Caddy www block lacks trusted_proxies (strip client-supplied XFF at the edge) #129

Nytt ärende

Stängd

öppnade 2026-07-19 06:58:04 +00:00 av supernaut · 1 kommentar

supernaut kommenterad

2026-07-19 06:58:04 +00:00

Ägare

Severity: MEDIUM (defence-in-depth) — pre-onboarding infra audit (2026-07-19).

The www.gitborg.se block (ansible/roles/caddy/templates/Caddyfile.j2:60-67) is a bare reverse_proxy bitborg-web:3000 with no trusted_proxies, so Caddy appends the real client IP to any client-supplied X-Forwarded-For rather than stripping it. bitborg-web PR #60 fixes the app side (read the rightmost/last XFF hop), but the edge should also strip client-supplied XFF for defence-in-depth — as Forgejo already does (REVERSE_PROXY_TRUSTED_PROXIES + REVERSE_PROXY_LIMIT=1, app.ini.j2:69-74).

Ask

Add trusted_proxies (the podman subnet) to the www block so Caddy replaces rather than appends XFF. Related: monitoring-VM Caddy pasta client-IP loss #100. Effort S.

**Severity: MEDIUM** (defence-in-depth) — pre-onboarding infra audit (2026-07-19). The `www.gitborg.se` block (`ansible/roles/caddy/templates/Caddyfile.j2:60-67`) is a bare `reverse_proxy bitborg-web:3000` with **no `trusted_proxies`**, so Caddy appends the real client IP to any client-supplied `X-Forwarded-For` rather than stripping it. bitborg-web PR #60 fixes the app side (read the rightmost/last XFF hop), but the edge should also strip client-supplied XFF for defence-in-depth — as Forgejo already does (`REVERSE_PROXY_TRUSTED_PROXIES` + `REVERSE_PROXY_LIMIT=1`, `app.ini.j2:69-74`). ### Ask Add `trusted_proxies` (the podman subnet) to the `www` block so Caddy replaces rather than appends XFF. Related: monitoring-VM Caddy pasta client-IP loss #100. Effort S.

supernaut lade till etiketterna

area/infra

area/security

ready-for-implementation

type

task

2026-07-19 06:59:37 +00:00

supernaut lade till detta till projektet Bitborg Infrastructure

2026-07-19 07:04:47 +00:00

supernaut kommenterad

2026-07-20 09:29:59 +00:00

Upphovsperson

Ägare

Implemented on branch feat/129-caddy-trusted-proxies (committed, push pending — SSH agent re-locked). Added caddy_trusted_proxies (the internal podman subnet, 10.89.0.0/24) and trusted_proxies to all three reverse_proxy blocks (www, kanidm, forgejo), not just www — Caddy is the edge and sees the real client IP via socket activation (#81), so real clients are untrusted and Caddy overwrites their X-Forwarded-For, stripping spoofed hops. Rendered Caddyfile validated with caddy validate (2.11.4). Ready to push + PR + apply.

Implemented on branch `feat/129-caddy-trusted-proxies` (committed, **push pending** — SSH agent re-locked). Added `caddy_trusted_proxies` (the internal podman subnet, 10.89.0.0/24) and `trusted_proxies` to all three reverse_proxy blocks (www, kanidm, forgejo), not just www — Caddy is the edge and sees the real client IP via socket activation (#81), so real clients are untrusted and Caddy overwrites their X-Forwarded-For, stripping spoofed hops. Rendered Caddyfile validated with `caddy validate` (2.11.4). Ready to push + PR + apply.

supernaut refererade till detta ärende från en incheckning

2026-07-20 11:33:36 +00:00

feat(caddy): strip client-supplied X-Forwarded-For at the edge (#129)

supernaut hänvisade till detta ärende från en ändringsförfrågan som kommer att stänga det

2026-07-20 11:34:22 +00:00

strip client-supplied X-Forwarded-For at the edge (#129) #168

supernaut refererade till detta ärende från en incheckning

2026-07-20 12:09:47 +00:00

feat(caddy): strip client-supplied X-Forwarded-For at the edge (#129)

supernaut stängde ärendet

2026-07-20 12:28:25 +00:00

supernaut refererade till detta ärende från en incheckning