun 16, 2026
…er IP nginx's responsibility is to determine the correct end user's IP (as far as we can trust it) and report that to Discourse. The correct way to do that is to teach nginx how to determine this for itself - this means that both the nginx logs and the downstream value will be correct. (see discourse/discourse_docker#1077 which removes the only use of `proxy_add_x_forwarded_for`) Setting the x-f-f header to `$proxy_add_x_forwarded_for` or `$http_x_forwarded_for` hides this learned knowledge and forces Discourse to go through the same process and possibly arrive at a edifferent answer. In most cases this won't make a difference, but when there is more than one proxy in front of Discourse this exposes a failure case. client → proxyA → proxyB → nginx → discourse means Discourse saw: ``` x-real-ip: client_ip x-forwarded-for: client_ip, proxyA ``` and might end using `client_ip` or `proxyA_ip` depending on codepath. After this change, Discourse sees: ``` x-real-ip: client_ip x-forwarded-for: client_ip ``` for the same situation.
Supermathie
commented
Jun 16, 2026
| real_ip_header fastly-client-ip; | ||
| - exec: | ||
| cmd: | ||
| - apt-get update && apt-get install -y jq && apt-get clean |
Member
Author
There was a problem hiding this comment.
I feel a little bad about this, but after we move to trixie we can pull yq-go into the base image for tasks like this
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The idea of replacing proxy_add_x_forwarded_for is ghastly - we have the
ability to teach nginx how to discern the correct values for the actual end
user IP instead of telling it to pass through the header to Discourse.
This means the server-side nginx logs will be correct, plus allows for more
complex setups.