Add 'no_forwarder' Option to Public Frontend

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## v0.4.28
 
+FEATURE: Added `no_forwarder` option to the public frontend configuration to avoid setting client addresses of intermediate infrastructure (https://github.com/openziti/zrok/issues/609)
+
 CHANGE: the container images run as "ziggy" (UID 2171) instead of the generic restricted user "nobody" (UID 65534). This reduces the risk of unexpected file permissions when binding the Docker host's filesystem to a zrok container.
 
 CHANGE: the Docker sharing guides were simplified and expanded

endpoints/publicProxy/config.go

@@ -12,12 +12,13 @@ import (
 const V = 3
 
 type Config struct {
-	V         int
-	Identity  string
-	Address   string
-	HostMatch string
-	Oauth     *OauthConfig
-	Tls       *endpoints.TlsConfig
+	V           int
+	Identity    string
+	Address     string
+	HostMatch   string
+	NoForwarder bool
+	Oauth       *OauthConfig
+	Tls         *endpoints.TlsConfig
 }
 
 type OauthConfig struct {

endpoints/publicProxy/http.go

@@ -106,6 +106,9 @@ func newServiceProxy(cfg *Config, ctx ziti.Context) (*httputil.ReverseProxy, err
 	director := proxy.Director
 	proxy.Director = func(req *http.Request) {
 		director(req)
+		if cfg.NoForwarder {
+			req.Header["X-Forwarded-For"] = nil
+		}
 		req.Header.Set("X-Proxy", "zrok")
 	}
 	proxy.ModifyResponse = func(resp *http.Response) error {