Get forwarded IP after Caddy 2.4.6.

[JackBailey]

realip doesn't work after Caddy 2.4.6.

How should retrieving remote ips be done behind a proxy after Caddy 2.4.6?

[hslatman]

Interesting. Thank you for the heads-up.

I think a solution would involve using the changes that are being worked on as discussed in this issue: caddyserver/caddy#4924. I'll have to check it out to see if changes are required for this bouncer.

[JackBailey]

Caddy v2.6.3 has been released adding a global trusted_proxies option - caddyserver/caddy#5103

Does this addition help at all with this issue?

[dd310]

Caddy 2.7.0-beta1 introduced client_ip in the logs.
Maybe the bouncer could be updated to support this new feature?

caddyserver/caddy#5104

[hslatman]

@dd310 thank you 🙂

I've started a PR to upgrade the dependencies. Will need to do some testing with the new Caddy beta.

If things look good, I can cut a new release. After that I'll upgrade other dependencies too for yet another release.

[dd310]

Thank you for your time!

I noticed caddy 2.7 beta 2 is out, and I guess the next release will be stable.

[JackBailey]

Looks like Caddy 2.7 stable is out now, any updates on this?

[hslatman]

@JackBailey you're right! 🙂

I've been working on the PR and updating it several times, because there were some last-minute breaking issues in Caddy. But on v2.7.3 things are looking OK: #18.

I intend to release this very soon now. Need to find a bit of time, because I have some follow-up wants/wishes and also want to find out what's the best way to go about the "real client IP": would it only be some configuration, or will code changes be required; or maybe both? This issue will likely help me do the right thing 🙂

[serfriz]

Hey, I saw there is a new release, does it already include the additional changes to use the real IP of clients when the proxy is behind Cloudflare? Thank you!

[JackBailey]

Need to find a bit of time, because I have some follow-up wants/wishes and also want to find out what's the best way to go about the "real client IP": would it only be some configuration, or will code changes be required

It looks like client_ip will return the proper ip, works fine for me @hslatman

Trying to use Crowdsec with Caddy 2.7 gives me the error in #17, not sure if that's because of Caddy 2.7 or not, but looks like an issue trying to retrieve api_url from the config.

[iurab]

With Caddy 2.7, I can also see the real ip in the client_ip field.
I've tried a temporary ban in crowdsec for my ip and the site was still reachable. So I guess caddy-crowdsec-bouncer it's not yet updated to use it.

[dd310]

I can also confirm that caddy 2.7.3 will return client_ip correctly when i set client_ip_headers Cf-Connecting-Ip

[hslatman]

I still need to take a look at the client_ip; it's not in the latest release yet, but I'll make a new one when it works with that. Will do it ASAP when time allows.

[dd310]

Thank you for the great work!

[hslatman]

The release is out: https://github.com/hslatman/caddy-crowdsec-bouncer/releases/tag/v0.3.1. I've tested it locally only, but the results look OK 🙂

@JackBailey do you still have that issue with the API URL? I don't think it's related to the Caddy version, as mine parsed fine, but then again, I'm usually testing with a local config.json. Maybe pushing it via the admin API makes a difference?

@iurab did you test it with a proxy in front, or without? Without a proxy it should still have worked on the old release, but it depends on whether you use the streaming bouncer or the live bouncer. The streaming bouncer will poll every X period of time, based on the ticker interval. The live bouncer will perform a look up every HTTP request. If you're using the streaming bouncer (the default), the decision may not have been received by the bouncer yet.

The streaming bouncer is technically not really a streaming bouncer, but it's the name the CrowdSec team gave to the Go package I'm using in this bouncer.

[dd310]

Just for the sake of clarity, I think it may be helpful to include in the readme that trusted_proxies needs to be set globally and that it might be necessary to use client_ip_header to choose where client_ip is read from (e.g. with Cloudflare it only works by specifing Cf-Connecting-Ip)

[hslatman]

@dd310 thanks! I've pushed a commit that directs users to the Caddy docs on those: 12a8d66.

I might add some example configurations using that in the near future. I've also been thinking about some more elaborate example setups, so it might become part of that too.