Ruben Hensen 53d74768ad gateway: take the visitor's address from a PROXY header ...

node001 passes TLS through without opening it, so every request from
the tunneled hosts arrives from 46.224.26.65. Wordfence locked that
address out after 20 failed logins on 2026-10-26, and with it everyone
who logs in to scoutingmbg.nl. With a PROXY header from node001, Envoy
puts the visitor's address in X-Forwarded-For instead.

The header is optional: s2 and ntfy2 point straight at home, and
node001's proxy on port 80 sends none either.

2026-10-26 23:11:38 +01:00

..

envoyproxy.yaml

gateway: take over ports 80 and 443 from ingress-nginx

2026-10-23 21:02:52 +02:00

gateway.yaml

authentik: serve auth.scoutingmbg.nl

2026-10-24 18:52:24 +02:00

gatewayclass.yaml

gateway: add the Envoy GatewayClass and Gateway

2026-10-23 17:27:02 +02:00

https-redirect.yaml

gatus: serve s2.rubenhensen.nl through the Gateway as well

2026-10-23 17:30:42 +02:00

proxy-protocol.yaml

gateway: take the visitor's address from a PROXY header

2026-10-26 23:11:38 +01:00

retry-policy.yaml

immich: remove sol-auth

2026-10-24 14:14:43 +02:00