diff options
| author |  Alexandre Alapetite <alexandre@alapetite.fr>
| 2023-07-30 12:59:18 +0200 |
|---|---|---|
| committer |  GitHub <noreply@github.com>
| 2023-07-30 12:59:18 +0200 |
| commit | e7689459f25663e00b4f5814a3608872ff36b582 (patch) | |
| tree | 28a747f685a782fd7aa70dd4211106fe412b774a /Docker/entrypoint.sh | |
| parent | 0182d84142fb5f4c9514371f8fc0e6ce3640a6e1 (diff) | |
Rework trusted proxies (#5549)
* Rework trusted proxies
Fix https://github.com/FreshRSS/FreshRSS/issues/5502
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/3226
New environment variable `TRUSTED_PROXY`: set to 0 to disable, or to a list of trusted IP ranges compatible with https://httpd.apache.org/docs/current/mod/mod_remoteip.html#remoteiptrustedproxy
New internal environment variable `CONN_REMOTE_ADDR` to remember the true IP address of the connection (e.g. last proxy), even when using mod_remoteip.
Current working setups should not observe any significant change.
* Minor whitespace
* Safer trusted sources during install
Rework of https://github.com/FreshRSS/FreshRSS/pull/5358
https://github.com/FreshRSS/FreshRSS/issues/5357
* Minor readme
Diffstat (limited to 'Docker/entrypoint.sh')
| -rwxr-xr-x | Docker/entrypoint.sh | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/Docker/entrypoint.sh b/Docker/entrypoint.sh index 1b25026b5..6cb5a49b4 100755 --- a/Docker/entrypoint.sh +++ b/Docker/entrypoint.sh @@ -11,6 +11,16 @@ if [ -n "$LISTEN" ]; then find /etc/apache2/ -type f -name FreshRSS.Apache.conf -exec sed -r -i "\\#^Listen#s#^.*#Listen $LISTEN#" {} \; fi +if [ -n "$TRUSTED_PROXY" ]; then + if [ "$TRUSTED_PROXY" -eq 0 ]; then + # Disable RemoteIPHeader and RemoteIPTrustedProxy + find /etc/apache2/ -type f -name FreshRSS.Apache.conf -exec sed -r -i "/^\s*RemoteIP.*$/s/^/#/" {} \; + else + # Custom list for RemoteIPTrustedProxy + find /etc/apache2/ -type f -name FreshRSS.Apache.conf -exec sed -r -i "\\#^\s*RemoteIPTrustedProxy#s#^.*#\tRemoteIPTrustedProxy $TRUSTED_PROXY#" {} \; + fi +fi + if [ -n "$OIDC_ENABLED" ] && [ "$OIDC_ENABLED" -ne 0 ]; then a2enmod -q auth_openidc fi |