mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
53d74768ad
node001 passes TLS through without opening it, so every request from the tunneled hosts arrives from 46.224.26.65. Wordfence locked that address out after 20 failed logins on 2026-10-26, and with it everyone who logs in to scoutingmbg.nl. With a PROXY header from node001, Envoy puts the visitor's address in X-Forwarded-For instead. The header is optional: s2 and ntfy2 point straight at home, and node001's proxy on port 80 sends none either.
24 lines
931 B
YAML
24 lines
931 B
YAML
# node001 passes TLS for the tunneled hosts through without opening it, so
|
|
# without this every request arrives from 46.224.26.65. Wordfence locks that
|
|
# address out after 20 failed logins (2026-10-26), and with it everyone who
|
|
# logs in to scoutingmbg.nl. node001 puts a PROXY header with the visitor's
|
|
# address in front of each connection; Envoy takes the address from there
|
|
# and adds it to X-Forwarded-For.
|
|
#
|
|
# Optional, because s2 and ntfy2 point straight at home and their clients
|
|
# send no header, and neither does node001's proxy on port 80. The price:
|
|
# whoever connects to the home address directly can send a header of their
|
|
# own and claim any address.
|
|
apiVersion: gateway.envoyproxy.io/v1alpha1
|
|
kind: ClientTrafficPolicy
|
|
metadata:
|
|
name: proxy-protocol
|
|
namespace: envoy-gateway-system
|
|
spec:
|
|
targetRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: homelab
|
|
proxyProtocol:
|
|
optional: true
|