Nginx Proxy, Fail2Ban, headers - they all be fighting

[matticas]

Hi All;

I've been banging my head on a wall with this. I can not get the external IP address to resolve/display in the Immich Logs, for Fail2Ban to ban the correct IP. Fail2Ban only sees the docker container IP.

Setup;

• Immich in Docker. Works great.
• Nginx Proxy Manager, also in Docker, with URL and Certificates. Works great, says "server online" bottom left.
• I have the custom config proxy header stuff copied in from the Immich Docs website. Removing this allows it to all work, just no "server online" on the bottom left.
• Fail2Ban on the Host Machine, works with Emby so far. Immich logs are piped in and work, except, it only sees the Docker IP address (172.21.0.x etc).

If I remove the customer proxy header stuff (from the reverse proxy docs above), the "server online" changes to "server offline" however the correct external IP address is passed to the logs thus Fail2Ban.

But why? I want "server online" to be present, and for the external IP to be passed to the logs.

What have I done wrong to my setup? (some data below);

Thanks

Immich-Server Docker;

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    volumes:
      #- ${UPLOAD_LOCATION}:/usr/src/app/upload
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
      - /home/user/Photos:/My_Photos
    env_file:
      - stack.env
    ports:
      - 2283:2283
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false
    devices:
      - /dev/dri:/dev/dri
    dns:
      - 192.168.1.10  #pihole 1
      - 192.168.1.11  #pihole 2

    logging:
      driver: "journald"
      options:
        tag: "immich-server"

Nginx Proxy Manager Docker;

services:
  app:
    image: 'docker.io/jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - /home/user/nginx:/data
      #- /home/user/ssl:/etc/letsencrypt
      - ./letsencrypt:/etc/letsencrypt
    dns:
      - 192.168.1.10
      - 192.168.1.11

Nginx Proxy setup;

Direct from the immich reverse proxy docs website.

    server_name immich.myurl.com;

    # allow large file uploads
    client_max_body_size 50000M;

    # disable buffering uploads to prevent OOM on reverse proxy server and make uploads twice as fast (no pause)
    proxy_request_buffering off;

    # increase body buffer to avoid limiting upload speed
    client_body_buffer_size 1024k;

    # Set headers
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # enable websockets: http://nginx.org/en/docs/http/websocket.html
    proxy_http_version 1.1;
    proxy_redirect     off;

    # set timeout
    proxy_read_timeout 600s;
    proxy_send_timeout 600s;
    send_timeout       600s;

    location / {
        proxy_pass http://192.168.1.10:2283;
        proxy_set_header   Upgrade    $http_upgrade;
        proxy_set_header   Connection "upgrade";
    }

    # useful when using Let's Encrypt http-01 challenge
    # location = /.well-known/immich {
    #     proxy_pass http://<backend_url>:2283;
    # }

Host system log file from /var/log/syslog which shows the Immich docker containers network gateway; 172.21.0.1 (4x Immich docker containers are 172.21.0.2->5)

026-01-13T17:33:54.505629+11:00 Goomba immich-server[1841]: #033[33m[Nest] 27  - #033[39m01/13/2026, 5:33:54 PM #033[33m   WARN#033[39m #033[33m[Api:AuthService~l1ianawa]#033[39m #033[33mFailed login attempt for user fake@gmail.com from ip address ::ffff:172.21.0.1#033[39m
2026-01-13T17:33:54.506076+11:00 Goomba immich-server[1841]: #033[95m[Nest] 27  - #033[39m01/13/2026, 5:33:54 PM #033[95m  DEBUG#033[39m #033[33m[Api:LoggingInterceptor~l1ianawa]#033[39m #033[95mPOST /api/auth/login 201 24.34ms ::ffff:172.21.0.1#033[39m
2026-01-13T17:33:54.506437+11:00 Goomba immich-server[1841]: #033[95m[Nest] 27  - #033[39m01/13/2026, 5:33:54 PM #033[95m  DEBUG#033[39m #033[33m[Api:GlobalExceptionFilter~l1ianawa]#033[39m #033[95mHttpException(401): {"message":"Incorrect email or password","error":"Unauthorized","statusCode":401}#033[39m

[matticas]

Anyone?