confdroid/confdroid_apache
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

add ranges to template and update Readme

Browse Source
This commit is contained in:
Arne Teuke
2026-03-14 15:09:28 +01:00
parent c6e13a366c
commit 54b1322717
3 changed files with 22 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -45,7 +45,7 @@ Configuration
Optional Optional
- manage remoteIP logging if running behind a Loadbalancer like HAproxy: if `ae_use_lb` is set to `true`, a configuration file `etc/httpd/conf.d/loadbalancer-remoteip.conf`is created and configures apache/httpd to use the remote header. This allows proper fail2ban protection even behind the Loadbalancer. Make sure to set `ae_trusted_proxy`to the proper IP or range for the loadbalancer! - manage remoteIP logging if running behind a Loadbalancer like HAproxy: if `ae_use_lb` is set to `true`, a configuration file `etc/httpd/conf.d/loadbalancer-remoteip.conf`is created and configures apache/httpd to use the remote header. This allows proper fail2ban protection even behind the Loadbalancer. Make sure to set `ae_trusted_proxy` and `ae_internal_proxy` to the proper IP or range for the loadbalancer!
Maintenance Maintenance

12
manifests/params.pp
View File

@@ -30,9 +30,12 @@
# to apply the changes. This is required when using httpd behind a # to apply the changes. This is required when using httpd behind a
# load balancer like haproxy, otherwise all client ips will be logged # load balancer like haproxy, otherwise all client ips will be logged
# as the load balancer ip. # as the load balancer ip.
# @param [String] ae_trusted_proxy the IP address of the trusted proxy, # @param [Array] ae_trusted_proxy the IP addresses of the trusted proxies,
# i.e. the load balancer. This is required when `ae_use_lb` is set to # i.e. the load balancers. This is required when `ae_use_lb` is set to
# true, and defaults to '10.0.1.0/24'. # true, and defaults to ['127.0.0.1','10.0.1.0/24'].
# @param [Array] ae_internal_proxy the IP addresses of the internal proxies,
# i.e. the internal load balancers. This is required when `ae_use_lb` is set to
# true, and defaults to ['127.0.0.1'].
########################################################################### ###########################################################################
class confdroid_apache::params ( class confdroid_apache::params (
@@ -58,7 +61,8 @@ class confdroid_apache::params (
# loadbalancer # loadbalancer
Boolean $ae_use_lb = false, Boolean $ae_use_lb = false,
String $ae_trusted_proxy = '10.0.1.0/24', Array $ae_trusted_proxy = ['127.0.0.1','10.0.1.0/24'],
Array $ae_internal_proxy = ['127.0.0.1','10.0.1.0/24'],
) { ) {
# facts # facts

19
templates/loadbalancer/remoteip.conf.erb
View File

@@ -3,10 +3,17 @@
########## manual changes will be overwritten !!! ########## ########## manual changes will be overwritten !!! ##########
############################################################################### ###############################################################################
RemoteIPHeader X-Forwarded-For <IfModule remoteip_module>
RemoteIPTrustedProxy <%= @ae_trusted_proxy %> RemoteIPHeader <%= @remoteip_header %>
RemoteIPInternalProxy <%= @ae_trusted_proxy %> <% @trusted_proxies.each do |proxy| -%>
RemoteIPTrustedProxy <%= proxy %>
<% end -%>
<% @internal_proxies.each do |proxy| -%>
RemoteIPInternalProxy <%= proxy %>
<% end -%>
# Use real client IP in all standard log formats
LogFormat "%a %l %u %t \"%r\" %>s %b" common
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
</IfModule>
# mod_remoteip rewrites client address for %a; use it in common/combined logs.
LogFormat "%a %l %u %t \"%r\" %>s %b" common
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined