Add config for X-Forwarded-For trust
Use the same config option for `set_real_ip_from` when not using proxy protocol. The default remains `0.0.0.0/0`, which is insecure if the ingress is publicly accessible. This at least provides a workaround for
@@ -23,8 +23,8 @@ http {
set_real_ip_from {{ $cfg.ProxyRealIPCIDR }};
real_ip_header proxy_protocol;
{{ else }}
+ set_real_ip_from {{ $cfg.ProxyRealIPCIDR }};
real_ip_header X-Forwarded-For;
- set_real_ip_from 0.0.0.0/0;
{{ end }}
real_ip_recursive on;
