Update nginx recommendations

[silverwind]

• Connection and Upgrade needed for websockets
• X-Real-IP unnecessary and duplicate with X-Forwarded-For. chi checks both headers, but XFF is definitely the more "standard" one.

[silverwind]

I guess X-Real-IP has the benefit of parsing faster, so I'm indifferent whether to keep it. cc: @lafriks.

[lafriks]

This really depends on the situation, I would keep both. Generally nowadays there will be at least two proxies when deploying HA in K8s/docker etc edge reverse proxy -> ingress reverse proxy -> gitea and if not correctly configured x-real-ip could be incorrect and x-forwarded-for will be more reliable in that case. In the case of a single VM and nginx in front, yes it does not really matter what to use

[lafriks]

For more general use case I would recommend leaving them both

[silverwind]

I guess I will restore x-real-ip based on your opinion. Generally I think XFF is much better and likely better handled in a chain of proxies. There is also a https://datatracker.ietf.org/doc/html/rfc7239 but it seems no one is adopting it 😆

[silverwind]

So now this is only about websocket config, which does not hurt to have and will be needed for #26679 anyways, so I think it's good to start recommending it.

[wxiaoguang]

In many cases, X-Real-IP can be trusted while X-Forwarded-For can't.

[lafriks]

In many cases, X-Real-IP can be trusted while X-Forwarded-For can't.

That's why there is configuration on how many last IP's from X-Forwarded-For can be trusted by default we have 1 I think all others are discarded

[GiteaBot]

I was unable to create a backport for 1.20. @silverwind, please send one manually. 🍵

go run ./contrib/backport 26924
...  // fix git conflicts if any
go run ./contrib/backport --continue

[silverwind]

Not worth the backport imho, Websocket will come in 1.22 earliest.