From d0d0936619c28c834c90d23e24c4b37e1e3c80b9 Mon Sep 17 00:00:00 2001 From: emeric Date: Sat, 5 Oct 2024 20:47:03 +0200 Subject: [PATCH] Use newer Wt's proxy settings, fixes #532 --- INSTALL.md | 10 ++++++---- approot/images/unknown-artist.jpg | Bin 12272 -> 0 bytes conf/lms.conf | 7 +++++++ src/lms/main.cpp | 11 ++++++++++- 4 files changed, 23 insertions(+), 5 deletions(-) delete mode 100755 approot/images/unknown-artist.jpg diff --git a/INSTALL.md b/INSTALL.md index 7cb0abe5..cecb7aae 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -129,7 +129,10 @@ deploy-path = "/newroot/"; # ending slash is important ``` If you use nginx as a reverse proxy, you can simply replace `location /` with `location /newroot/` to achieve the same result. ## Reverse proxy settings -_LMS_ is shipped with an embedded web server, but it is recommended to deploy behind a reverse proxy. You have to set the _behind-reverse-proxy_ option to _true_ in the `lms.conf` configuration file. +_LMS_ is shipped with an embedded web server, but it is recommended to deploy behind a reverse proxy. You have to set the `behind-reverse-proxy` option to _true_ in the `lms.conf` configuration file and to adjust the trusted proxy list in `trusted-proxies` option. + +__Note__: when running in a docker environment, you have to trust the docker gateway IP (which is `172.17.0.1` by default) + Here is an example to make _LMS_ properly work on _myserver.org_ using _nginx_: ``` server { @@ -147,10 +150,9 @@ server { keepalive_timeout 10m; location / { - - proxy_set_header Client-IP $remote_addr; proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://localhost:5082/; diff --git a/approot/images/unknown-artist.jpg b/approot/images/unknown-artist.jpg deleted file mode 100755 index 8c3285ef1aed427b5d0411a1e67d5c0d049ce222..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 12272 zcmeI2by!u~*6cQ{p zkP4qfD6Yu;wh{z(c^)XRJELOq+iGYf(R*7CnI6ad-&U88V0=GeaILSP==xnfQl05o zO*sZ zNMBZBvM?Md=>kLdZ9h-=?6mI+k-uD=NWexfNA^Ieh9&kqK4&j6giT0l3= z6a~Ifa;~bLJlImbRLQSJgsP*!e2`CJQZ3)|rjQvmk8yT|wcHVe+xxQ_f`&kMYevz& zaJ&f=1P=!SLqYhEazuH2Ce;G|-mwV! zlSiNk@ZmcyBm}`|0A{-SUH|3k;qrJ4-kG&Su?hQ+#c2P80l-gYyWUffb4L>pqXqxV zPxTVCWCqn^9xk?kcEIXVP@QgMZ5%!!Ybc|%UbZL{okPk z0E8`3QBt|7c=dc708$R~@Xip8(Ek+t znm_%M7hr7430fBWI}04~Go}d!JE20rQ1KFZ@LeR7Xg8%-JrG=f;Q%b$u#D#=NpL_2 z%+foBXvqTJ@j|GtgMQ^G9y9YDq5vVq_;(b{eeMk#zCy8IAuQZ1(sBTd0`sL94>nTb z5y0D=Ul9Nx!UgPT0Vq(ee&>P2Xt~5DN2KvTD5M1c(s?lmKBDYhT+m?3j=7JUlKw%t zzUTJ|g56Mm8imJXz3nRe4+uJ@l$``X%9u3s|1ce&2e&dK=vNBt((4Gjdm!bp0v}$I zlPwIxOj8ddS$mUZ1Nnu7TXjW%kx-3wZiJj%t3ETVwq2wFsCpPaXX&ilKc+X5qpFM= zO-iaFvd!uKlHnl)YL)Pv&$+N}ye@rL>&d1sF zvoRmukP|H`1OWg%I^19^%HnAGY%J{RZv{>xHhVhMMUb;4x9d)f!c!DWqIU^d{&{sL z`B}gwO{PyhS2 zA;7_d5CJ4?TpWlh7!RLAjEb6uHi7d26!t2D0((J$LxjHt%x~=XkH1x+U7049Q07d# z&eDQ)+;n!I*~T0f-ybn-knI}ZtIQs3h&lF&@aYMbL8OUf*`Nx4LH8zpEW4B0h29wp zUoeZWqS}`t>~Tg%-U0J2_jKTDC{232)7vT=$v%o=} z$?mhY&vh}81R1Fnl3T4RICc}2;hjw2c zqZ^WQe7iA@5xyq$r#)QKc}8B&H`5y)n#QQUfhyxg3#1PR)($gM0Ig z(d9AM7YZ)xbMI<6G6vq2Xt>d0fdm@rr$2^k!bOCu6l3|=;!bI4D8f{RIx6>G zS2pP{@{(G}x+Uq%9a-|Q-2$zeYNLo_j3=8FLYql3KG>ZlI;>TT7^OnRNr-`H8tV3| zv@&EhAJs@zh6+2*`Fp5v57~XH4Hk=~)2kC?@vn)M6ed?=kmT@xHHWuP*RPYxSJW{4JrVwthr>mesm zm{rkxl~RACg3W=>a#8$Go%J%pQ~zq;tb)09N?-h*?PWmbYueaWu3Zr)%ii{r%i3l9zKPU{S=92wRpb;@PEq+mK&!sjmB2)_l|7jImM zhsdezi@mD!Zz^f{3i2FoqN7vT&YDG-)!w9bJ?a&yy5akpc9Uf#RMkQ6+S14z7&dmr zce)~YLs;v}rtv~bP2kD3BF{NN&fXh~jGm}Pa@9{m&5?1kf?*FhDdLo`2EO7d5mqBV zgS6rC>fM_pxNl{(Ou~{(Bg|PFq%Ww+qP~fBaN9*X zpxShrz1S_0>lf{_oeK;C{m7Has8Ya?=GYw3P;^B)?%)yUW8PI_q*5OYUu0{;&9W~v zT!LVs9`eAMZyG>GRCKG)nvH4Hgi@yiPrTJy1h3V;xeu3A(2VY!5Q#3OBi@yx-j+(mvnx)kjronR8Zyn{IhVP zu%@1GT9lOyjisV_qmWj?7ugVU1t(W!ZkNB?1|}xYi+iUeRVy!etSxtha1YdZP*tKu^>b!}t;$5<0ObFHfd7kt!e&hbI1nN-8UixnPaSv5I&2UQl^QiCRMixh zMoe7Y*#!~8@qo)LII*A>+AQJ-? zdXB*RS;<#Pe@)f%bm*pG0pogR!PQ){oaKSfAvp!>%DZH9yoXEv7u71dC3xCRw?LCa zN0xr(R%T;Q{?{Jj&m|LPj&IJdIf=*#8CldRT(ESaJvVYWBi`kYvne^QO4~AC+^v1~yI$}8^MhZW&K|4&5Z6g+zmH23h z8<7!Ioss>7KcB@-KK8M9k5LKCep0rRd_~qVJ8u0@XnkjZlznCgOE8Mr`V`v2Fjj{B zRLHX-DgM!n$@z0fpO5u#ZV-Z}rO^D7B*s4+-YjR$OLB&cJX_yH&M#11M6NVeHr_<( zBj2T6wpSukWj~8ly7}>}YtI8QVAwwJKCSc)Et&Xaqtx}={As7n1)~9df#gD5oqLJ5=3!i0u`tsobRafta|B=7}}FFdf>*?I@wpntQpw4S4AlD z2tl-U%P)`XTAx{b1l^cRtHjR2kj8A=J~cxq7JlIV!>e)Q0jk4_xo_RJuY9^R)+XFp zA4Tw=haY4d;%UK+9=5n@?@I_RYlT-OIVDCbkD-Syb1TIepvNXIWX@@q;jm@L%T?ui z4l?@`oM1}I&;6KKF{%?lMv_w8)vC_Lma1sqpLQH^QfpPuQ8H|sjp&%au{ia@O#P5+ z9(yBa5dP&x@YI0B7Z=7UfST1 zBBPYg^ZcN~_Q|QZoUnf=?V?n^m)`q4^iizXg>IdBg@bWH9LwHzr03&->Seo@RWP`= zFC_q4dM55GHdxVn@dde`8DYbz0MVs(=1hj1(B2U~lwwceM!u*xwc$9=vf=ru&Pq(4 z#fQ%b3I@6!4)2;PjJ%$Ilyl<|N5y3?PS>-sR&qH=sdJ?uEn)xhAxQh&Am zRyK-|TB9D+Jz?L`{F=U>tKk%xvQ}%yiq}`7nJz;JU$&i5+$P*|uerVzg}RDy_6<>0 z*30q1?}pD$s-q&^_(!DK@QljkaYmWhx<4#y3Z^9s5G=*WIblZP7VkY_#ms>x0jwRnabB5-< zs8sP@1vg=eUaX1*m2-BoQDHDb^7DqTyw9b{2W{EwY@9TmSfSN?i_cS|%f5`X_1*#| z9=qTCgfoW%AAtz*rE}GmcvzH)?KJUSUo(x`d}MTShL-GIkiGNcF5L1Zdlt0E4m<((*7MLr%y!ZRA+EQCEY`!S;UJ!Sc%-S~?75z)B^ zx;H~7J49sZ)zkVGv*FD->CMdi0?|^WB>h+V>mEN9M_#?qfnDb(Vr)DQ1D`#DJ&2gW zu*V93fQ0ndjv*X?O~nZXtC>0nAF9HhE8UY2v9%+Pgg@WSMX7Fq$^B;>Pe~>!{Z&LM z_0#Zd1V1+KIRpVgwjx5#(Y$M0m=5O&9Ggz=ZS%9+?3JehrE#3`al$@=Z=50-)1AK( zVWy$YoPS2A0)~mqHx#v;E4Z5Z3iegi>*n~fYLA^v98B4Vr$2rA=Cw#lq2Dm=y96av zT>f%V%pNgc{8C zwlFC4yd~HPEUhB>?gwOBUG5XVm}BVnOcFosR#Ng^l0i!ez26_tt4w8iKJ{eFedfTZ z`u*UwfoW{mTzk}1TlJO1su@7uje%=nf`yd6eTNO`TlFv>wr^=dIo_K zk#0_mFIO?mA!pkf0m#K#g67Rzfllj;DHqi zLjEIl8{$b3IkWTbA2=3%GaqXNyBs*b6Yua!FN;7hA||(aRSZ%PA_eLd>TM=CdT+h8zhOxI?f+3=4j>R`}(0Td6Qd7TsJDX;bNg-4Cf1_6K>T-N{ z7OsnPo3RxXZ#6Q13k=7vniFuw^~b5jxZBtuQkurJRJoc2e{_%Y zZLNMtek^Lojf-E38*_DN%YW5n8HvnB6N8p|*Q?opkfL)Grw4KwY24bVCNK7gGhK)H1Cti0(gUFw=V#=K#GGsY!FVsox| zaYnfU8>A?qvd3;2>~%Or?1iDx*MyRnN%d7YU6+f=he+sh?0t;o4;Bw0^0)yZ0+w>S z=7HuWXT*hLT`^CagN!%hxy|u@F>RQ|k_I?}+=o_&P7aUV;Hnu-xTcqz&J0D79_*XP z==MhwOSV>bEUi9V4$eYHa9i%NsuVbVXu4ViX-VLd1{3JEFYF2rksunBw_4VnvCYJo zv$2>>TlQx#pc}`LS?Z^)Wv(FuC#zz!rVoC!L7qL6U8nV9e7b&gbS6D#CQ&lOVb@OA zomTg0B#qd4{xj!Wy~6yD@nEprrEZbPJm(}cLP;CKDn0W*bJ~95l-EtJ@O~P7wa2PWfy(8mF-Y!Bnl2*5x z(TEGbcjcH)yCRxDCFuMFIoEVEZCu~Q`w96f-K6D!S{y-h2YB_7O!P}cX3{i*2O9!Y zezo88CW*Sw4|DEWdpKuGJlz^eBjD$>va_;9-KA^CFx$?$GG%=n2%XjBEA{WeFO8}O z6Mvk~>suyy*|*shklXn|(zzd1U)l0nQPba!Lb+#vBfAf8!112O+aFYG1SLCukIJRV zILlqW_sMgNxj<}>zI3+u*jjp%J@Y_zdoiu8Hj~_+Xhe=-1uj)d{7!3LjKNlSs^KZh z{)%CdK$|XFpa97*-K&1fElvH*zy&k*-Aa!q<7w`0*y&jC>m|GdZa2YwM(tgG%%n_a zMMaP1fmhmOn6FGmYclhgKQkYjpW>7+&g$w5<9@0VV}{zdQ;=y`1Sq#pRjVA{Pg4nIc`BSwO|1td4!ocBBQ zZJk#yAbN4s-;;GV^(XdUg5@jKzbgxOCI&Ef&*JnET@(yy@-tO`)ruqc{EJ-2!CH5-(k9Of87M4KTT@ ztTgjGZAhH#X<=IOKVmNr-XRK>!BRL(iwNg33^eXM(SSXQe`f4}yX`b^k{s=SkN;Z) zK=8kh6$JRL9G02*ty~uLdtMfjfcm?!fYRdpRt^VC?)-*NkOL+BPM!qN2BG|phr&`6 zp#O|OkQi-(>~G{?I9hn4)YfU0uKlJPkV6g z#tRaH`YR8M7%D9e0D}LAekd$xupxk@fPUp+BXyV8ge1ZJDu+UFxF; z9RDDGt^{Fe8W23}hb?e-x9A@$K~pv7VDQg{pxEK$5rkvy-z!1zEwJ+q)k}d_7H&fB zU?25y$5#&GCT_;)nTKK9{*&B%iD9)uG1C#brxs9-Yk^saF9w#La0vrXL^Z2uF;WwY zCA^Ni5W$2bSHO7%Q@|Htf%q(&QP%BJ6v@JanOWn#>k_48#iC>7OQr=IKAMHTH7p;IJn4R6-^*SUqj&p%{w~Vgyy9il0p4aLx)!o+Q-G{QncQDQVBWlSKgY9eOp`j zF}?zAyANCDjwzXAGsLCC-$+vw6R+F?`Z>4|&SC}ZO$XyA9~s1P{9Q725^Wkoy|f57 z<;IAFuowCtOW0`EjBh^dsOCz_-C$o#_)?Y4;wj$k)7|OOHVubC7aL5&K&Au?Din$V zT{=2m(UNVo&ZBII$yfclsCSl85zU# zM47Z-5Gq6xVB_Ghn6ehY&w7+#bqjP0xa+z#hmi@6jQLgwPV0D?YOgtRr~Kfs$a+_? zeUAN>#XSpzp`_r{cTL5+noDvX^p05&)l3+hE@AkKhctr|{_EF{dWHeY8Msn?D83Kd!fi>hCt+<)*Xl4fMtNIbW<0yE+LQjRT+*X|M_mCTsQ+I+Mm z0gB@-5KB+=QR}&;reZJ|PQJY@IGq>}7%YksiuOPSFDDqqZMlc4*mMMLhQOstYS-#0 zB@Xbswsgv8Yrp4-oOC?aH{sFJg3Tj_D`}IKap=>{GIIH7)h#s*+i)L4!yRuXV`4z` z0(p;c5{j^yoC;+cHU(KG4O`St4L?4{+gCr!NjJ^zb5B`0lUb0kTZl$}>h`KI?Kq-4 zE{goy^>_mw;r12XaWtHI79Du@F!qxN%DiKvpF*LKGxscO;ksaB@lc_4X8v8Jr9(o?~AT7{~6=tf{SL*kf|})qgRSoRK^1C6e%=ObA$aZ#fvu?6#~g z9E_@e8k<+{7c;4o5d~W_T9Aq+1~`)}Ndy z59dl{TZA#dEsc zQdUnhvYO%&^wTfZbJg+1t3*n&&3ZSylJ=xf+B>#IznHDscDY4LAC0DcgbsMKFti zbA_aa+BEu#W~%nL)G|f<@6`If77G7wz5~IjJ2HB(@=3 z$#&)ohRjFu3#MgmOja9IQp{4enrJB8_n$O#I-Z7F+mRAwWGlKy<(Qrm)F@D|ytwK| z)pDNF^6_}4#`+Y$t?klYZONY=$t(reaFSag)z$?5LmqZJ*6M~%1Kmu!$;plz>K1Wf zD&o$#P}fw^ECU|0c*Cnt_+2Z_{;_!&Q4-0R+!-|{_jl^jJx&_S+**%NckBY+ajNsa z*KNc%NtNo99Myl8Wi~ybi;vh(HZ4b{$dV~cC#hIZ)^k!jLfUX&7iDUMN9E(XG5o!x z-SsmFyLuMc`&Z|NGRv7OH~|Q0eq#Ckfo$=-Y}&(Rys~I}74^xzQ1<+LeDHU z5^5fGnN^v6Us{)bmGU#ja0fkHPFtgnlpWbLrlEzXp}x2y$tGJ|6ek0+Nv2WHWF(wt zrFxjV-`wal%(FW`zcz^VG5rzfmBl<4nV)lM=W>!-vVVQK8};fWu~_jbeFFct=%h6a zqy?duJktno?H1lZZ&LQ$tS(LsmA+DOJvl_cpwG;Z$ zo8Vv~?i8NRD~6Gcc^hh@Kd(_JqYC&WwqE1JUp^etzP*A9ngeguQFN zL-#!`0)+$8AHr*NoF%o7n$Atd2MYYF9bLUFG^^kORme~92oK8Y%%hSEdZ^cW+lZ~3 z#M51E-DZN`G?w>J{n+X`V*ep_!VcD$tU4rB?;?R3OsR((Z&%(7yYE1FAc3k64`|G%$RiA3Ruq+PT96b3T%9I z-g-J(t7Udk-E5noAuN#7FnY+MCi3MlVa&XPDw5(U&A;4zKj|?rHp1c*BjCQnLyslr zoL)6;@Rcc5(J`NOr_C?GsutZ@Ro`9rT$2Hrv9sYc6@KdAp01&KR#jDi&M3p2Zqvqu zk)pW^Pnud5^}5c}y3<`;CV^D>>ea0XK}e?ro3F{a#9_Z>?o4_)=LF*!U73x}NX+N% z!F-bYo&^!Lwnia(BsgtS>D0?(EiP}Lt%^IUuTTX#v#Z&yQ--WAk)FlX)51$vHy;i& z>LUlens(8Co;v0W*hY@?&c?{9 ztnd4rpTDJ655mWixVj;UspK*223g)nZ);Vywv(s=mXG#EAG7;~;V{h|=uy^o>B)I2 zQ+xs*;au0T?v;prh_}|CH6!FpX6`0pJC^4V!%V~0fbHQ%WSD1;pm%KS>80ZoT-gO| zeDDL_R}SY|aknS5pBnuzrJG=lf3ByOCK4xf!XZUQL)QI~>jH%^mAH#CZH-&tEQ}z> zOX^zjH64#u;P94E>z1dqL!pFzP#LB(MV1|MaK&nxqy;5vq0qGy@nyJI=OkKEoUl9V zK4No_ZaajuxKAb#)#Oxui#PSF3Dbe^Q$8JnN3rcW+!1sWRTRtSPhRZ4Xi70-Si@U( zM}2qdou-j#|jiOT};Xv&ks13W7=E6JzkASl9e%&O7Fn5+Q$#+VhQQ*4F(`o1|!0O7} z>AGMw9{Z^~mCjiDHwyQNRE~<44>SJGobW-fPOy-t2W3bMaQ!@=QAe~FII9_Gg+>Le zs!~jR4YylDJ@YHzVU%}c64?6cl{xt-CZALaSu2?T$j8yRvUW>YIHBu1hj&L^-N^H0 zLr{SsYVX;DJYvZ?|951raD+?+I$Z(YLA@%HhKj7ILCBOvanuZ-jM)7LnTP}QC$c=h zdnJd_J@&B8$#%x@m)Bb<996lu8OzROg_0}=EG&Y4ika%|J z-HeZ>jmCjr%pQ1w%pk=Lm?)phb*YRtl8#|ux~L>B%Dwka)GoUP4rH2boG0hcL-u>- zkz>bI%Iq}wM@|{<&72emLLW%&__2TeFu}v-@D`3T^E-`jff(=Ffnl5G{78U2?h9gq zE6~Hi5%F;&6dThjcy~Xq5oSrQGUbH}^QXjdkrMfor$r7Tt2@GwoW#;Ze;k&^iV|e{ zfZj?xuxjDA_+kG7qRR5MuFXNY-K%tvtZh&bhVg12!q!Z(eJrtct|cVm70><; zYVI$eIX^9XI}nM6H67G`7;VgpkSWKDXV}`9GL+w`ueXO{V6D{8I^f1KQ)wCOZ@_*u QWFeRa9}{?@a{J-`0h_`QVgLXD diff --git a/conf/lms.conf b/conf/lms.conf index 82b565ce..d3d7675b 100644 --- a/conf/lms.conf +++ b/conf/lms.conf @@ -19,6 +19,13 @@ db-show-queries = false; listen-port = 5082; listen-addr = "0.0.0.0"; behind-reverse-proxy = false; +# original-ip-header and trusted-proxies are used only if behind-reverse-proxy is set to true +original-ip-header = "X-Forwarded-For"; +trusted-proxies = +( + "127.0.0.1", + "::1" +); # If enabled, these files have to exist and have correct permissions tls-enable = false; diff --git a/src/lms/main.cpp b/src/lms/main.cpp index f2586a48..bd6f3467 100644 --- a/src/lms/main.cpp +++ b/src/lms/main.cpp @@ -137,7 +137,16 @@ namespace lms // log-config pt.put("server.application-settings.log-config", core::logging::WtLogger::computeLogConfig(minSeverity)); - pt.put("server.application-settings.behind-reverse-proxy", core::Service::get()->getBool("behind-reverse-proxy", false)); + + // Reverse proxy + if (core::Service::get()->getBool("behind-reverse-proxy", false)) + { + pt.put("server.application-settings.trusted-proxy-config.original-ip-header", core::Service::get()->getString("original-ip-header", "X-Forwarded-For")); + core::Service::get()->visitStrings("trusted-proxies", [&](std::string_view trustedProxy) { + pt.add("server.application-settings.trusted-proxy-config.trusted-proxies.proxy", std::string{ trustedProxy }); + }, + { "127.0.0.1", "::1" }); + } { boost::property_tree::ptree viewport;